Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 15:02
Static task
static1
Behavioral task
behavioral1
Sample
e98e80b300af28043252190b020ee173.exe
Resource
win7v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e98e80b300af28043252190b020ee173.exe
Resource
win10-en-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4blisskarmabackdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
e98e80b300af28043252190b020ee173.exe
-
Size
139KB
-
MD5
e98e80b300af28043252190b020ee173
-
SHA1
df38365f73543166e8fb859908f0b3dbc9b6e64e
-
SHA256
ebcecaf7cc142a2954b15d4390e5275aed5a7c8f70a7c777c0288b5f3c2312ac
-
SHA512
11d40f6529dd546cdf97c73183393418e728a64320cb1345d43056f002e469ab16eae64eb4b628b195234cf07843cb2e7fb659d46598c3de951d73d1b680b762
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
karma
C2
94.103.9.133:39323
Extracted
Family
redline
Botnet
Bliss
C2
185.237.98.178:62607
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
resource yara_rule behavioral2/memory/1324-173-0x0000000002290000-0x00000000022AF000-memory.dmp family_redline behavioral2/memory/1324-175-0x00000000026B0000-0x00000000026CE000-memory.dmp family_redline behavioral2/memory/1852-176-0x0000000002250000-0x0000000002273000-memory.dmp family_redline behavioral2/memory/1852-178-0x00000000024E0000-0x0000000002502000-memory.dmp family_redline behavioral2/memory/1852-196-0x00000000004D0000-0x000000000057E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral2/memory/2996-139-0x0000000000400000-0x000000000044D000-memory.dmp family_arkei -
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral2/memory/1632-205-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 3020 A52.exe 1920 F54.exe 2996 1550.exe 1044 19E5.exe 1324 SindonsWelfare_2021-09-26_15-02.exe 1852 SolanumsYoghurt_2021-09-26_14-52.exe 1632 fbf.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion A52.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion A52.exe -
Deletes itself 1 IoCs
pid Process 3008 Process not Found -
Loads dropped DLL 8 IoCs
pid Process 2996 1550.exe 2996 1550.exe 2996 1550.exe 1920 F54.exe 1920 F54.exe 1920 F54.exe 1920 F54.exe 1920 F54.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000300000001abdc-120.dat themida behavioral2/memory/3020-122-0x0000000000C40000-0x0000000000C41000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uuuocai.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbf.exe" fbf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA A52.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\V: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\L: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\X: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\E: fbf.exe File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\R: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\W: fbf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 3020 A52.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2348 set thread context of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 800 2996 WerFault.exe 74 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e98e80b300af28043252190b020ee173.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e98e80b300af28043252190b020ee173.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e98e80b300af28043252190b020ee173.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2144 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2432 e98e80b300af28043252190b020ee173.exe 2432 e98e80b300af28043252190b020ee173.exe 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found 3008 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3008 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2432 e98e80b300af28043252190b020ee173.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeRestorePrivilege 800 WerFault.exe Token: SeBackupPrivilege 800 WerFault.exe Token: SeDebugPrivilege 800 WerFault.exe Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeDebugPrivilege 3020 A52.exe Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeDebugPrivilege 1324 SindonsWelfare_2021-09-26_15-02.exe Token: SeDebugPrivilege 1852 SolanumsYoghurt_2021-09-26_14-52.exe Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found Token: SeShutdownPrivilege 3008 Process not Found Token: SeCreatePagefilePrivilege 3008 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1632 fbf.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2348 wrote to memory of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 PID 2348 wrote to memory of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 PID 2348 wrote to memory of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 PID 2348 wrote to memory of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 PID 2348 wrote to memory of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 PID 2348 wrote to memory of 2432 2348 e98e80b300af28043252190b020ee173.exe 70 PID 3008 wrote to memory of 3020 3008 Process not Found 71 PID 3008 wrote to memory of 3020 3008 Process not Found 71 PID 3008 wrote to memory of 3020 3008 Process not Found 71 PID 3008 wrote to memory of 1920 3008 Process not Found 73 PID 3008 wrote to memory of 1920 3008 Process not Found 73 PID 3008 wrote to memory of 1920 3008 Process not Found 73 PID 3008 wrote to memory of 2996 3008 Process not Found 74 PID 3008 wrote to memory of 2996 3008 Process not Found 74 PID 3008 wrote to memory of 2996 3008 Process not Found 74 PID 3008 wrote to memory of 1044 3008 Process not Found 75 PID 3008 wrote to memory of 1044 3008 Process not Found 75 PID 1920 wrote to memory of 3780 1920 F54.exe 79 PID 1920 wrote to memory of 3780 1920 F54.exe 79 PID 1920 wrote to memory of 3780 1920 F54.exe 79 PID 3780 wrote to memory of 2144 3780 cmd.exe 81 PID 3780 wrote to memory of 2144 3780 cmd.exe 81 PID 3780 wrote to memory of 2144 3780 cmd.exe 81 PID 1044 wrote to memory of 1324 1044 19E5.exe 82 PID 1044 wrote to memory of 1324 1044 19E5.exe 82 PID 1044 wrote to memory of 1324 1044 19E5.exe 82 PID 1044 wrote to memory of 1852 1044 19E5.exe 84 PID 1044 wrote to memory of 1852 1044 19E5.exe 84 PID 1044 wrote to memory of 1852 1044 19E5.exe 84 PID 1044 wrote to memory of 1632 1044 19E5.exe 86 PID 1044 wrote to memory of 1632 1044 19E5.exe 86 PID 1044 wrote to memory of 1632 1044 19E5.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"C:\Users\Admin\AppData\Local\Temp\e98e80b300af28043252190b020ee173.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2432
-
-
C:\Users\Admin\AppData\Local\Temp\A52.exeC:\Users\Admin\AppData\Local\Temp\A52.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:3020
-
C:\Users\Admin\AppData\Local\Temp\F54.exeC:\Users\Admin\AppData\Local\Temp\F54.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\F54.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3780 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:2144
-
-
-
C:\Users\Admin\AppData\Local\Temp\1550.exeC:\Users\Admin\AppData\Local\Temp\1550.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2996 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2996 -s 13402⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:800
-
-
C:\Users\Admin\AppData\Local\Temp\19E5.exeC:\Users\Admin\AppData\Local\Temp\19E5.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1324
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1852
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:1632
-