Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 15:12
Static task
static1
Behavioral task
behavioral1
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win7v20210408
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7blissinstallszxckarmaz0rm1onbuildbackdoorbotnetdiscoveryevasioninfostealerspywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3dd4ba94c558b54ba1fe639566cbc368.exe
Resource
win10-en-20210920
arkeichinese_generic_botnetraccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4blisskarmabackdoorbotnetdiscoveryevasioninfostealerpersistencespywarestealersuricatathemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
3dd4ba94c558b54ba1fe639566cbc368.exe
-
Size
237KB
-
MD5
3dd4ba94c558b54ba1fe639566cbc368
-
SHA1
8c44f1c918c3d2fd48694e8af653e473be3e02c1
-
SHA256
c75b223b462ba88c62c1c8d848a845e7aeacc0ec0c96a7ecf1644e782accdd52
-
SHA512
58e828507bd3be52ea340ed835c3dc06a655db0a067c746ef65e7382d2b09eb5e7d6847dc679b89539826b598749e60ddf62859e25930b8e586acc11228bb1fa
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://naghenrietti1.top/
http://kimballiett2.top/
http://xadriettany3.top/
http://jebeccallis4.top/
http://nityanneron5.top/
http://umayaniela6.top/
http://lynettaram7.top/
http://sadineyalas8.top/
http://geenaldencia9.top/
http://aradysiusep10.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
karma
C2
94.103.9.133:39323
Extracted
Family
redline
Botnet
Bliss
C2
185.237.98.178:62607
Signatures
-
Generic Chinese Botnet
A botnet originating from China which is currently unnamed publicly.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
resource yara_rule behavioral2/memory/340-173-0x0000000002210000-0x000000000222F000-memory.dmp family_redline behavioral2/memory/1096-179-0x0000000002260000-0x0000000002283000-memory.dmp family_redline behavioral2/memory/340-181-0x0000000002470000-0x000000000248E000-memory.dmp family_redline behavioral2/memory/1096-184-0x0000000002530000-0x0000000002552000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
-
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
-
Arkei Stealer Payload 1 IoCs
resource yara_rule behavioral2/memory/2264-139-0x0000000000400000-0x000000000044D000-memory.dmp family_arkei -
Chinese Botnet Payload 1 IoCs
resource yara_rule behavioral2/memory/2164-205-0x0000000010000000-0x0000000010018000-memory.dmp unk_chinese_botnet -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
pid Process 2680 FC29.exe 3148 169.exe 2264 7D3.exe 792 DB0.exe 340 SindonsWelfare_2021-09-26_15-02.exe 1096 SolanumsYoghurt_2021-09-26_14-52.exe 2164 fbf.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FC29.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FC29.exe -
Deletes itself 1 IoCs
pid Process 2648 Process not Found -
Loads dropped DLL 8 IoCs
pid Process 2264 7D3.exe 2264 7D3.exe 2264 7D3.exe 3148 169.exe 3148 169.exe 3148 169.exe 3148 169.exe 3148 169.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000700000001aba9-120.dat themida behavioral2/memory/2680-122-0x0000000000970000-0x0000000000971000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\Uuuocai.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\fbf.exe" fbf.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FC29.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\J: fbf.exe File opened (read-only) \??\L: fbf.exe File opened (read-only) \??\O: fbf.exe File opened (read-only) \??\P: fbf.exe File opened (read-only) \??\W: fbf.exe File opened (read-only) \??\X: fbf.exe File opened (read-only) \??\Y: fbf.exe File opened (read-only) \??\B: fbf.exe File opened (read-only) \??\E: fbf.exe File opened (read-only) \??\G: fbf.exe File opened (read-only) \??\H: fbf.exe File opened (read-only) \??\U: fbf.exe File opened (read-only) \??\Z: fbf.exe File opened (read-only) \??\M: fbf.exe File opened (read-only) \??\N: fbf.exe File opened (read-only) \??\S: fbf.exe File opened (read-only) \??\T: fbf.exe File opened (read-only) \??\F: fbf.exe File opened (read-only) \??\I: fbf.exe File opened (read-only) \??\K: fbf.exe File opened (read-only) \??\Q: fbf.exe File opened (read-only) \??\R: fbf.exe File opened (read-only) \??\V: fbf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2680 FC29.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2072 set thread context of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
pid pid_target Process procid_target 3792 2264 WerFault.exe 73 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3dd4ba94c558b54ba1fe639566cbc368.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 fbf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz fbf.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2404 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2228 3dd4ba94c558b54ba1fe639566cbc368.exe 2228 3dd4ba94c558b54ba1fe639566cbc368.exe 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found 2648 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2648 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2228 3dd4ba94c558b54ba1fe639566cbc368.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeRestorePrivilege 3792 WerFault.exe Token: SeBackupPrivilege 3792 WerFault.exe Token: SeDebugPrivilege 3792 WerFault.exe Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeDebugPrivilege 2680 FC29.exe Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found Token: SeShutdownPrivilege 2648 Process not Found Token: SeCreatePagefilePrivilege 2648 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2164 fbf.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2072 wrote to memory of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 PID 2072 wrote to memory of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 PID 2072 wrote to memory of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 PID 2072 wrote to memory of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 PID 2072 wrote to memory of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 PID 2072 wrote to memory of 2228 2072 3dd4ba94c558b54ba1fe639566cbc368.exe 69 PID 2648 wrote to memory of 2680 2648 Process not Found 70 PID 2648 wrote to memory of 2680 2648 Process not Found 70 PID 2648 wrote to memory of 2680 2648 Process not Found 70 PID 2648 wrote to memory of 3148 2648 Process not Found 72 PID 2648 wrote to memory of 3148 2648 Process not Found 72 PID 2648 wrote to memory of 3148 2648 Process not Found 72 PID 2648 wrote to memory of 2264 2648 Process not Found 73 PID 2648 wrote to memory of 2264 2648 Process not Found 73 PID 2648 wrote to memory of 2264 2648 Process not Found 73 PID 2648 wrote to memory of 792 2648 Process not Found 74 PID 2648 wrote to memory of 792 2648 Process not Found 74 PID 3148 wrote to memory of 3880 3148 169.exe 78 PID 3148 wrote to memory of 3880 3148 169.exe 78 PID 3148 wrote to memory of 3880 3148 169.exe 78 PID 3880 wrote to memory of 2404 3880 cmd.exe 80 PID 3880 wrote to memory of 2404 3880 cmd.exe 80 PID 3880 wrote to memory of 2404 3880 cmd.exe 80 PID 792 wrote to memory of 340 792 DB0.exe 84 PID 792 wrote to memory of 340 792 DB0.exe 84 PID 792 wrote to memory of 340 792 DB0.exe 84 PID 792 wrote to memory of 1096 792 DB0.exe 86 PID 792 wrote to memory of 1096 792 DB0.exe 86 PID 792 wrote to memory of 1096 792 DB0.exe 86 PID 792 wrote to memory of 2164 792 DB0.exe 87 PID 792 wrote to memory of 2164 792 DB0.exe 87 PID 792 wrote to memory of 2164 792 DB0.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2072 -
C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"C:\Users\Admin\AppData\Local\Temp\3dd4ba94c558b54ba1fe639566cbc368.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2228
-
-
C:\Users\Admin\AppData\Local\Temp\FC29.exeC:\Users\Admin\AppData\Local\Temp\FC29.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2680
-
C:\Users\Admin\AppData\Local\Temp\169.exeC:\Users\Admin\AppData\Local\Temp\169.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3148 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\169.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3880 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:2404
-
-
-
C:\Users\Admin\AppData\Local\Temp\7D3.exeC:\Users\Admin\AppData\Local\Temp\7D3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:2264 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2264 -s 9282⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3792
-
-
C:\Users\Admin\AppData\Local\Temp\DB0.exeC:\Users\Admin\AppData\Local\Temp\DB0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"2⤵
- Executes dropped EXE
PID:340
-
-
C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"2⤵
- Executes dropped EXE
PID:1096
-
-
C:\Users\Admin\AppData\Local\Temp\fbf.exe"C:\Users\Admin\AppData\Local\Temp\fbf.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Checks processor information in registry
- Suspicious use of SetWindowsHookEx
PID:2164
-