Analysis

  • max time kernel
    150s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    26-09-2021 16:11

General

  • Target

    831ba3bb4dfd40bf0408d07a186eb216.exe

  • Size

    140KB

  • MD5

    831ba3bb4dfd40bf0408d07a186eb216

  • SHA1

    adf6f3514edc63b5ce5b91d3bc781a13bb176247

  • SHA256

    f6ede8409878ceb95b88f9cc7064b816568a0be6a933676709152de794173e1a

  • SHA512

    e1c4f66d3aa75dce06993a49bc511cfaae178651b96860114f49df36ff48a5e4f8c7eb8b26a4675b0d53597a103034a7c06f1be7a4d60fdf9638af15c3546da7

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

karma

C2

94.103.9.133:39323

Extracted

Family

redline

Botnet

Bliss

C2

185.237.98.178:62607

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Generic Chinese Botnet

    A botnet originating from China which is currently unnamed publicly.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Arkei Stealer Payload 1 IoCs
  • Chinese Botnet Payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 2 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 49 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 14 IoCs
  • Suspicious use of FindShellTrayWindow 6 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 46 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\831ba3bb4dfd40bf0408d07a186eb216.exe
    "C:\Users\Admin\AppData\Local\Temp\831ba3bb4dfd40bf0408d07a186eb216.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1216
    • C:\Users\Admin\AppData\Local\Temp\831ba3bb4dfd40bf0408d07a186eb216.exe
      "C:\Users\Admin\AppData\Local\Temp\831ba3bb4dfd40bf0408d07a186eb216.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2044
  • C:\Users\Admin\AppData\Local\Temp\2386.exe
    C:\Users\Admin\AppData\Local\Temp\2386.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1684
  • C:\Users\Admin\AppData\Local\Temp\28C5.exe
    C:\Users\Admin\AppData\Local\Temp\28C5.exe
    1⤵
    • Executes dropped EXE
    PID:588
  • C:\Users\Admin\AppData\Local\Temp\2DD5.exe
    C:\Users\Admin\AppData\Local\Temp\2DD5.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:472
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\2DD5.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:1348
  • C:\Users\Admin\AppData\Local\Temp\3268.exe
    C:\Users\Admin\AppData\Local\Temp\3268.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe
      "C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1748
    • C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
      "C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:972
    • C:\Users\Admin\AppData\Local\Temp\fbf.exe
      "C:\Users\Admin\AppData\Local\Temp\fbf.exe"
      2⤵
      • Executes dropped EXE
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:1708
  • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
    "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe"
    1⤵
    • Executes dropped EXE
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1996
    • C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe
      "C:\Program Files (x86)\Microsoft Ouigga\Uuuocai.exe" Win7
      2⤵
      • Executes dropped EXE
      • Drops file in System32 directory
      • Modifies data under HKEY_USERS
      • Suspicious use of SetWindowsHookEx
      PID:1208

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/472-71-0x0000000000400000-0x000000000044D000-memory.dmp

    Filesize

    308KB

  • memory/472-70-0x0000000000270000-0x000000000029D000-memory.dmp

    Filesize

    180KB

  • memory/588-83-0x0000000000240000-0x00000000002D0000-memory.dmp

    Filesize

    576KB

  • memory/588-84-0x0000000000400000-0x00000000004F1000-memory.dmp

    Filesize

    964KB

  • memory/972-103-0x0000000001FB0000-0x0000000001FD2000-memory.dmp

    Filesize

    136KB

  • memory/972-100-0x0000000001F80000-0x0000000001FA3000-memory.dmp

    Filesize

    140KB

  • memory/972-102-0x0000000004822000-0x0000000004823000-memory.dmp

    Filesize

    4KB

  • memory/972-112-0x0000000000400000-0x00000000004CB000-memory.dmp

    Filesize

    812KB

  • memory/972-106-0x0000000004824000-0x0000000004826000-memory.dmp

    Filesize

    8KB

  • memory/972-105-0x0000000004823000-0x0000000004824000-memory.dmp

    Filesize

    4KB

  • memory/972-101-0x0000000004821000-0x0000000004822000-memory.dmp

    Filesize

    4KB

  • memory/972-97-0x0000000000230000-0x0000000000267000-memory.dmp

    Filesize

    220KB

  • memory/976-76-0x0000000001010000-0x0000000001011000-memory.dmp

    Filesize

    4KB

  • memory/1216-56-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

  • memory/1268-57-0x0000000002B30000-0x0000000002B46000-memory.dmp

    Filesize

    88KB

  • memory/1684-66-0x0000000000C90000-0x0000000000C91000-memory.dmp

    Filesize

    4KB

  • memory/1684-62-0x00000000001D0000-0x00000000001D1000-memory.dmp

    Filesize

    4KB

  • memory/1708-115-0x0000000010000000-0x0000000010018000-memory.dmp

    Filesize

    96KB

  • memory/1708-108-0x0000000001D20000-0x0000000001DDC000-memory.dmp

    Filesize

    752KB

  • memory/1708-109-0x0000000000400000-0x00000000004C4000-memory.dmp

    Filesize

    784KB

  • memory/1748-110-0x00000000020E4000-0x00000000020E6000-memory.dmp

    Filesize

    8KB

  • memory/1748-111-0x00000000020E3000-0x00000000020E4000-memory.dmp

    Filesize

    4KB

  • memory/1748-94-0x0000000000390000-0x00000000003AF000-memory.dmp

    Filesize

    124KB

  • memory/1748-104-0x0000000000540000-0x000000000055E000-memory.dmp

    Filesize

    120KB

  • memory/1748-99-0x00000000020E1000-0x00000000020E2000-memory.dmp

    Filesize

    4KB

  • memory/1748-98-0x0000000000400000-0x00000000004C5000-memory.dmp

    Filesize

    788KB

  • memory/1748-96-0x00000000020E2000-0x00000000020E3000-memory.dmp

    Filesize

    4KB

  • memory/1748-95-0x00000000002C0000-0x00000000002F0000-memory.dmp

    Filesize

    192KB

  • memory/2044-53-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

  • memory/2044-55-0x0000000075B11000-0x0000000075B13000-memory.dmp

    Filesize

    8KB