Analysis
-
max time kernel
152s -
max time network
102s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-09-2021 04:05
Static task
static1
Behavioral task
behavioral1
Sample
d5f329232a41254c8b8fff293347162d.exe
Resource
win7-en-20210920
gozi_rm3raccoonredlinesmokeloadertofseexmrig5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4rsecond build backdoorbankerdiscoveryevasioninfostealerminerpersistencespywarestealerthemidatrojan
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d5f329232a41254c8b8fff293347162d.exe
Resource
win10v20210408
raccoonredlinesmokeloader5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4second build backdoordiscoveryevasioninfostealerspywarestealerthemidatrojan
windows10_x64
0 signatures
0 seconds
General
-
Target
d5f329232a41254c8b8fff293347162d.exe
-
Size
267KB
-
MD5
d5f329232a41254c8b8fff293347162d
-
SHA1
1647c6e7396d84a5db3a523d44b4b0ab11e1048b
-
SHA256
ec078bf46a67bb519f2f15227a024af19356993f9b5b26bd16d9248f42fb373d
-
SHA512
e05b1a881724fbd9c498aede4ab6130a9f35ab154f4ae64db1580a45cff099c0c2b309f88781678af8f1454dfa44ded84063fe7a8bd50055b595484d5c11ccd6
Malware Config
Extracted
Family
smokeloader
Version
2020
C2
http://fiskahlilian16.top/
http://paishancho17.top/
http://ydiannetter18.top/
http://azarehanelle19.top/
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
raccoon
Botnet
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
redline
Botnet
Second BUILD
C2
asyndenera.xyz:15667
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/3856-170-0x0000000002220000-0x000000000223F000-memory.dmp family_redline behavioral2/memory/3856-175-0x0000000002530000-0x000000000254E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
pid Process 1148 C3F7.exe 3096 D09A.exe 4012 D955.exe 3856 InternodesPiets_2021-09-29_21-00.exe 996 Money10k_.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion C3F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion C3F7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Money10k_.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Money10k_.exe -
Deletes itself 1 IoCs
pid Process 3044 Process not Found -
Loads dropped DLL 5 IoCs
pid Process 4012 D955.exe 4012 D955.exe 4012 D955.exe 4012 D955.exe 4012 D955.exe -
Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x000200000001ab40-119.dat themida behavioral2/memory/1148-122-0x00000000012B0000-0x00000000012B1000-memory.dmp themida behavioral2/files/0x000500000000068b-159.dat themida behavioral2/memory/996-162-0x0000000000EA0000-0x0000000000EA1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA C3F7.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Money10k_.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1148 C3F7.exe 996 Money10k_.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 800 set thread context of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d5f329232a41254c8b8fff293347162d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d5f329232a41254c8b8fff293347162d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI d5f329232a41254c8b8fff293347162d.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 1844 timeout.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1000 d5f329232a41254c8b8fff293347162d.exe 1000 d5f329232a41254c8b8fff293347162d.exe 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3044 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1000 d5f329232a41254c8b8fff293347162d.exe -
Suspicious use of AdjustPrivilegeToken 63 IoCs
description pid Process Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeDebugPrivilege 1148 C3F7.exe Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeDebugPrivilege 996 Money10k_.exe Token: SeDebugPrivilege 3856 InternodesPiets_2021-09-29_21-00.exe Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found Token: SeShutdownPrivilege 3044 Process not Found Token: SeCreatePagefilePrivilege 3044 Process not Found -
Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found 3044 Process not Found -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 800 wrote to memory of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 PID 800 wrote to memory of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 PID 800 wrote to memory of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 PID 800 wrote to memory of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 PID 800 wrote to memory of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 PID 800 wrote to memory of 1000 800 d5f329232a41254c8b8fff293347162d.exe 68 PID 3044 wrote to memory of 1148 3044 Process not Found 69 PID 3044 wrote to memory of 1148 3044 Process not Found 69 PID 3044 wrote to memory of 1148 3044 Process not Found 69 PID 3044 wrote to memory of 3096 3044 Process not Found 71 PID 3044 wrote to memory of 3096 3044 Process not Found 71 PID 3044 wrote to memory of 4012 3044 Process not Found 74 PID 3044 wrote to memory of 4012 3044 Process not Found 74 PID 3044 wrote to memory of 4012 3044 Process not Found 74 PID 4012 wrote to memory of 1664 4012 D955.exe 77 PID 4012 wrote to memory of 1664 4012 D955.exe 77 PID 4012 wrote to memory of 1664 4012 D955.exe 77 PID 1664 wrote to memory of 1844 1664 cmd.exe 79 PID 1664 wrote to memory of 1844 1664 cmd.exe 79 PID 1664 wrote to memory of 1844 1664 cmd.exe 79 PID 3096 wrote to memory of 3856 3096 D09A.exe 82 PID 3096 wrote to memory of 3856 3096 D09A.exe 82 PID 3096 wrote to memory of 3856 3096 D09A.exe 82 PID 3096 wrote to memory of 996 3096 D09A.exe 84 PID 3096 wrote to memory of 996 3096 D09A.exe 84 PID 3096 wrote to memory of 996 3096 D09A.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\d5f329232a41254c8b8fff293347162d.exe"C:\Users\Admin\AppData\Local\Temp\d5f329232a41254c8b8fff293347162d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:800 -
C:\Users\Admin\AppData\Local\Temp\d5f329232a41254c8b8fff293347162d.exe"C:\Users\Admin\AppData\Local\Temp\d5f329232a41254c8b8fff293347162d.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1000
-
-
C:\Users\Admin\AppData\Local\Temp\C3F7.exeC:\Users\Admin\AppData\Local\Temp\C3F7.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1148
-
C:\Users\Admin\AppData\Local\Temp\D09A.exeC:\Users\Admin\AppData\Local\Temp\D09A.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3096 -
C:\Users\Admin\AppData\Local\Temp\InternodesPiets_2021-09-29_21-00.exe"C:\Users\Admin\AppData\Local\Temp\InternodesPiets_2021-09-29_21-00.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3856
-
-
C:\Users\Admin\AppData\Local\Temp\Money10k_.exe"C:\Users\Admin\AppData\Local\Temp\Money10k_.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:996
-
-
C:\Users\Admin\AppData\Local\Temp\D955.exeC:\Users\Admin\AppData\Local\Temp\D955.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\D955.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1664 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1844
-
-