Analysis
- max time kernel
151s - max time network
113s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/10/2021, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
bcc870848e95ee84544b0387e47665d6.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bcc870848e95ee84544b0387e47665d6.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target bcc870848e95ee84544b0387e47665d6.exe
- Size 262KB
- Sample211002-m45dqsedbp
- SHA256 f7f6c6651d65b0cb84634ef2e2ca985392d41d79dfd18180544d02c07fcc91bb
- MD5 bcc870848e95ee84544b0387e47665d6
- SHA1 1c2812ca5dc5f6c9310f6402afb4a27185112091
- SHA512 fad12e1855e7c1ebae11454639724653506f67e38fda802c0454d7da595091f71572a2f300610f9e3d070f11d573491588fabddea42b829d3b2244121fe1b031
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fiskahlilian16.top/
-
http://paishancho17.top/
-
http://ydiannetter18.top/
-
http://azarehanelle19.top/
-
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
-
raccoon
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
-
redline
C2
-
185.92.74.21:80
Extracted
Family
-
redline
Botnet
-
gold_proliv
C2
-
45.140.147.106:12318
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 5 IoCs
resource yara_rule behavioral2/memory/2784-158-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/2784-159-0x000000000041C5A6-mapping.dmp family_redline behavioral2/memory/2784-168-0x0000000005170000-0x0000000005776000-memory.dmp family_redline behavioral2/memory/1544-179-0x00000000005B0000-0x00000000005D2000-memory.dmp family_redline behavioral2/memory/1544-189-0x00000000049F0000-0x0000000004FF6000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
pid Process 1884 6339.exe 788 64FF.exe 1196 IlzQNwW.exe 1336 ResearchBathe.exe 3916 Obbedivamo.exe.com 2720 Obbedivamo.exe.com 2784 ResearchBathe.exe 1544 RegAsm.exe - Deletes itself 1 IoCs
pid Process 3024 Process not Found - Loads dropped DLL 5 IoCs
pid Process 1884 6339.exe 1884 6339.exe 1884 6339.exe 1884 6339.exe 1884 6339.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce IlzQNwW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" IlzQNwW.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3628 set thread context of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 1336 set thread context of 2784 1336 ResearchBathe.exe 85 PID 2720 set thread context of 1544 2720 Obbedivamo.exe.com 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcc870848e95ee84544b0387e47665d6.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcc870848e95ee84544b0387e47665d6.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI bcc870848e95ee84544b0387e47665d6.exe - Delays execution with timeout.exe 1 IoCs
pid Process 356 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2884 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3880 bcc870848e95ee84544b0387e47665d6.exe 3880 bcc870848e95ee84544b0387e47665d6.exe 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3024 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3880 bcc870848e95ee84544b0387e47665d6.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeDebugPrivilege 2784 ResearchBathe.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeDebugPrivilege 1544 RegAsm.exe Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found Token: SeShutdownPrivilege 3024 Process not Found Token: SeCreatePagefilePrivilege 3024 Process not Found - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found 3024 Process not Found - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 3628 wrote to memory of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 3628 wrote to memory of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 3628 wrote to memory of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 3628 wrote to memory of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 3628 wrote to memory of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 3628 wrote to memory of 3880 3628 bcc870848e95ee84544b0387e47665d6.exe 68 PID 3024 wrote to memory of 1884 3024 Process not Found 69 PID 3024 wrote to memory of 1884 3024 Process not Found 69 PID 3024 wrote to memory of 1884 3024 Process not Found 69 PID 3024 wrote to memory of 788 3024 Process not Found 70 PID 3024 wrote to memory of 788 3024 Process not Found 70 PID 1884 wrote to memory of 856 1884 6339.exe 71 PID 1884 wrote to memory of 856 1884 6339.exe 71 PID 1884 wrote to memory of 856 1884 6339.exe 71 PID 856 wrote to memory of 356 856 cmd.exe 73 PID 856 wrote to memory of 356 856 cmd.exe 73 PID 856 wrote to memory of 356 856 cmd.exe 73 PID 788 wrote to memory of 1196 788 64FF.exe 74 PID 788 wrote to memory of 1196 788 64FF.exe 74 PID 788 wrote to memory of 1196 788 64FF.exe 74 PID 788 wrote to memory of 1336 788 64FF.exe 75 PID 788 wrote to memory of 1336 788 64FF.exe 75 PID 788 wrote to memory of 1336 788 64FF.exe 75 PID 1196 wrote to memory of 1916 1196 IlzQNwW.exe 77 PID 1196 wrote to memory of 1916 1196 IlzQNwW.exe 77 PID 1196 wrote to memory of 1916 1196 IlzQNwW.exe 77 PID 1196 wrote to memory of 1596 1196 IlzQNwW.exe 78 PID 1196 wrote to memory of 1596 1196 IlzQNwW.exe 78 PID 1196 wrote to memory of 1596 1196 IlzQNwW.exe 78 PID 1596 wrote to memory of 2428 1596 cmd.exe 80 PID 1596 wrote to memory of 2428 1596 cmd.exe 80 PID 1596 wrote to memory of 2428 1596 cmd.exe 80 PID 2428 wrote to memory of 2496 2428 cmd.exe 81 PID 2428 wrote to memory of 2496 2428 cmd.exe 81 PID 2428 wrote to memory of 2496 2428 cmd.exe 81 PID 2428 wrote to memory of 3916 2428 cmd.exe 82 PID 2428 wrote to memory of 3916 2428 cmd.exe 82 PID 2428 wrote to memory of 3916 2428 cmd.exe 82 PID 2428 wrote to memory of 2884 2428 cmd.exe 83 PID 2428 wrote to memory of 2884 2428 cmd.exe 83 PID 2428 wrote to memory of 2884 2428 cmd.exe 83 PID 3916 wrote to memory of 2720 3916 Obbedivamo.exe.com 84 PID 3916 wrote to memory of 2720 3916 Obbedivamo.exe.com 84 PID 3916 wrote to memory of 2720 3916 Obbedivamo.exe.com 84 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 1336 wrote to memory of 2784 1336 ResearchBathe.exe 85 PID 2720 wrote to memory of 1544 2720 Obbedivamo.exe.com 93 PID 2720 wrote to memory of 1544 2720 Obbedivamo.exe.com 93 PID 2720 wrote to memory of 1544 2720 Obbedivamo.exe.com 93 PID 2720 wrote to memory of 1544 2720 Obbedivamo.exe.com 93 PID 2720 wrote to memory of 1544 2720 Obbedivamo.exe.com 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcc870848e95ee84544b0387e47665d6.exe"C:\Users\Admin\AppData\Local\Temp\bcc870848e95ee84544b0387e47665d6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3628 -
C:\Users\Admin\AppData\Local\Temp\bcc870848e95ee84544b0387e47665d6.exe"C:\Users\Admin\AppData\Local\Temp\bcc870848e95ee84544b0387e47665d6.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3880
-
-
C:\Users\Admin\AppData\Local\Temp\6339.exeC:\Users\Admin\AppData\Local\Temp\6339.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\6339.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:856 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:356
-
-
-
C:\Users\Admin\AppData\Local\Temp\64FF.exeC:\Users\Admin\AppData\Local\Temp\64FF.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\IlzQNwW.exe"C:\Users\Admin\AppData\Local\Temp\IlzQNwW.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵PID:1916
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Vede.wpd3⤵
- Suspicious use of WriteProcessMemory
PID:1596 -
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^esEkNCLqJoSIAPZevIIHybQOcJEHydCbtewpCtUlJsAfCAFHcWNIGFvEBPPtXtVaFxEnNPAsOnYNXAkVrWkpDTRnFbINfQjFviKoVuUFccUiHIHqDTqqS$" Una.wpd5⤵PID:2496
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Obbedivamo.exe.comObbedivamo.exe.com J5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Obbedivamo.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Obbedivamo.exe.com J6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1544
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
PID:2884
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ResearchBathe.exe"C:\Users\Admin\AppData\Local\Temp\ResearchBathe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1336 -
C:\Users\Admin\AppData\Local\Temp\ResearchBathe.exeC:\Users\Admin\AppData\Local\Temp\ResearchBathe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2784
-
-