Analysis
- max time kernel
152s - max time network
91s - platform
windows10_x64 - resource
win10v20210408 - submitted
02/10/2021, 10:41
Static task
static1
Behavioral task
behavioral1
Sample
9c477095786e3f993a820863dfe8a799.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9c477095786e3f993a820863dfe8a799.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 9c477095786e3f993a820863dfe8a799.exe
- Size 263KB
- Sample211002-mq39hsedam
- SHA256 fab15b7f61f816cf3128cc02c96d98d3385533087bc5afe3cd3799e7e034ce7f
- MD5 9c477095786e3f993a820863dfe8a799
- SHA1 056c5c26f208e5772e9f67b77389f989c44e1933
- SHA512 4cf4a6c06a6208de19d79bf2399c1a1db9ad8e9c770eb16a550e6ac8a7ef0802648fca8d25c2368c63cbfb2a4c64198fac0e66254ebe2832f6d04c66d0531c36
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fiskahlilian16.top/
-
http://paishancho17.top/
-
http://ydiannetter18.top/
-
http://azarehanelle19.top/
-
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
-
raccoon
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Extracted
Family
-
redline
C2
-
185.92.74.21:80
Extracted
Family
-
redline
Botnet
-
gold_proliv
C2
-
45.140.147.106:12318
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 5 IoCs
resource yara_rule behavioral2/memory/4024-158-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/4024-159-0x000000000041C5A6-mapping.dmp family_redline behavioral2/memory/4024-169-0x0000000005710000-0x0000000005D16000-memory.dmp family_redline behavioral2/memory/1072-179-0x0000000000DD0000-0x0000000000DF2000-memory.dmp family_redline behavioral2/memory/1072-189-0x0000000005400000-0x0000000005A06000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Downloads MZ/PE file
- Executes dropped EXE 8 IoCs
pid Process 3024 7EC0.exe 764 8067.exe 1344 IlzQNwW.exe 1460 ResearchBathe.exe 2824 Obbedivamo.exe.com 4012 Obbedivamo.exe.com 4024 ResearchBathe.exe 1072 RegAsm.exe - Deletes itself 1 IoCs
pid Process 3028 Process not Found - Loads dropped DLL 5 IoCs
pid Process 3024 7EC0.exe 3024 7EC0.exe 3024 7EC0.exe 3024 7EC0.exe 3024 7EC0.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce IlzQNwW.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" IlzQNwW.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4016 set thread context of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 1460 set thread context of 4024 1460 ResearchBathe.exe 84 PID 4012 set thread context of 1072 4012 Obbedivamo.exe.com 93 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9c477095786e3f993a820863dfe8a799.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9c477095786e3f993a820863dfe8a799.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9c477095786e3f993a820863dfe8a799.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1080 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Runs ping.exe 1 TTPs 1 IoCs
pid Process 3540 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4076 9c477095786e3f993a820863dfe8a799.exe 4076 9c477095786e3f993a820863dfe8a799.exe 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3028 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4076 9c477095786e3f993a820863dfe8a799.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeDebugPrivilege 4024 ResearchBathe.exe Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeDebugPrivilege 1072 RegAsm.exe Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found Token: SeShutdownPrivilege 3028 Process not Found Token: SeCreatePagefilePrivilege 3028 Process not Found - Suspicious use of FindShellTrayWindow 8 IoCs
pid Process 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found 3028 Process not Found - Suspicious use of WriteProcessMemory 57 IoCs
description pid Process procid_target PID 4016 wrote to memory of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 4016 wrote to memory of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 4016 wrote to memory of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 4016 wrote to memory of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 4016 wrote to memory of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 4016 wrote to memory of 4076 4016 9c477095786e3f993a820863dfe8a799.exe 68 PID 3028 wrote to memory of 3024 3028 Process not Found 69 PID 3028 wrote to memory of 3024 3028 Process not Found 69 PID 3028 wrote to memory of 3024 3028 Process not Found 69 PID 3028 wrote to memory of 764 3028 Process not Found 70 PID 3028 wrote to memory of 764 3028 Process not Found 70 PID 3024 wrote to memory of 1152 3024 7EC0.exe 71 PID 3024 wrote to memory of 1152 3024 7EC0.exe 71 PID 3024 wrote to memory of 1152 3024 7EC0.exe 71 PID 1152 wrote to memory of 1080 1152 cmd.exe 73 PID 1152 wrote to memory of 1080 1152 cmd.exe 73 PID 1152 wrote to memory of 1080 1152 cmd.exe 73 PID 764 wrote to memory of 1344 764 8067.exe 74 PID 764 wrote to memory of 1344 764 8067.exe 74 PID 764 wrote to memory of 1344 764 8067.exe 74 PID 764 wrote to memory of 1460 764 8067.exe 75 PID 764 wrote to memory of 1460 764 8067.exe 75 PID 764 wrote to memory of 1460 764 8067.exe 75 PID 1344 wrote to memory of 1616 1344 IlzQNwW.exe 77 PID 1344 wrote to memory of 1616 1344 IlzQNwW.exe 77 PID 1344 wrote to memory of 1616 1344 IlzQNwW.exe 77 PID 1344 wrote to memory of 2180 1344 IlzQNwW.exe 78 PID 1344 wrote to memory of 2180 1344 IlzQNwW.exe 78 PID 1344 wrote to memory of 2180 1344 IlzQNwW.exe 78 PID 2180 wrote to memory of 2548 2180 cmd.exe 80 PID 2180 wrote to memory of 2548 2180 cmd.exe 80 PID 2180 wrote to memory of 2548 2180 cmd.exe 80 PID 2548 wrote to memory of 2612 2548 cmd.exe 81 PID 2548 wrote to memory of 2612 2548 cmd.exe 81 PID 2548 wrote to memory of 2612 2548 cmd.exe 81 PID 2548 wrote to memory of 2824 2548 cmd.exe 82 PID 2548 wrote to memory of 2824 2548 cmd.exe 82 PID 2548 wrote to memory of 2824 2548 cmd.exe 82 PID 2548 wrote to memory of 3540 2548 cmd.exe 83 PID 2548 wrote to memory of 3540 2548 cmd.exe 83 PID 2548 wrote to memory of 3540 2548 cmd.exe 83 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 2824 wrote to memory of 4012 2824 Obbedivamo.exe.com 85 PID 2824 wrote to memory of 4012 2824 Obbedivamo.exe.com 85 PID 2824 wrote to memory of 4012 2824 Obbedivamo.exe.com 85 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 1460 wrote to memory of 4024 1460 ResearchBathe.exe 84 PID 4012 wrote to memory of 1072 4012 Obbedivamo.exe.com 93 PID 4012 wrote to memory of 1072 4012 Obbedivamo.exe.com 93 PID 4012 wrote to memory of 1072 4012 Obbedivamo.exe.com 93 PID 4012 wrote to memory of 1072 4012 Obbedivamo.exe.com 93 PID 4012 wrote to memory of 1072 4012 Obbedivamo.exe.com 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\9c477095786e3f993a820863dfe8a799.exe"C:\Users\Admin\AppData\Local\Temp\9c477095786e3f993a820863dfe8a799.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\9c477095786e3f993a820863dfe8a799.exe"C:\Users\Admin\AppData\Local\Temp\9c477095786e3f993a820863dfe8a799.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4076
-
-
C:\Users\Admin\AppData\Local\Temp\7EC0.exeC:\Users\Admin\AppData\Local\Temp\7EC0.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:3024 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\7EC0.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:1080
-
-
-
C:\Users\Admin\AppData\Local\Temp\8067.exeC:\Users\Admin\AppData\Local\Temp\8067.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:764 -
C:\Users\Admin\AppData\Local\Temp\IlzQNwW.exe"C:\Users\Admin\AppData\Local\Temp\IlzQNwW.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1344 -
C:\Windows\SysWOW64\dllhost.exedllhost.exe3⤵PID:1616
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Vede.wpd3⤵
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
PID:2548 -
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^esEkNCLqJoSIAPZevIIHybQOcJEHydCbtewpCtUlJsAfCAFHcWNIGFvEBPPtXtVaFxEnNPAsOnYNXAkVrWkpDTRnFbINfQjFviKoVuUFccUiHIHqDTqqS$" Una.wpd5⤵PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Obbedivamo.exe.comObbedivamo.exe.com J5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Obbedivamo.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Obbedivamo.exe.com J6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4012 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\RegAsm.exe7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1072
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost5⤵
- Runs ping.exe
PID:3540
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\ResearchBathe.exe"C:\Users\Admin\AppData\Local\Temp\ResearchBathe.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1460 -
C:\Users\Admin\AppData\Local\Temp\ResearchBathe.exeC:\Users\Admin\AppData\Local\Temp\ResearchBathe.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-