Analysis
- max time kernel
150s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
05/10/2021, 06:02
Static task
static1
Behavioral task
behavioral1
Sample
a33039f06bcfc8cca0c615c1c35cdb0c.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a33039f06bcfc8cca0c615c1c35cdb0c.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target a33039f06bcfc8cca0c615c1c35cdb0c.exe
- Size 254KB
- Sample211005-grgh9ahfak
- SHA256 1f3057ef0ac66ca277f6e443be3547e4db15b989ef0874b2a0770caa8441dafd
- MD5 a33039f06bcfc8cca0c615c1c35cdb0c
- SHA1 5ef5da9ec976e147e3c424596148ee5cec71bdc7
- SHA512 1db3392c555eef0749846027d2b7ea10e187a5fb2f57d1fb4c8ed82781704c233adbe9164958c1b652720189c9c5601d9409d503f547dcae7cccfcc0615f8a82
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://fiskahlilian16.top/
-
http://paishancho17.top/
-
http://ydiannetter18.top/
-
http://azarehanelle19.top/
-
http://quericeriant20.top/
rc4.i32
rc4.i32
Extracted
Family
-
raccoon
Version
-
1.8.2
Botnet
-
19c2ecb55a38664aa514ead2a514e7094696c747
Attributes
-
url4cnc
http://teletop.top/magesty12
http://teleta.top/magesty12
https://t.me/magesty12
rc4.plain
rc4.plain
Extracted
Family
-
raccoon
Version
-
1.8.1
Botnet
-
5ff0ccb2bc00dc52d1ad09949e9c7663bc9ca4d4
Attributes
-
url4cnc
https://t.me/agrybirdsgamerept
rc4.plain
rc4.plain
Signatures
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
description pid Process procid_target PID 4900 created 4784 4900 WerFault.exe 70 - suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
suricata: ET MALWARE Win32.Raccoon Stealer CnC Activity (dependency download)
- suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
suricata: ET MALWARE Win32.Raccoon Stealer Data Exfil Attempt
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 4720 AF75.exe 4784 AF75.exe 4920 B90B.exe - Deletes itself 1 IoCs
pid Process 3048 Process not Found - Loads dropped DLL 5 IoCs
pid Process 4920 B90B.exe 4920 B90B.exe 4920 B90B.exe 4920 B90B.exe 4920 B90B.exe - Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4648 set thread context of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 4720 set thread context of 4784 4720 AF75.exe 70 - Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp WerFault.exe - Program crash 2 IoCs
pid pid_target Process procid_target 4876 4720 WerFault.exe 69 4900 4784 WerFault.exe 70 - Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a33039f06bcfc8cca0c615c1c35cdb0c.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a33039f06bcfc8cca0c615c1c35cdb0c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a33039f06bcfc8cca0c615c1c35cdb0c.exe - Delays execution with timeout.exe 1 IoCs
pid Process 4036 timeout.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4672 a33039f06bcfc8cca0c615c1c35cdb0c.exe 4672 a33039f06bcfc8cca0c615c1c35cdb0c.exe 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3048 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4672 a33039f06bcfc8cca0c615c1c35cdb0c.exe - Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 4720 AF75.exe Token: SeRestorePrivilege 4876 WerFault.exe Token: SeRestorePrivilege 4900 WerFault.exe Token: SeBackupPrivilege 4900 WerFault.exe Token: SeBackupPrivilege 4876 WerFault.exe Token: SeBackupPrivilege 4900 WerFault.exe Token: SeDebugPrivilege 4876 WerFault.exe Token: SeDebugPrivilege 4900 WerFault.exe Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found Token: SeShutdownPrivilege 3048 Process not Found Token: SeCreatePagefilePrivilege 3048 Process not Found - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 3048 Process not Found 3048 Process not Found 3048 Process not Found 3048 Process not Found - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4648 wrote to memory of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 4648 wrote to memory of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 4648 wrote to memory of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 4648 wrote to memory of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 4648 wrote to memory of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 4648 wrote to memory of 4672 4648 a33039f06bcfc8cca0c615c1c35cdb0c.exe 68 PID 3048 wrote to memory of 4720 3048 Process not Found 69 PID 3048 wrote to memory of 4720 3048 Process not Found 69 PID 3048 wrote to memory of 4720 3048 Process not Found 69 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 4720 wrote to memory of 4784 4720 AF75.exe 70 PID 3048 wrote to memory of 4920 3048 Process not Found 74 PID 3048 wrote to memory of 4920 3048 Process not Found 74 PID 3048 wrote to memory of 4920 3048 Process not Found 74 PID 4920 wrote to memory of 3888 4920 B90B.exe 77 PID 4920 wrote to memory of 3888 4920 B90B.exe 77 PID 4920 wrote to memory of 3888 4920 B90B.exe 77 PID 3888 wrote to memory of 4036 3888 cmd.exe 79 PID 3888 wrote to memory of 4036 3888 cmd.exe 79 PID 3888 wrote to memory of 4036 3888 cmd.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\a33039f06bcfc8cca0c615c1c35cdb0c.exe"C:\Users\Admin\AppData\Local\Temp\a33039f06bcfc8cca0c615c1c35cdb0c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4648 -
C:\Users\Admin\AppData\Local\Temp\a33039f06bcfc8cca0c615c1c35cdb0c.exe"C:\Users\Admin\AppData\Local\Temp\a33039f06bcfc8cca0c615c1c35cdb0c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4672
-
-
C:\Users\Admin\AppData\Local\Temp\AF75.exeC:\Users\Admin\AppData\Local\Temp\AF75.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4720 -
C:\Users\Admin\AppData\Local\Temp\AF75.exe"C:\Users\Admin\AppData\Local\Temp\AF75.exe"2⤵
- Executes dropped EXE
PID:4784 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4784 -s 7923⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Drops file in Windows directory
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4900
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4720 -s 9162⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:4876
-
-
C:\Users\Admin\AppData\Local\Temp\B90B.exeC:\Users\Admin\AppData\Local\Temp\B90B.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4920 -
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\B90B.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:3888 -
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
PID:4036
-
-