Analysis
-
max time kernel
151s -
max time network
135s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-10-2021 09:33
Static task
static1
Behavioral task
behavioral1
Sample
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
Resource
win10-en-20210920
General
-
Target
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe
-
Size
336KB
-
MD5
ce3b37511bcf0f509b20f5ca0085badb
-
SHA1
cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
-
SHA256
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
-
SHA512
c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Extracted
raccoon
7ebf9b416b72a203df65383eec899dc689d2c3d7
-
url4cnc
http://telegatt.top/agrybirdsgamerept
http://telegka.top/agrybirdsgamerept
http://telegin.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/684-134-0x0000000000418D06-mapping.dmp family_redline behavioral1/memory/684-133-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 2412 created 1936 2412 WerFault.exe CC18.exe -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
3593.exe3593.exe5001.exe5001.exeCC18.exepid process 3980 3593.exe 1020 3593.exe 2776 5001.exe 684 5001.exe 1936 CC18.exe -
Deletes itself 1 IoCs
Processes:
pid process 3036 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe3593.exe5001.exedescription pid process target process PID 3224 set thread context of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3980 set thread context of 1020 3980 3593.exe 3593.exe PID 2776 set thread context of 684 2776 5001.exe 5001.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2412 1936 WerFault.exe CC18.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3593.exe8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3593.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3593.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3593.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exepid process 3308 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 3308 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 3036 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3036 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe3593.exepid process 3308 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 1020 3593.exe -
Suspicious use of AdjustPrivilegeToken 30 IoCs
Processes:
5001.exeWerFault.exedescription pid process Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeDebugPrivilege 684 5001.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeRestorePrivilege 2412 WerFault.exe Token: SeBackupPrivilege 2412 WerFault.exe Token: SeDebugPrivilege 2412 WerFault.exe Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 Token: SeShutdownPrivilege 3036 Token: SeCreatePagefilePrivilege 3036 -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe3593.exe5001.exedescription pid process target process PID 3224 wrote to memory of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3224 wrote to memory of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3224 wrote to memory of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3224 wrote to memory of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3224 wrote to memory of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3224 wrote to memory of 3308 3224 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe 8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe PID 3036 wrote to memory of 3980 3036 3593.exe PID 3036 wrote to memory of 3980 3036 3593.exe PID 3036 wrote to memory of 3980 3036 3593.exe PID 3980 wrote to memory of 1020 3980 3593.exe 3593.exe PID 3980 wrote to memory of 1020 3980 3593.exe 3593.exe PID 3980 wrote to memory of 1020 3980 3593.exe 3593.exe PID 3980 wrote to memory of 1020 3980 3593.exe 3593.exe PID 3980 wrote to memory of 1020 3980 3593.exe 3593.exe PID 3980 wrote to memory of 1020 3980 3593.exe 3593.exe PID 3036 wrote to memory of 2776 3036 5001.exe PID 3036 wrote to memory of 2776 3036 5001.exe PID 3036 wrote to memory of 2776 3036 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 2776 wrote to memory of 684 2776 5001.exe 5001.exe PID 3036 wrote to memory of 1936 3036 CC18.exe PID 3036 wrote to memory of 1936 3036 CC18.exe PID 3036 wrote to memory of 1936 3036 CC18.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe"C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe"C:\Users\Admin\AppData\Local\Temp\8e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3593.exeC:\Users\Admin\AppData\Local\Temp\3593.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3593.exeC:\Users\Admin\AppData\Local\Temp\3593.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5001.exeC:\Users\Admin\AppData\Local\Temp\5001.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5001.exeC:\Users\Admin\AppData\Local\Temp\5001.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CC18.exeC:\Users\Admin\AppData\Local\Temp\CC18.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1936 -s 8522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5001.exe.logMD5
605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3
-
C:\Users\Admin\AppData\Local\Temp\3593.exeMD5
ce3b37511bcf0f509b20f5ca0085badb
SHA1cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
SHA2568e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
SHA512c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61
-
C:\Users\Admin\AppData\Local\Temp\3593.exeMD5
ce3b37511bcf0f509b20f5ca0085badb
SHA1cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
SHA2568e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
SHA512c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61
-
C:\Users\Admin\AppData\Local\Temp\3593.exeMD5
ce3b37511bcf0f509b20f5ca0085badb
SHA1cc0dd74710fa5c1cb8b78a8ddb05ab8eceb3f9a0
SHA2568e8956efbe5ab389ab9b391fe82ed762b115aa1b15e2a2b10284dabe27f560d3
SHA512c549b2de885731127a97624667b1a7104a3332b3d91ed4ce58f051fa171882ec6e9d26f7005cf44efd1bb36ed4543c9d397e721b71c2b3c09c570adb52fe9c61
-
C:\Users\Admin\AppData\Local\Temp\5001.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\5001.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\5001.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\CC18.exeMD5
cfe698927cffa57588b0d86d1663f19a
SHA119b67410923e589ad3a3c560e35b733e01fe40b2
SHA256c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361
SHA512984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9
-
C:\Users\Admin\AppData\Local\Temp\CC18.exeMD5
cfe698927cffa57588b0d86d1663f19a
SHA119b67410923e589ad3a3c560e35b733e01fe40b2
SHA256c57897485abec1f54b3f54c762777cd2b8fb09d79282388a8b30bb1216052361
SHA512984b12091b376797d2350e9a10fe8b88de4c99815f6dd887d678384649bced4e3e89f65db05fc767e280c80bcea7f101ae399d38d7e8b6a9ab3c6a27ebcbb6b9
-
memory/684-148-0x00000000062A0000-0x00000000062A1000-memory.dmpFilesize
4KB
-
memory/684-149-0x0000000006DD0000-0x0000000006DD1000-memory.dmpFilesize
4KB
-
memory/684-150-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/684-147-0x00000000062D0000-0x00000000062D1000-memory.dmpFilesize
4KB
-
memory/684-146-0x00000000061B0000-0x00000000061B1000-memory.dmpFilesize
4KB
-
memory/684-134-0x0000000000418D06-mapping.dmp
-
memory/684-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/684-145-0x0000000006600000-0x0000000006601000-memory.dmpFilesize
4KB
-
memory/684-138-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/684-139-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/684-140-0x0000000005480000-0x0000000005481000-memory.dmpFilesize
4KB
-
memory/684-141-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB
-
memory/684-142-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/684-143-0x00000000052E0000-0x00000000058E6000-memory.dmpFilesize
6.0MB
-
memory/684-144-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/1020-125-0x0000000000402E0C-mapping.dmp
-
memory/1936-155-0x0000000001391000-0x00000000013E0000-memory.dmpFilesize
316KB
-
memory/1936-156-0x0000000001220000-0x00000000012AE000-memory.dmpFilesize
568KB
-
memory/1936-152-0x0000000000000000-mapping.dmp
-
memory/1936-157-0x0000000000400000-0x0000000001063000-memory.dmpFilesize
12.4MB
-
memory/2776-131-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/2776-128-0x0000000000000000-mapping.dmp
-
memory/3036-127-0x0000000002820000-0x0000000002836000-memory.dmpFilesize
88KB
-
memory/3036-119-0x0000000000DF0000-0x0000000000E06000-memory.dmpFilesize
88KB
-
memory/3224-118-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3308-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3308-117-0x0000000000402E0C-mapping.dmp
-
memory/3980-120-0x0000000000000000-mapping.dmp