Analysis
- max time kernel
151s - max time network
151s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
27/10/2021, 01:26
General
- Target a5d0f5e9023afe30c7222f952dc0dc06.exe
- Size 185KB
- Sample211027-bth7zaabbn
- SHA256 7e52d4da15fe2a58de032652081f0875c6edb3259033a50acccd288d3aa3d8dc
Malware Config
Extracted
-
smokeloader
-
2020
-
http://gejajoo7.top/
-
http://sysaheu9.top/
-
http://nusurtal4f.net/
-
http://netomishnetojuk.net/
-
http://escalivrouter.net/
-
http://nick22doom4.net/
-
http://wrioshtivsio.su/
-
http://nusotiso4.su/
-
http://rickkhtovkka.biz/
-
http://palisotoliso.net/
Extracted
-
vidar
-
41.6
-
754
-
https://mas.to/@lilocc
-
profile_id
754
Extracted
-
redline
-
11111
-
93.115.20.139:28978
Extracted
-
raccoon
-
60e59be328fbd2ebac1839ea99411dccb00a6f49
-
url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
- Vidar Stealer 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 6 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 1 IoCs
- Modifies system certificate store 2 TTPs 3 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\8AC2.exeC:\Users\Admin\AppData\Local\Temp\8AC2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8AC2.exeC:\Users\Admin\AppData\Local\Temp\8AC2.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\9232.exeC:\Users\Admin\AppData\Local\Temp\9232.exe1⤵
- Executes dropped EXE
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\9455.exeC:\Users\Admin\AppData\Local\Temp\9455.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\9C62.exeC:\Users\Admin\AppData\Local\Temp\9C62.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 9C62.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9C62.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 9C62.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\B5C4.exeC:\Users\Admin\AppData\Local\Temp\B5C4.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/388-68-0x0000000000758000-0x0000000000769000-memory.dmp
memory/780-57-0x0000000074F21000-0x0000000074F23000-memory.dmp
memory/780-55-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1140-86-0x0000000000400000-0x0000000002EFA000-memory.dmp
memory/1140-83-0x00000000002B0000-0x00000000002B9000-memory.dmp
memory/1140-82-0x0000000000220000-0x0000000000228000-memory.dmp
memory/1200-91-0x0000000003E80000-0x0000000003E96000-memory.dmp
memory/1200-60-0x0000000002970000-0x0000000002986000-memory.dmp
memory/1200-97-0x00000000040C0000-0x00000000040D6000-memory.dmp
memory/1548-90-0x0000000000400000-0x0000000002F6F000-memory.dmp
memory/1548-89-0x0000000004770000-0x0000000004846000-memory.dmp
memory/1548-88-0x0000000002F70000-0x0000000002FEC000-memory.dmp
memory/1584-58-0x0000000000220000-0x0000000000228000-memory.dmp
memory/1584-59-0x0000000000240000-0x0000000000249000-memory.dmp
memory/1616-92-0x0000000000A10000-0x0000000000A2E000-memory.dmp
memory/1616-69-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/1616-78-0x0000000000390000-0x0000000000393000-memory.dmp
memory/1616-79-0x0000000000680000-0x0000000000681000-memory.dmp
memory/1616-93-0x0000000000A30000-0x0000000000A4A000-memory.dmp
memory/1960-102-0x0000000000400000-0x00000000005B2000-memory.dmp
memory/1960-100-0x0000000000630000-0x00000000006BE000-memory.dmp
memory/1960-98-0x00000000002E8000-0x0000000000337000-memory.dmp