Analysis
- max time kernel
151s - max time network
129s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
27/10/2021, 01:26
General
- Target a5d0f5e9023afe30c7222f952dc0dc06.exe
- Size 185KB
- Sample211027-bth7zaabbn
- SHA256 7e52d4da15fe2a58de032652081f0875c6edb3259033a50acccd288d3aa3d8dc
Malware Config
Extracted
-
smokeloader
-
2020
-
http://gejajoo7.top/
-
http://sysaheu9.top/
-
http://nusurtal4f.net/
-
http://netomishnetojuk.net/
-
http://escalivrouter.net/
-
http://nick22doom4.net/
-
http://wrioshtivsio.su/
-
http://nusotiso4.su/
-
http://rickkhtovkka.biz/
-
http://palisotoliso.net/
Extracted
-
redline
-
11111
-
93.115.20.139:28978
Extracted
-
redline
-
dksajdlkj32lkj13211211
-
84.38.189.175:18214
Extracted
-
vidar
-
41.6
-
754
-
https://mas.to/@lilocc
-
profile_id
754
Extracted
-
raccoon
-
60e59be328fbd2ebac1839ea99411dccb00a6f49
-
url4cnc
http://telegin.top/agrybirdsgamerept
http://ttmirror.top/agrybirdsgamerept
http://teletele.top/agrybirdsgamerept
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
- Vidar Stealer 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 32 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"C:\Users\Admin\AppData\Local\Temp\a5d0f5e9023afe30c7222f952dc0dc06.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\57A.exeC:\Users\Admin\AppData\Local\Temp\57A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\57A.exeC:\Users\Admin\AppData\Local\Temp\57A.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\CAF.exeC:\Users\Admin\AppData\Local\Temp\CAF.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EE2.exeC:\Users\Admin\AppData\Local\Temp\EE2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1694.exeC:\Users\Admin\AppData\Local\Temp\1694.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im 1694.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1694.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im 1694.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\1F8E.exeC:\Users\Admin\AppData\Local\Temp\1F8E.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3336.exeC:\Users\Admin\AppData\Local\Temp\3336.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 796 -s 9442⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/668-176-0x0000000004C40000-0x0000000004D16000-memory.dmp
memory/668-179-0x0000000000400000-0x0000000002F6F000-memory.dmp
memory/668-175-0x0000000004AB0000-0x0000000004B2C000-memory.dmp
memory/796-201-0x0000000000400000-0x00000000005B2000-memory.dmp
memory/796-200-0x0000000000710000-0x000000000085A000-memory.dmp
memory/796-199-0x0000000000901000-0x0000000000950000-memory.dmp
memory/2712-117-0x00000000001D0000-0x00000000001D8000-memory.dmp
memory/2712-118-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/3028-174-0x0000000002D80000-0x0000000002D96000-memory.dmp
memory/3028-119-0x0000000000EB0000-0x0000000000EC6000-memory.dmp
memory/3028-180-0x0000000002F10000-0x0000000002F26000-memory.dmp
memory/3364-129-0x0000000003170000-0x0000000003173000-memory.dmp
memory/3364-186-0x00000000071F0000-0x00000000071F1000-memory.dmp
memory/3364-148-0x0000000006600000-0x0000000006601000-memory.dmp
memory/3364-147-0x00000000065C0000-0x00000000065C1000-memory.dmp
memory/3364-126-0x0000000000E20000-0x0000000000E21000-memory.dmp
memory/3364-128-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/3364-146-0x0000000006680000-0x0000000006681000-memory.dmp
memory/3364-145-0x0000000006550000-0x0000000006551000-memory.dmp
memory/3364-177-0x0000000006A00000-0x0000000006A01000-memory.dmp
memory/3364-178-0x0000000007110000-0x0000000007111000-memory.dmp
memory/3364-144-0x0000000006B00000-0x0000000006B01000-memory.dmp
memory/3364-135-0x0000000005910000-0x0000000005911000-memory.dmp
memory/3364-181-0x0000000007230000-0x0000000007231000-memory.dmp
memory/3364-182-0x00000000077D0000-0x00000000077D1000-memory.dmp
memory/3364-142-0x0000000005760000-0x000000000577A000-memory.dmp
memory/3364-141-0x00000000056A0000-0x00000000056BE000-memory.dmp
memory/3364-188-0x00000000083D0000-0x00000000083D1000-memory.dmp
memory/3364-187-0x0000000007CD0000-0x0000000007CD1000-memory.dmp
memory/3684-115-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4028-196-0x0000000006B60000-0x0000000006B61000-memory.dmp
memory/4028-159-0x0000000000730000-0x000000000075E000-memory.dmp
memory/4028-173-0x00000000050A4000-0x00000000050A5000-memory.dmp
memory/4028-172-0x00000000050A3000-0x00000000050A4000-memory.dmp
memory/4028-171-0x00000000050A2000-0x00000000050A3000-memory.dmp
memory/4028-170-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/4028-163-0x0000000000980000-0x0000000000999000-memory.dmp
memory/4036-153-0x0000000002F60000-0x0000000002F69000-memory.dmp
memory/4036-158-0x0000000000400000-0x0000000002EFA000-memory.dmp
memory/4036-152-0x0000000002F10000-0x0000000002F18000-memory.dmp