Analysis
- max time kernel
150s - max time network
153s - submitted
01/01/1970, 00:00
General
- Target 5ceb8ab578f3be9d15e01c08a46c31c1.exe
- Size 320KB
- Sample211027-ny1n2aefc2
- SHA256 a6b6db3fc549c6648a2959d43cddbf790f2a3b64e380d6919ed6231c19641f46
Malware Config
Extracted
-
smokeloader
-
2020
-
http://brandyjaggers.com/upload/
-
http://andbal.com/upload/
-
http://alotofquotes.com/upload/
-
http://szpnc.cn/upload/
-
http://uggeboots.com/upload/
-
http://100klv.com/upload/
-
http://rapmusic.at/upload/
Extracted
-
raccoon
-
9dc771dc7e85f59c03cb7b7e8b3457b079a2d538
-
url4cnc
http://telegin.top/opussenseus1
http://ttmirror.top/opussenseus1
http://teletele.top/opussenseus1
http://telegalive.top/opussenseus1
http://toptelete.top/opussenseus1
http://telegraf.top/opussenseus1
https://t.me/opussenseus1
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Deletes itself 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ceb8ab578f3be9d15e01c08a46c31c1.exe"C:\Users\Admin\AppData\Local\Temp\5ceb8ab578f3be9d15e01c08a46c31c1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\E7D0.exeC:\Users\Admin\AppData\Local\Temp\E7D0.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/820-54-0x0000000002CC8000-0x0000000002CD9000-memory.dmp
memory/820-55-0x0000000075821000-0x0000000075823000-memory.dmp
memory/820-57-0x0000000000400000-0x0000000002BAA000-memory.dmp
memory/820-56-0x0000000000020000-0x0000000000029000-memory.dmp
memory/1264-58-0x0000000002B20000-0x0000000002B36000-memory.dmp
memory/1900-61-0x0000000000308000-0x0000000000357000-memory.dmp
memory/1900-64-0x0000000000400000-0x0000000002BE8000-memory.dmp
memory/1900-63-0x0000000002C60000-0x0000000002CEE000-memory.dmp