Analysis
- max time kernel
151s - max time network
128s - submitted
01/01/1970, 00:00
General
- Target 5ceb8ab578f3be9d15e01c08a46c31c1.exe
- Size 320KB
- Sample211027-ny1n2aefc2
- SHA256 a6b6db3fc549c6648a2959d43cddbf790f2a3b64e380d6919ed6231c19641f46
Malware Config
Extracted
-
smokeloader
-
2020
-
http://brandyjaggers.com/upload/
-
http://andbal.com/upload/
-
http://alotofquotes.com/upload/
-
http://szpnc.cn/upload/
-
http://uggeboots.com/upload/
-
http://100klv.com/upload/
-
http://rapmusic.at/upload/
Extracted
-
raccoon
-
9dc771dc7e85f59c03cb7b7e8b3457b079a2d538
-
url4cnc
http://telegin.top/opussenseus1
http://ttmirror.top/opussenseus1
http://teletele.top/opussenseus1
http://telegalive.top/opussenseus1
http://toptelete.top/opussenseus1
http://telegraf.top/opussenseus1
https://t.me/opussenseus1
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ceb8ab578f3be9d15e01c08a46c31c1.exe"C:\Users\Admin\AppData\Local\Temp\5ceb8ab578f3be9d15e01c08a46c31c1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\whbufgjC:\Users\Admin\AppData\Roaming\whbufgj1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\CEC5.exeC:\Users\Admin\AppData\Local\Temp\CEC5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 10122⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/504-127-0x0000000002F71000-0x0000000002FC0000-memory.dmp
memory/504-128-0x0000000002D90000-0x0000000002E1E000-memory.dmp
memory/504-129-0x0000000000400000-0x0000000002BE8000-memory.dmp
memory/2880-118-0x0000000000850000-0x0000000000866000-memory.dmp
memory/2880-126-0x0000000002880000-0x0000000002896000-memory.dmp
memory/3068-116-0x0000000000030000-0x0000000000039000-memory.dmp
memory/3068-117-0x0000000000400000-0x0000000002BAA000-memory.dmp
memory/3272-121-0x0000000002F71000-0x0000000002F82000-memory.dmp
memory/3272-122-0x0000000000400000-0x0000000002BAA000-memory.dmp