Analysis
- max time kernel
150s - max time network
177s - platform
windows7_x64 - resource
win7-en-20210920 - submitted
30/10/2021, 06:32
General
- Target b0c72d42069a922cceb9058191eb4f79.exe
- Size 180KB
- Sample211030-hamjlsbcdm
- SHA256 78e78f19e3c8ff370f2656bf606c18503e0a6d8c596ff9fab36d8145aff8ef81
Malware Config
Extracted
-
smokeloader
-
2020
-
http://xacokuo8.top/
-
http://hajezey1.top/
-
http://nusurtal4f.net/
-
http://netomishnetojuk.net/
-
http://escalivrouter.net/
-
http://nick22doom4.net/
-
http://wrioshtivsio.su/
-
http://nusotiso4.su/
-
http://rickkhtovkka.biz/
-
http://palisotoliso.net/
-
http://193.56.146.214/
-
https://193.56.146.214/
Extracted
-
redline
-
999888988
-
93.115.20.139:28978
Extracted
-
raccoon
-
68e2d75238f7c69859792d206401b6bde2b2515c
-
url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 9 IoCs
- VMProtect packed file 2 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 4 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 52 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\E4F2.exeC:\Users\Admin\AppData\Local\Temp\E4F2.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E4F2.exeC:\Users\Admin\AppData\Local\Temp\E4F2.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\EB79.exeC:\Users\Admin\AppData\Local\Temp\EB79.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EDF9.exeC:\Users\Admin\AppData\Local\Temp\EDF9.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\71.exeC:\Users\Admin\AppData\Local\Temp\71.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\88D.exeC:\Users\Admin\AppData\Local\Temp\88D.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\170F.exeC:\Users\Admin\AppData\Local\Temp\170F.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\1F69.exeC:\Users\Admin\AppData\Local\Temp\1F69.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1F69.exeC:\Users\Admin\AppData\Local\Temp\1F69.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/840-57-0x0000000000020000-0x0000000000029000-memory.dmp
memory/840-58-0x0000000000030000-0x0000000000039000-memory.dmp
memory/880-56-0x0000000076851000-0x0000000076853000-memory.dmp
memory/880-54-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1084-139-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1084-143-0x0000000004803000-0x0000000004804000-memory.dmp
memory/1084-135-0x0000000000440000-0x000000000045C000-memory.dmp
memory/1084-144-0x0000000004804000-0x0000000004806000-memory.dmp
memory/1084-136-0x0000000001FF0000-0x000000000200B000-memory.dmp
memory/1084-140-0x0000000004801000-0x0000000004802000-memory.dmp
memory/1084-142-0x0000000004802000-0x0000000004803000-memory.dmp
memory/1084-132-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1144-137-0x0000000000220000-0x0000000000242000-memory.dmp
memory/1144-138-0x0000000000250000-0x0000000000280000-memory.dmp
memory/1204-141-0x00000000042F0000-0x0000000004306000-memory.dmp
memory/1204-117-0x0000000003D80000-0x0000000003D96000-memory.dmp
memory/1204-116-0x0000000003B90000-0x0000000003BA6000-memory.dmp
memory/1204-59-0x0000000001D90000-0x0000000001DA6000-memory.dmp
memory/1384-97-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
memory/1384-89-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/1384-99-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/1384-102-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/1384-103-0x0000000000EE0000-0x0000000000EE1000-memory.dmp
memory/1384-108-0x0000000000130000-0x0000000000131000-memory.dmp
memory/1384-87-0x0000000000E80000-0x0000000000E81000-memory.dmp
memory/1384-88-0x0000000000E80000-0x0000000000E81000-memory.dmp
memory/1384-96-0x0000000000EC0000-0x0000000000EC1000-memory.dmp
memory/1384-115-0x0000000001180000-0x0000000001181000-memory.dmp
memory/1384-94-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/1384-93-0x0000000000EB0000-0x0000000000EB1000-memory.dmp
memory/1384-86-0x0000000000E80000-0x0000000000E81000-memory.dmp
memory/1384-91-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/1384-100-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/1384-90-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/1492-121-0x0000000000220000-0x0000000000229000-memory.dmp
memory/1492-120-0x0000000002D3D000-0x0000000002D4E000-memory.dmp
memory/1492-123-0x0000000000400000-0x0000000002B4D000-memory.dmp
memory/1640-77-0x0000000000020000-0x0000000000029000-memory.dmp
memory/1736-127-0x0000000000220000-0x000000000026E000-memory.dmp
memory/1736-128-0x0000000000370000-0x00000000003FE000-memory.dmp
memory/1736-129-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1980-110-0x0000000000500000-0x000000000051F000-memory.dmp
memory/1980-78-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/1980-76-0x00000000003E0000-0x00000000003E3000-memory.dmp
memory/1980-65-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/1980-111-0x0000000000530000-0x000000000054A000-memory.dmp
memory/2004-80-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/2004-79-0x00000000001B0000-0x00000000001B8000-memory.dmp
memory/2004-85-0x0000000000400000-0x0000000002EFA000-memory.dmp