Analysis
- max time kernel
151s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
30/10/2021, 06:32
General
- Target b0c72d42069a922cceb9058191eb4f79.exe
- Size 180KB
- Sample211030-hamjlsbcdm
- SHA256 78e78f19e3c8ff370f2656bf606c18503e0a6d8c596ff9fab36d8145aff8ef81
Malware Config
Extracted
-
smokeloader
-
2020
-
http://xacokuo8.top/
-
http://hajezey1.top/
-
http://nusurtal4f.net/
-
http://netomishnetojuk.net/
-
http://escalivrouter.net/
-
http://nick22doom4.net/
-
http://wrioshtivsio.su/
-
http://nusotiso4.su/
-
http://rickkhtovkka.biz/
-
http://palisotoliso.net/
-
http://193.56.146.214/
-
https://193.56.146.214/
Extracted
-
redline
-
999888988
-
93.115.20.139:28978
Extracted
-
raccoon
-
68e2d75238f7c69859792d206401b6bde2b2515c
-
url4cnc
http://telegalive.top/agrybirdsgamerept
http://toptelete.top/agrybirdsgamerept
http://telegraf.top/agrybirdsgamerept
https://t.me/agrybirdsgamerept
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
9b47742e621d3b0f1b0b79db6ed26e2c33328c05
-
url4cnc
http://telegalive.top/ustavshiy1
http://toptelete.top/ustavshiy1
http://telegraf.top/ustavshiy1
https://t.me/ustavshiy1
Extracted
-
vidar
-
41.6
-
936
-
https://mas.to/@lilocc
-
profile_id
936
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Windows security bypass 2 TTPs
- suricata: ET MALWARE Known Sinkhole Response Header
suricata: ET MALWARE Known Sinkhole Response Header
- suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Nirsoft 3 IoCs
- Vidar Stealer 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 22 IoCs
- VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Loads dropped DLL 3 IoCs
- Obfuscated with Agile.Net obfuscator 7 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 3 IoCs
Detects Themida, an advanced Windows software protection system.
- Windows security modification 2 TTPs 10 IoCs
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 12 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Kills process with taskkill 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 14 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"C:\Users\Admin\AppData\Local\Temp\b0c72d42069a922cceb9058191eb4f79.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\170E.exeC:\Users\Admin\AppData\Local\Temp\170E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\170E.exeC:\Users\Admin\AppData\Local\Temp\170E.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1D2A.exeC:\Users\Admin\AppData\Local\Temp\1D2A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1F7C.exeC:\Users\Admin\AppData\Local\Temp\1F7C.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\319E.exeC:\Users\Admin\AppData\Local\Temp\319E.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3E70.exeC:\Users\Admin\AppData\Local\Temp\3E70.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5092.exeC:\Users\Admin\AppData\Local\Temp\5092.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1652 -s 9042⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\55D3.exeC:\Users\Admin\AppData\Local\Temp\55D3.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\55D3.exeC:\Users\Admin\AppData\Local\Temp\55D3.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\A76E.exeC:\Users\Admin\AppData\Local\Temp\A76E.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\A85A.exeC:\Users\Admin\AppData\Local\Temp\A85A.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\A85A.exe"C:\Users\Admin\AppData\Local\Temp\A85A.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"3⤵
- Creates scheduled task(s)
-
-
-
C:\Users\Admin\AppData\Local\Temp\A9F1.exeC:\Users\Admin\AppData\Local\Temp\A9F1.exe1⤵
- Executes dropped EXE
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d608cbf2-d066-4296-9dbd-3307b528a9bc\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\d608cbf2-d066-4296-9dbd-3307b528a9bc\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\d608cbf2-d066-4296-9dbd-3307b528a9bc\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d608cbf2-d066-4296-9dbd-3307b528a9bc\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\d608cbf2-d066-4296-9dbd-3307b528a9bc\AdvancedRun.exe" /SpecialRun 4101d8 24523⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\A9F1.exe" -Force2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\A9F1.exeC:\Users\Admin\AppData\Local\Temp\A9F1.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\A9F1.exeC:\Users\Admin\AppData\Local\Temp\A9F1.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im A9F1.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\A9F1.exe" & del C:\ProgramData\*.dll & exit3⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /im A9F1.exe /f4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\A9F1.exeC:\Users\Admin\AppData\Local\Temp\A9F1.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\B4C0.exeC:\Users\Admin\AppData\Local\Temp\B4C0.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Loughborough.exe"C:\Users\Admin\AppData\Local\Temp\Loughborough.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exeC:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\TelemetryServices\fodhelper.exe"3⤵
- Creates scheduled task(s)
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/388-155-0x0000000001E80000-0x0000000001E81000-memory.dmp
memory/388-154-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
memory/388-166-0x0000000006980000-0x0000000006981000-memory.dmp
memory/388-164-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
memory/388-160-0x0000000077270000-0x00000000773FE000-memory.dmp
memory/388-158-0x0000000001FB0000-0x0000000001FB1000-memory.dmp
memory/388-173-0x0000000006330000-0x0000000006331000-memory.dmp
memory/388-156-0x0000000001E90000-0x0000000001E91000-memory.dmp
memory/388-169-0x0000000006610000-0x0000000006611000-memory.dmp
memory/388-157-0x0000000001FA0000-0x0000000001FA1000-memory.dmp
memory/388-153-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/388-197-0x00000000071A0000-0x00000000071A1000-memory.dmp
memory/416-268-0x0000000004790000-0x000000000481E000-memory.dmp
memory/416-270-0x0000000000400000-0x0000000002BED000-memory.dmp
memory/684-277-0x0000000003220000-0x0000000003247000-memory.dmp
memory/684-275-0x0000000003250000-0x0000000003272000-memory.dmp
memory/772-117-0x0000000000400000-0x0000000000409000-memory.dmp
memory/792-247-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/792-242-0x00000000006F0000-0x00000000006F1000-memory.dmp
memory/912-184-0x0000000002C70000-0x0000000002C79000-memory.dmp
memory/912-188-0x0000000000400000-0x0000000002B4D000-memory.dmp
memory/1124-152-0x0000000000400000-0x0000000002EFA000-memory.dmp
memory/1124-146-0x0000000004990000-0x0000000004998000-memory.dmp
memory/1124-147-0x00000000049E0000-0x00000000049E9000-memory.dmp
memory/1224-265-0x0000000003300000-0x0000000003374000-memory.dmp
memory/1224-266-0x0000000003290000-0x00000000032FB000-memory.dmp
memory/1284-297-0x0000000000400000-0x00000000004DA000-memory.dmp
memory/1424-572-0x0000000004F10000-0x000000000540E000-memory.dmp
memory/1652-202-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1652-201-0x00000000007A0000-0x000000000082E000-memory.dmp
memory/1652-200-0x0000000000590000-0x00000000006DA000-memory.dmp
memory/1948-331-0x0000000006573000-0x0000000006574000-memory.dmp
memory/1948-317-0x000000007DF60000-0x000000007DF61000-memory.dmp
memory/1948-300-0x0000000006572000-0x0000000006573000-memory.dmp
memory/1948-296-0x0000000006570000-0x0000000006571000-memory.dmp
memory/2280-285-0x00000000001A0000-0x00000000001AD000-memory.dmp
memory/2280-283-0x00000000001B0000-0x00000000001B7000-memory.dmp
memory/2320-276-0x0000000002DF0000-0x0000000002DF6000-memory.dmp
memory/2320-278-0x0000000002DE0000-0x0000000002DEB000-memory.dmp
memory/2640-116-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/2640-115-0x0000000000030000-0x0000000000039000-memory.dmp
memory/2756-563-0x0000000000400000-0x0000000000406000-memory.dmp
memory/2976-272-0x0000000000F20000-0x0000000000F27000-memory.dmp
memory/2976-273-0x0000000000F10000-0x0000000000F1C000-memory.dmp
memory/3020-203-0x00000000028F0000-0x0000000002906000-memory.dmp
memory/3020-159-0x0000000001FE0000-0x0000000001FF6000-memory.dmp
memory/3020-182-0x0000000002680000-0x0000000002696000-memory.dmp
memory/3020-119-0x0000000000520000-0x0000000000536000-memory.dmp
memory/3120-179-0x0000000007350000-0x0000000007351000-memory.dmp
memory/3120-175-0x0000000006AF0000-0x0000000006AF1000-memory.dmp
memory/3120-142-0x0000000006640000-0x0000000006641000-memory.dmp
memory/3120-143-0x0000000006770000-0x0000000006771000-memory.dmp
memory/3120-144-0x00000000066B0000-0x00000000066B1000-memory.dmp
memory/3120-145-0x00000000066F0000-0x00000000066F1000-memory.dmp
memory/3120-194-0x0000000007EB0000-0x0000000007EB1000-memory.dmp
memory/3120-131-0x0000000005970000-0x0000000005971000-memory.dmp
memory/3120-134-0x0000000005870000-0x0000000005871000-memory.dmp
memory/3120-137-0x00000000057D0000-0x00000000057D3000-memory.dmp
memory/3120-139-0x0000000006570000-0x000000000658A000-memory.dmp
memory/3120-141-0x0000000006BC0000-0x0000000006BC1000-memory.dmp
memory/3120-127-0x0000000000FE0000-0x0000000000FE1000-memory.dmp
memory/3120-195-0x00000000085B0000-0x00000000085B1000-memory.dmp
memory/3120-181-0x0000000007410000-0x0000000007411000-memory.dmp
memory/3120-138-0x0000000005950000-0x000000000596F000-memory.dmp
memory/3420-211-0x0000000004910000-0x000000000492B000-memory.dmp
memory/3420-214-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3420-220-0x00000000049B3000-0x00000000049B4000-memory.dmp
memory/3420-210-0x00000000049B2000-0x00000000049B3000-memory.dmp
memory/3420-207-0x0000000002160000-0x000000000217C000-memory.dmp
memory/3420-204-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3420-218-0x00000000049B4000-0x00000000049B6000-memory.dmp
memory/3420-216-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/3688-241-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/3688-246-0x0000000004DB0000-0x00000000052AE000-memory.dmp
memory/3688-234-0x00000000004F0000-0x00000000004F1000-memory.dmp
memory/3732-132-0x0000000000030000-0x0000000000039000-memory.dmp
memory/3852-302-0x000001CEDF7B4000-0x000001CEDF7B6000-memory.dmp
memory/3852-301-0x000001CEDF7B2000-0x000001CEDF7B4000-memory.dmp
memory/3852-282-0x000001CEDF7B0000-0x000001CEDF7B2000-memory.dmp
memory/3896-212-0x0000000000460000-0x000000000050E000-memory.dmp
memory/3896-208-0x00000000001C0000-0x00000000001E2000-memory.dmp