Analysis

  • max time kernel
    151s
  • max time network
    142s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    14-11-2021 06:38

General

  • Target

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4.exe

  • Size

    219KB

  • MD5

    a33fb4be7ac6ae4caf3b1bbbabdc137e

  • SHA1

    d92579ae7748a8c8ea9a4fe34110bb1f76e05d9b

  • SHA256

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4

  • SHA512

    fe64a7b88cc53b7afad7ea2b0a93b154277bc4d434252ab014dff272e6f2f7eab657cb50473de7c01200d7164c019308be65a281169ffcb3be270df36dfe2af6

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes
  • url4cnc

    http://91.219.236.27/agrybirdsgamerept

    http://5.181.156.92/agrybirdsgamerept

    http://91.219.236.207/agrybirdsgamerept

    http://185.225.19.18/agrybirdsgamerept

    http://91.219.237.227/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://5.181.156.92/capibar

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 39 IoCs
  • Suspicious use of WriteProcessMemory 47 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4.exe
    "C:\Users\Admin\AppData\Local\Temp\0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2536
    • C:\Users\Admin\AppData\Local\Temp\0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4.exe
      "C:\Users\Admin\AppData\Local\Temp\0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2656
  • C:\Users\Admin\AppData\Local\Temp\F08B.exe
    C:\Users\Admin\AppData\Local\Temp\F08B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1980
    • C:\Users\Admin\AppData\Local\Temp\F08B.exe
      C:\Users\Admin\AppData\Local\Temp\F08B.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:636
  • C:\Users\Admin\AppData\Local\Temp\F54F.exe
    C:\Users\Admin\AppData\Local\Temp\F54F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3216
    • C:\Users\Admin\AppData\Local\Temp\F54F.exe
      C:\Users\Admin\AppData\Local\Temp\F54F.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:736
  • C:\Users\Admin\AppData\Local\Temp\F7EF.exe
    C:\Users\Admin\AppData\Local\Temp\F7EF.exe
    1⤵
    • Executes dropped EXE
    PID:2684
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2684 -s 480
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2072
  • C:\Users\Admin\AppData\Local\Temp\FC07.exe
    C:\Users\Admin\AppData\Local\Temp\FC07.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3260
    • C:\Users\Admin\AppData\Local\Temp\FC07.exe
      C:\Users\Admin\AppData\Local\Temp\FC07.exe
      2⤵
      • Executes dropped EXE
      PID:4036
  • C:\Users\Admin\AppData\Local\Temp\7D.exe
    C:\Users\Admin\AppData\Local\Temp\7D.exe
    1⤵
    • Executes dropped EXE
    PID:1460
  • C:\Users\Admin\AppData\Local\Temp\E78.exe
    C:\Users\Admin\AppData\Local\Temp\E78.exe
    1⤵
    • Executes dropped EXE
    PID:2228
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 2228 -s 812
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:3752
  • C:\Users\Admin\AppData\Roaming\ebfdvrd
    C:\Users\Admin\AppData\Roaming\ebfdvrd
    1⤵
    • Executes dropped EXE
    PID:3188
    • C:\Users\Admin\AppData\Roaming\ebfdvrd
      C:\Users\Admin\AppData\Roaming\ebfdvrd
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1540

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\F54F.exe.log
    MD5

    41fbed686f5700fc29aaccf83e8ba7fd

    SHA1

    5271bc29538f11e42a3b600c8dc727186e912456

    SHA256

    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

    SHA512

    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

  • C:\Users\Admin\AppData\Local\Temp\7D.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\7D.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\E78.exe
    MD5

    8e4900be6c568c8833b9020c97d5c26d

    SHA1

    c012f4e440551ff055ba03e4261b8cbcac926bf4

    SHA256

    9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a

    SHA512

    0f7d31976efdea8d6c1a24aa90c2a8a17498b8a4d051b0cca20659f1870685b55c89e83f7de0c9eb3c142ba4e87aed996de2f28b0fcc62fdec46d75574fa3ae1

  • C:\Users\Admin\AppData\Local\Temp\E78.exe
    MD5

    8e4900be6c568c8833b9020c97d5c26d

    SHA1

    c012f4e440551ff055ba03e4261b8cbcac926bf4

    SHA256

    9308d06fec62ea75d5d1a5a86114ee2b326c543f9338ea5216ef88fb31af241a

    SHA512

    0f7d31976efdea8d6c1a24aa90c2a8a17498b8a4d051b0cca20659f1870685b55c89e83f7de0c9eb3c142ba4e87aed996de2f28b0fcc62fdec46d75574fa3ae1

  • C:\Users\Admin\AppData\Local\Temp\F08B.exe
    MD5

    a33fb4be7ac6ae4caf3b1bbbabdc137e

    SHA1

    d92579ae7748a8c8ea9a4fe34110bb1f76e05d9b

    SHA256

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4

    SHA512

    fe64a7b88cc53b7afad7ea2b0a93b154277bc4d434252ab014dff272e6f2f7eab657cb50473de7c01200d7164c019308be65a281169ffcb3be270df36dfe2af6

  • C:\Users\Admin\AppData\Local\Temp\F08B.exe
    MD5

    a33fb4be7ac6ae4caf3b1bbbabdc137e

    SHA1

    d92579ae7748a8c8ea9a4fe34110bb1f76e05d9b

    SHA256

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4

    SHA512

    fe64a7b88cc53b7afad7ea2b0a93b154277bc4d434252ab014dff272e6f2f7eab657cb50473de7c01200d7164c019308be65a281169ffcb3be270df36dfe2af6

  • C:\Users\Admin\AppData\Local\Temp\F08B.exe
    MD5

    a33fb4be7ac6ae4caf3b1bbbabdc137e

    SHA1

    d92579ae7748a8c8ea9a4fe34110bb1f76e05d9b

    SHA256

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4

    SHA512

    fe64a7b88cc53b7afad7ea2b0a93b154277bc4d434252ab014dff272e6f2f7eab657cb50473de7c01200d7164c019308be65a281169ffcb3be270df36dfe2af6

  • C:\Users\Admin\AppData\Local\Temp\F54F.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\F54F.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\F54F.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\F7EF.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Local\Temp\F7EF.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Local\Temp\FC07.exe
    MD5

    1c3d7d93df23a48e7e009d4e724f943f

    SHA1

    8b9e432a7ad63d6f0d1d34d9f9ed45e5f75c0bd7

    SHA256

    fb6c44a8a6f9bf805dbaf1ec5b01df27d176036b30aa2b5d6e8afb65d22bd954

    SHA512

    841a1e7e947a257229edd40f91945fbfcb33d788386ec301cedc4d7ee9d77b79390641fe8918aa53c3f6b60cb9ee228894046b332498e7dfc84b126c1774e403

  • C:\Users\Admin\AppData\Local\Temp\FC07.exe
    MD5

    1c3d7d93df23a48e7e009d4e724f943f

    SHA1

    8b9e432a7ad63d6f0d1d34d9f9ed45e5f75c0bd7

    SHA256

    fb6c44a8a6f9bf805dbaf1ec5b01df27d176036b30aa2b5d6e8afb65d22bd954

    SHA512

    841a1e7e947a257229edd40f91945fbfcb33d788386ec301cedc4d7ee9d77b79390641fe8918aa53c3f6b60cb9ee228894046b332498e7dfc84b126c1774e403

  • C:\Users\Admin\AppData\Local\Temp\FC07.exe
    MD5

    1c3d7d93df23a48e7e009d4e724f943f

    SHA1

    8b9e432a7ad63d6f0d1d34d9f9ed45e5f75c0bd7

    SHA256

    fb6c44a8a6f9bf805dbaf1ec5b01df27d176036b30aa2b5d6e8afb65d22bd954

    SHA512

    841a1e7e947a257229edd40f91945fbfcb33d788386ec301cedc4d7ee9d77b79390641fe8918aa53c3f6b60cb9ee228894046b332498e7dfc84b126c1774e403

  • C:\Users\Admin\AppData\Roaming\ebfdvrd
    MD5

    a33fb4be7ac6ae4caf3b1bbbabdc137e

    SHA1

    d92579ae7748a8c8ea9a4fe34110bb1f76e05d9b

    SHA256

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4

    SHA512

    fe64a7b88cc53b7afad7ea2b0a93b154277bc4d434252ab014dff272e6f2f7eab657cb50473de7c01200d7164c019308be65a281169ffcb3be270df36dfe2af6

  • C:\Users\Admin\AppData\Roaming\ebfdvrd
    MD5

    a33fb4be7ac6ae4caf3b1bbbabdc137e

    SHA1

    d92579ae7748a8c8ea9a4fe34110bb1f76e05d9b

    SHA256

    0ef907de2ec40e93b1c1aed504e0d026a9c7a29ab7efa702f0446685acff13f4

    SHA512

    fe64a7b88cc53b7afad7ea2b0a93b154277bc4d434252ab014dff272e6f2f7eab657cb50473de7c01200d7164c019308be65a281169ffcb3be270df36dfe2af6

  • memory/636-127-0x0000000000402DD8-mapping.dmp
  • memory/736-196-0x0000000006F70000-0x0000000006F71000-memory.dmp
    Filesize

    4KB

  • memory/736-169-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/736-195-0x0000000006870000-0x0000000006871000-memory.dmp
    Filesize

    4KB

  • memory/736-192-0x0000000005C00000-0x0000000005C01000-memory.dmp
    Filesize

    4KB

  • memory/736-170-0x0000000000418EEA-mapping.dmp
  • memory/736-179-0x0000000004DB0000-0x00000000053B6000-memory.dmp
    Filesize

    6.0MB

  • memory/736-190-0x0000000005050000-0x0000000005051000-memory.dmp
    Filesize

    4KB

  • memory/1460-189-0x0000000000400000-0x0000000002B85000-memory.dmp
    Filesize

    39.5MB

  • memory/1460-188-0x0000000004810000-0x000000000489F000-memory.dmp
    Filesize

    572KB

  • memory/1460-184-0x0000000002E86000-0x0000000002ED6000-memory.dmp
    Filesize

    320KB

  • memory/1460-153-0x0000000000000000-mapping.dmp
  • memory/1980-132-0x0000000000540000-0x000000000068A000-memory.dmp
    Filesize

    1.3MB

  • memory/1980-123-0x0000000000000000-mapping.dmp
  • memory/2228-185-0x0000000002020000-0x000000000206F000-memory.dmp
    Filesize

    316KB

  • memory/2228-186-0x0000000002070000-0x00000000020FF000-memory.dmp
    Filesize

    572KB

  • memory/2228-187-0x0000000000400000-0x0000000000491000-memory.dmp
    Filesize

    580KB

  • memory/2228-181-0x0000000000000000-mapping.dmp
  • memory/2264-200-0x0000000006690000-0x00000000066A6000-memory.dmp
    Filesize

    88KB

  • memory/2264-180-0x0000000004CD0000-0x0000000004CE6000-memory.dmp
    Filesize

    88KB

  • memory/2264-122-0x0000000001250000-0x0000000001266000-memory.dmp
    Filesize

    88KB

  • memory/2536-121-0x0000000000540000-0x000000000068A000-memory.dmp
    Filesize

    1.3MB

  • memory/2536-120-0x0000000000520000-0x0000000000528000-memory.dmp
    Filesize

    32KB

  • memory/2656-119-0x0000000000402DD8-mapping.dmp
  • memory/2656-118-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/2684-137-0x0000000000000000-mapping.dmp
  • memory/2684-147-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/2684-146-0x00000000005A0000-0x00000000005A9000-memory.dmp
    Filesize

    36KB

  • memory/2684-145-0x0000000000440000-0x00000000004EE000-memory.dmp
    Filesize

    696KB

  • memory/3216-129-0x0000000000000000-mapping.dmp
  • memory/3216-133-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
    Filesize

    4KB

  • memory/3216-135-0x00000000054D0000-0x00000000054D1000-memory.dmp
    Filesize

    4KB

  • memory/3216-136-0x0000000003030000-0x0000000003031000-memory.dmp
    Filesize

    4KB

  • memory/3216-140-0x0000000005B40000-0x0000000005B41000-memory.dmp
    Filesize

    4KB

  • memory/3216-141-0x0000000005630000-0x0000000005631000-memory.dmp
    Filesize

    4KB

  • memory/3260-162-0x0000000002070000-0x00000000020A0000-memory.dmp
    Filesize

    192KB

  • memory/3260-161-0x0000000000590000-0x00000000006DA000-memory.dmp
    Filesize

    1.3MB

  • memory/3260-142-0x0000000000000000-mapping.dmp
  • memory/4036-148-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/4036-157-0x0000000004F40000-0x0000000004F41000-memory.dmp
    Filesize

    4KB

  • memory/4036-158-0x00000000049C0000-0x00000000049C1000-memory.dmp
    Filesize

    4KB

  • memory/4036-149-0x000000000040CD2F-mapping.dmp
  • memory/4036-159-0x0000000005550000-0x0000000005551000-memory.dmp
    Filesize

    4KB

  • memory/4036-160-0x00000000049F0000-0x00000000049F1000-memory.dmp
    Filesize

    4KB

  • memory/4036-155-0x0000000002420000-0x000000000243B000-memory.dmp
    Filesize

    108KB

  • memory/4036-151-0x0000000002260000-0x000000000227C000-memory.dmp
    Filesize

    112KB

  • memory/4036-164-0x0000000004A30000-0x0000000004A31000-memory.dmp
    Filesize

    4KB

  • memory/4036-163-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/4036-165-0x00000000056A0000-0x00000000056A1000-memory.dmp
    Filesize

    4KB

  • memory/4036-168-0x0000000004A34000-0x0000000004A36000-memory.dmp
    Filesize

    8KB

  • memory/4036-167-0x0000000004A33000-0x0000000004A34000-memory.dmp
    Filesize

    4KB

  • memory/4036-166-0x0000000004A32000-0x0000000004A33000-memory.dmp
    Filesize

    4KB