Analysis

  • max time kernel
    151s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    14-11-2021 12:09

General

  • Target

    b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3.exe

  • Size

    219KB

  • MD5

    ee0350a7dba1fb04740017294f9a5d68

  • SHA1

    e8f6cddfcec0e7685ffca138a26ce86b086757f1

  • SHA256

    b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3

  • SHA512

    4c8dd652e69769fad998740340076b8f41e6c0d7efdc25a12aabf1f7f1cfa4588ea345857b4729a0d3dc5be0e5a6da3e843357edf169ee174977e593c6e8de06

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes
  • url4cnc

    http://91.219.236.27/agrybirdsgamerept

    http://5.181.156.92/agrybirdsgamerept

    http://91.219.236.207/agrybirdsgamerept

    http://185.225.19.18/agrybirdsgamerept

    http://91.219.237.227/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://5.181.156.92/capibar

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 34 IoCs
  • Suspicious use of WriteProcessMemory 50 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3.exe
    "C:\Users\Admin\AppData\Local\Temp\b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3184
    • C:\Users\Admin\AppData\Local\Temp\b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3.exe
      "C:\Users\Admin\AppData\Local\Temp\b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2724
  • C:\Users\Admin\AppData\Local\Temp\128A.exe
    C:\Users\Admin\AppData\Local\Temp\128A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:860
    • C:\Users\Admin\AppData\Local\Temp\128A.exe
      C:\Users\Admin\AppData\Local\Temp\128A.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:864
  • C:\Users\Admin\AppData\Local\Temp\177D.exe
    C:\Users\Admin\AppData\Local\Temp\177D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3768
    • C:\Users\Admin\AppData\Local\Temp\177D.exe
      C:\Users\Admin\AppData\Local\Temp\177D.exe
      2⤵
      • Executes dropped EXE
      PID:2520
    • C:\Users\Admin\AppData\Local\Temp\177D.exe
      C:\Users\Admin\AppData\Local\Temp\177D.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1508
  • C:\Users\Admin\AppData\Local\Temp\1A9A.exe
    C:\Users\Admin\AppData\Local\Temp\1A9A.exe
    1⤵
    • Executes dropped EXE
    PID:3752
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3752 -s 480
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:2628
  • C:\Users\Admin\AppData\Local\Temp\1CDE.exe
    C:\Users\Admin\AppData\Local\Temp\1CDE.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1428
    • C:\Users\Admin\AppData\Local\Temp\1CDE.exe
      C:\Users\Admin\AppData\Local\Temp\1CDE.exe
      2⤵
      • Executes dropped EXE
      PID:2448
  • C:\Users\Admin\AppData\Local\Temp\22AB.exe
    C:\Users\Admin\AppData\Local\Temp\22AB.exe
    1⤵
    • Executes dropped EXE
    PID:3456
  • C:\Users\Admin\AppData\Local\Temp\2D99.exe
    C:\Users\Admin\AppData\Local\Temp\2D99.exe
    1⤵
    • Executes dropped EXE
    PID:744

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\177D.exe.log
    MD5

    41fbed686f5700fc29aaccf83e8ba7fd

    SHA1

    5271bc29538f11e42a3b600c8dc727186e912456

    SHA256

    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

    SHA512

    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

  • C:\Users\Admin\AppData\Local\Temp\128A.exe
    MD5

    ee0350a7dba1fb04740017294f9a5d68

    SHA1

    e8f6cddfcec0e7685ffca138a26ce86b086757f1

    SHA256

    b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3

    SHA512

    4c8dd652e69769fad998740340076b8f41e6c0d7efdc25a12aabf1f7f1cfa4588ea345857b4729a0d3dc5be0e5a6da3e843357edf169ee174977e593c6e8de06

  • C:\Users\Admin\AppData\Local\Temp\128A.exe
    MD5

    ee0350a7dba1fb04740017294f9a5d68

    SHA1

    e8f6cddfcec0e7685ffca138a26ce86b086757f1

    SHA256

    b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3

    SHA512

    4c8dd652e69769fad998740340076b8f41e6c0d7efdc25a12aabf1f7f1cfa4588ea345857b4729a0d3dc5be0e5a6da3e843357edf169ee174977e593c6e8de06

  • C:\Users\Admin\AppData\Local\Temp\128A.exe
    MD5

    ee0350a7dba1fb04740017294f9a5d68

    SHA1

    e8f6cddfcec0e7685ffca138a26ce86b086757f1

    SHA256

    b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3

    SHA512

    4c8dd652e69769fad998740340076b8f41e6c0d7efdc25a12aabf1f7f1cfa4588ea345857b4729a0d3dc5be0e5a6da3e843357edf169ee174977e593c6e8de06

  • C:\Users\Admin\AppData\Local\Temp\177D.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\177D.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\177D.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\177D.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\1A9A.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Local\Temp\1A9A.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Local\Temp\1CDE.exe
    MD5

    475227eebb5a7d5eff9c621ff9a9c124

    SHA1

    2131fd1692f442d02fda77a75f8a08d057b608cd

    SHA256

    a0933cf79231429b6be37a0c82f00e309409d2dc7d08519404473b47ab880c8a

    SHA512

    be0b29ac8dbe56efa6faf15da6e3375b3a89dbda2ff6dfcefccf6c0f340dc698329b1db34f33f707ef7f601fdd3bfb2396eecd201a6532e03580f98c0e9e0632

  • C:\Users\Admin\AppData\Local\Temp\1CDE.exe
    MD5

    475227eebb5a7d5eff9c621ff9a9c124

    SHA1

    2131fd1692f442d02fda77a75f8a08d057b608cd

    SHA256

    a0933cf79231429b6be37a0c82f00e309409d2dc7d08519404473b47ab880c8a

    SHA512

    be0b29ac8dbe56efa6faf15da6e3375b3a89dbda2ff6dfcefccf6c0f340dc698329b1db34f33f707ef7f601fdd3bfb2396eecd201a6532e03580f98c0e9e0632

  • C:\Users\Admin\AppData\Local\Temp\1CDE.exe
    MD5

    475227eebb5a7d5eff9c621ff9a9c124

    SHA1

    2131fd1692f442d02fda77a75f8a08d057b608cd

    SHA256

    a0933cf79231429b6be37a0c82f00e309409d2dc7d08519404473b47ab880c8a

    SHA512

    be0b29ac8dbe56efa6faf15da6e3375b3a89dbda2ff6dfcefccf6c0f340dc698329b1db34f33f707ef7f601fdd3bfb2396eecd201a6532e03580f98c0e9e0632

  • C:\Users\Admin\AppData\Local\Temp\22AB.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\22AB.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\2D99.exe
    MD5

    390f37e9d800eeefd843bb2a8c3b491c

    SHA1

    e7fa220b5e296dabe9e53c92b900f6e374394e99

    SHA256

    2672df533124d3a1f58f06caccf8d56e77e8ce2c9f24f909aa69f465ae6b8871

    SHA512

    83e15e28cb5e272d4c737bc46be2c681528b5d5fe3957ce261261a0fb8af75ea1f2543d66198abb7fecdbcd5b37f41bd2aa59631e7c0e3d9f171815b72679015

  • C:\Users\Admin\AppData\Local\Temp\2D99.exe
    MD5

    390f37e9d800eeefd843bb2a8c3b491c

    SHA1

    e7fa220b5e296dabe9e53c92b900f6e374394e99

    SHA256

    2672df533124d3a1f58f06caccf8d56e77e8ce2c9f24f909aa69f465ae6b8871

    SHA512

    83e15e28cb5e272d4c737bc46be2c681528b5d5fe3957ce261261a0fb8af75ea1f2543d66198abb7fecdbcd5b37f41bd2aa59631e7c0e3d9f171815b72679015

  • memory/744-174-0x0000000000400000-0x0000000000491000-memory.dmp
    Filesize

    580KB

  • memory/744-173-0x0000000000750000-0x00000000007DF000-memory.dmp
    Filesize

    572KB

  • memory/744-168-0x0000000000000000-mapping.dmp
  • memory/744-172-0x00000000006D0000-0x000000000071F000-memory.dmp
    Filesize

    316KB

  • memory/860-120-0x0000000000000000-mapping.dmp
  • memory/860-126-0x0000000000440000-0x00000000004EE000-memory.dmp
    Filesize

    696KB

  • memory/860-127-0x0000000000440000-0x00000000004EE000-memory.dmp
    Filesize

    696KB

  • memory/864-124-0x0000000000402DD8-mapping.dmp
  • memory/1428-153-0x00000000004E0000-0x000000000062A000-memory.dmp
    Filesize

    1.3MB

  • memory/1428-136-0x0000000000000000-mapping.dmp
  • memory/1428-155-0x0000000001FA0000-0x0000000001FD0000-memory.dmp
    Filesize

    192KB

  • memory/1508-191-0x0000000006460000-0x0000000006461000-memory.dmp
    Filesize

    4KB

  • memory/1508-188-0x0000000005470000-0x0000000005A76000-memory.dmp
    Filesize

    6.0MB

  • memory/1508-179-0x0000000000418EEA-mapping.dmp
  • memory/1508-194-0x00000000070D0000-0x00000000070D1000-memory.dmp
    Filesize

    4KB

  • memory/1508-195-0x00000000077D0000-0x00000000077D1000-memory.dmp
    Filesize

    4KB

  • memory/1508-189-0x00000000058A0000-0x00000000058A1000-memory.dmp
    Filesize

    4KB

  • memory/1508-178-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/2448-147-0x0000000000610000-0x000000000062C000-memory.dmp
    Filesize

    112KB

  • memory/2448-158-0x00000000021C0000-0x00000000021C1000-memory.dmp
    Filesize

    4KB

  • memory/2448-154-0x00000000024E0000-0x00000000024FB000-memory.dmp
    Filesize

    108KB

  • memory/2448-151-0x00000000049D0000-0x00000000049D1000-memory.dmp
    Filesize

    4KB

  • memory/2448-145-0x000000000040CD2F-mapping.dmp
  • memory/2448-156-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/2448-157-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
    Filesize

    4KB

  • memory/2448-159-0x00000000021C2000-0x00000000021C3000-memory.dmp
    Filesize

    4KB

  • memory/2448-160-0x00000000021C3000-0x00000000021C4000-memory.dmp
    Filesize

    4KB

  • memory/2448-162-0x00000000054E0000-0x00000000054E1000-memory.dmp
    Filesize

    4KB

  • memory/2448-163-0x0000000005510000-0x0000000005511000-memory.dmp
    Filesize

    4KB

  • memory/2448-164-0x0000000005620000-0x0000000005621000-memory.dmp
    Filesize

    4KB

  • memory/2448-165-0x00000000021C4000-0x00000000021C6000-memory.dmp
    Filesize

    8KB

  • memory/2448-166-0x00000000056A0000-0x00000000056A1000-memory.dmp
    Filesize

    4KB

  • memory/2448-144-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/2724-118-0x0000000000402DD8-mapping.dmp
  • memory/2724-117-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/3032-167-0x00000000045D0000-0x00000000045E6000-memory.dmp
    Filesize

    88KB

  • memory/3032-119-0x0000000000540000-0x0000000000556000-memory.dmp
    Filesize

    88KB

  • memory/3184-116-0x0000000002160000-0x0000000002169000-memory.dmp
    Filesize

    36KB

  • memory/3184-115-0x0000000002150000-0x0000000002158000-memory.dmp
    Filesize

    32KB

  • memory/3456-177-0x0000000000400000-0x0000000002B85000-memory.dmp
    Filesize

    39.5MB

  • memory/3456-176-0x0000000002BF0000-0x0000000002C9E000-memory.dmp
    Filesize

    696KB

  • memory/3456-148-0x0000000000000000-mapping.dmp
  • memory/3752-131-0x0000000000000000-mapping.dmp
  • memory/3752-141-0x0000000000540000-0x000000000068A000-memory.dmp
    Filesize

    1.3MB

  • memory/3752-140-0x0000000000520000-0x0000000000528000-memory.dmp
    Filesize

    32KB

  • memory/3752-142-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/3768-139-0x0000000005300000-0x0000000005301000-memory.dmp
    Filesize

    4KB

  • memory/3768-143-0x00000000052C0000-0x00000000052C1000-memory.dmp
    Filesize

    4KB

  • memory/3768-134-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
    Filesize

    4KB

  • memory/3768-152-0x0000000005510000-0x0000000005511000-memory.dmp
    Filesize

    4KB

  • memory/3768-128-0x0000000000000000-mapping.dmp