Analysis

  • max time kernel
    151s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    14-11-2021 12:36

General

  • Target

    ee0350a7dba1fb04740017294f9a5d68.exe

  • Size

    219KB

  • MD5

    ee0350a7dba1fb04740017294f9a5d68

  • SHA1

    e8f6cddfcec0e7685ffca138a26ce86b086757f1

  • SHA256

    b42594aa8ab53db52f547b48916adb07d0f87b631e3297e3118ef3614ea9e2b3

  • SHA512

    4c8dd652e69769fad998740340076b8f41e6c0d7efdc25a12aabf1f7f1cfa4588ea345857b4729a0d3dc5be0e5a6da3e843357edf169ee174977e593c6e8de06

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes
  • url4cnc

    http://91.219.236.27/agrybirdsgamerept

    http://5.181.156.92/agrybirdsgamerept

    http://91.219.236.207/agrybirdsgamerept

    http://185.225.19.18/agrybirdsgamerept

    http://91.219.237.227/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://5.181.156.92/capibar

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ee0350a7dba1fb04740017294f9a5d68.exe
    "C:\Users\Admin\AppData\Local\Temp\ee0350a7dba1fb04740017294f9a5d68.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:764
    • C:\Users\Admin\AppData\Local\Temp\ee0350a7dba1fb04740017294f9a5d68.exe
      "C:\Users\Admin\AppData\Local\Temp\ee0350a7dba1fb04740017294f9a5d68.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1464
  • C:\Users\Admin\AppData\Local\Temp\8E4B.exe
    C:\Users\Admin\AppData\Local\Temp\8E4B.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1756
    • C:\Users\Admin\AppData\Local\Temp\8E4B.exe
      C:\Users\Admin\AppData\Local\Temp\8E4B.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1308
  • C:\Users\Admin\AppData\Local\Temp\9416.exe
    C:\Users\Admin\AppData\Local\Temp\9416.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1640
    • C:\Users\Admin\AppData\Local\Temp\9416.exe
      C:\Users\Admin\AppData\Local\Temp\9416.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1392
  • C:\Users\Admin\AppData\Local\Temp\95BC.exe
    C:\Users\Admin\AppData\Local\Temp\95BC.exe
    1⤵
    • Executes dropped EXE
    PID:1060
  • C:\Users\Admin\AppData\Local\Temp\988B.exe
    C:\Users\Admin\AppData\Local\Temp\988B.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1880
    • C:\Users\Admin\AppData\Local\Temp\988B.exe
      C:\Users\Admin\AppData\Local\Temp\988B.exe
      2⤵
      • Executes dropped EXE
      PID:1764
  • C:\Users\Admin\AppData\Local\Temp\9EA4.exe
    C:\Users\Admin\AppData\Local\Temp\9EA4.exe
    1⤵
    • Executes dropped EXE
    PID:1200
  • C:\Users\Admin\AppData\Local\Temp\A79A.exe
    C:\Users\Admin\AppData\Local\Temp\A79A.exe
    1⤵
    • Executes dropped EXE
    PID:1216

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\8E4B.exe
    MD5

    524947e4ef8f43f10f91c74a0c213419

    SHA1

    82265aa9510e0e00035efe5fb6a5eebf7cf5493b

    SHA256

    c8f4dd7770356270fd8d60bd66508049e3cc55ab13ac24d75f34701b2c7e54a8

    SHA512

    5fb8df74132ac8aa00ce6a5f48fb8fc67167f829dcc6193a7d4ca9faff8ce5190632b533a5180b9ddf32a58c8228a7720b739dcf15416e1c2f47b3a2d8ede00f

  • C:\Users\Admin\AppData\Local\Temp\8E4B.exe
    MD5

    524947e4ef8f43f10f91c74a0c213419

    SHA1

    82265aa9510e0e00035efe5fb6a5eebf7cf5493b

    SHA256

    c8f4dd7770356270fd8d60bd66508049e3cc55ab13ac24d75f34701b2c7e54a8

    SHA512

    5fb8df74132ac8aa00ce6a5f48fb8fc67167f829dcc6193a7d4ca9faff8ce5190632b533a5180b9ddf32a58c8228a7720b739dcf15416e1c2f47b3a2d8ede00f

  • C:\Users\Admin\AppData\Local\Temp\8E4B.exe
    MD5

    524947e4ef8f43f10f91c74a0c213419

    SHA1

    82265aa9510e0e00035efe5fb6a5eebf7cf5493b

    SHA256

    c8f4dd7770356270fd8d60bd66508049e3cc55ab13ac24d75f34701b2c7e54a8

    SHA512

    5fb8df74132ac8aa00ce6a5f48fb8fc67167f829dcc6193a7d4ca9faff8ce5190632b533a5180b9ddf32a58c8228a7720b739dcf15416e1c2f47b3a2d8ede00f

  • C:\Users\Admin\AppData\Local\Temp\9416.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\9416.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\9416.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\95BC.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Local\Temp\988B.exe
    MD5

    8afc124eb046f8f27a24a30fb50d7af9

    SHA1

    8dd70444a901659ddde34d042e00986248381f97

    SHA256

    09337d3b93ad9a5fd7b0c02cba94cd6ecb359512aef4e0ed3aef314b35baa06b

    SHA512

    5cfa7b0887a6d6c91ca46d184786c5168cf6f3c220e61038a170e8612bd7f133d4951fc4cf374fe3b571480a900179f916cf841355943be68d1732f58dc44750

  • C:\Users\Admin\AppData\Local\Temp\988B.exe
    MD5

    8afc124eb046f8f27a24a30fb50d7af9

    SHA1

    8dd70444a901659ddde34d042e00986248381f97

    SHA256

    09337d3b93ad9a5fd7b0c02cba94cd6ecb359512aef4e0ed3aef314b35baa06b

    SHA512

    5cfa7b0887a6d6c91ca46d184786c5168cf6f3c220e61038a170e8612bd7f133d4951fc4cf374fe3b571480a900179f916cf841355943be68d1732f58dc44750

  • C:\Users\Admin\AppData\Local\Temp\988B.exe
    MD5

    8afc124eb046f8f27a24a30fb50d7af9

    SHA1

    8dd70444a901659ddde34d042e00986248381f97

    SHA256

    09337d3b93ad9a5fd7b0c02cba94cd6ecb359512aef4e0ed3aef314b35baa06b

    SHA512

    5cfa7b0887a6d6c91ca46d184786c5168cf6f3c220e61038a170e8612bd7f133d4951fc4cf374fe3b571480a900179f916cf841355943be68d1732f58dc44750

  • C:\Users\Admin\AppData\Local\Temp\9EA4.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\A79A.exe
    MD5

    81f60282c49313ee738f4557c3b463c6

    SHA1

    999749d7f927e024f5df4ac69754d4ffd5e3a17f

    SHA256

    5decfeda21c9dd9bd48be72f96d50b392c3a0d1ea065e5e35b67d1fb0ee8e0d0

    SHA512

    5b911946550cde9779b6e6e4006e8ab94cd64aa760a3ffbcb6a3c222ada5d4abbf7f66ac9258a04e4c9e633ad8581fbb56070f6cd62d8b40ff14fd2339d5d494

  • \Users\Admin\AppData\Local\Temp\8E4B.exe
    MD5

    524947e4ef8f43f10f91c74a0c213419

    SHA1

    82265aa9510e0e00035efe5fb6a5eebf7cf5493b

    SHA256

    c8f4dd7770356270fd8d60bd66508049e3cc55ab13ac24d75f34701b2c7e54a8

    SHA512

    5fb8df74132ac8aa00ce6a5f48fb8fc67167f829dcc6193a7d4ca9faff8ce5190632b533a5180b9ddf32a58c8228a7720b739dcf15416e1c2f47b3a2d8ede00f

  • \Users\Admin\AppData\Local\Temp\9416.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • \Users\Admin\AppData\Local\Temp\988B.exe
    MD5

    8afc124eb046f8f27a24a30fb50d7af9

    SHA1

    8dd70444a901659ddde34d042e00986248381f97

    SHA256

    09337d3b93ad9a5fd7b0c02cba94cd6ecb359512aef4e0ed3aef314b35baa06b

    SHA512

    5cfa7b0887a6d6c91ca46d184786c5168cf6f3c220e61038a170e8612bd7f133d4951fc4cf374fe3b571480a900179f916cf841355943be68d1732f58dc44750

  • memory/764-56-0x00000000002C0000-0x00000000002C9000-memory.dmp
    Filesize

    36KB

  • memory/764-55-0x00000000002A0000-0x00000000002A8000-memory.dmp
    Filesize

    32KB

  • memory/1060-82-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1060-73-0x0000000000000000-mapping.dmp
  • memory/1060-81-0x00000000001C0000-0x00000000001C9000-memory.dmp
    Filesize

    36KB

  • memory/1060-80-0x00000000001B0000-0x00000000001B8000-memory.dmp
    Filesize

    32KB

  • memory/1200-121-0x0000000000400000-0x0000000002B85000-memory.dmp
    Filesize

    39.5MB

  • memory/1200-120-0x00000000002A0000-0x000000000032F000-memory.dmp
    Filesize

    572KB

  • memory/1200-118-0x0000000002C1B000-0x0000000002C6A000-memory.dmp
    Filesize

    316KB

  • memory/1200-92-0x0000000000000000-mapping.dmp
  • memory/1216-115-0x0000000000220000-0x000000000026F000-memory.dmp
    Filesize

    316KB

  • memory/1216-117-0x0000000000400000-0x0000000000491000-memory.dmp
    Filesize

    580KB

  • memory/1216-101-0x0000000000000000-mapping.dmp
  • memory/1216-116-0x0000000000330000-0x00000000003BF000-memory.dmp
    Filesize

    572KB

  • memory/1308-66-0x0000000000402DD8-mapping.dmp
  • memory/1392-104-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1392-103-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1392-114-0x0000000000380000-0x0000000000381000-memory.dmp
    Filesize

    4KB

  • memory/1392-110-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1392-108-0x0000000000418EEA-mapping.dmp
  • memory/1392-107-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1392-106-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1392-105-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1400-60-0x0000000002560000-0x0000000002576000-memory.dmp
    Filesize

    88KB

  • memory/1400-111-0x00000000047D0000-0x00000000047E6000-memory.dmp
    Filesize

    88KB

  • memory/1464-57-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/1464-58-0x0000000000402DD8-mapping.dmp
  • memory/1464-59-0x0000000075321000-0x0000000075323000-memory.dmp
    Filesize

    8KB

  • memory/1640-70-0x0000000000000000-mapping.dmp
  • memory/1640-75-0x00000000013E0000-0x00000000013E1000-memory.dmp
    Filesize

    4KB

  • memory/1640-83-0x00000000003D0000-0x00000000003D1000-memory.dmp
    Filesize

    4KB

  • memory/1756-69-0x0000000000220000-0x0000000000228000-memory.dmp
    Filesize

    32KB

  • memory/1756-61-0x0000000000000000-mapping.dmp
  • memory/1764-90-0x00000000002D0000-0x00000000002EC000-memory.dmp
    Filesize

    112KB

  • memory/1764-98-0x00000000047B2000-0x00000000047B3000-memory.dmp
    Filesize

    4KB

  • memory/1764-97-0x00000000047B1000-0x00000000047B2000-memory.dmp
    Filesize

    4KB

  • memory/1764-96-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1764-99-0x00000000047B3000-0x00000000047B4000-memory.dmp
    Filesize

    4KB

  • memory/1764-100-0x00000000047B4000-0x00000000047B6000-memory.dmp
    Filesize

    8KB

  • memory/1764-87-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1764-88-0x000000000040CD2F-mapping.dmp
  • memory/1764-91-0x0000000000820000-0x000000000083B000-memory.dmp
    Filesize

    108KB

  • memory/1880-77-0x0000000000000000-mapping.dmp
  • memory/1880-95-0x0000000000250000-0x0000000000280000-memory.dmp
    Filesize

    192KB

  • memory/1880-94-0x0000000000220000-0x0000000000242000-memory.dmp
    Filesize

    136KB