Analysis

  • max time kernel
    152s
  • max time network
    147s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    14-11-2021 13:07

General

  • Target

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b.exe

  • Size

    219KB

  • MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

  • SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

  • SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

  • SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-file-host6.com/

http://host-host-file8.com/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

185.159.80.90:38637

Extracted

Family

redline

Botnet

SuperStar

C2

185.215.113.29:36224

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

675718a5f2ce6d3cacf6cb04a512f5637eae995f

Attributes
  • url4cnc

    http://91.219.236.27/agrybirdsgamerept

    http://5.181.156.92/agrybirdsgamerept

    http://91.219.236.207/agrybirdsgamerept

    http://185.225.19.18/agrybirdsgamerept

    http://91.219.237.227/agrybirdsgamerept

    http://185.163.47.176/agrybirdsgamerept

rc4.plain
rc4.plain

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

ddf183af4241e3172885cf1b2c4c1fb4ee03d05a

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://5.181.156.92/capibar

    http://91.219.236.207/capibar

    http://185.225.19.18/capibar

    http://91.219.237.227/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 11 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 5 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 36 IoCs
  • Suspicious use of WriteProcessMemory 53 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b.exe
    "C:\Users\Admin\AppData\Local\Temp\1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4484
    • C:\Users\Admin\AppData\Local\Temp\1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b.exe
      "C:\Users\Admin\AppData\Local\Temp\1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4356
  • C:\Users\Admin\AppData\Local\Temp\F761.exe
    C:\Users\Admin\AppData\Local\Temp\F761.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:808
    • C:\Users\Admin\AppData\Local\Temp\F761.exe
      C:\Users\Admin\AppData\Local\Temp\F761.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2960
  • C:\Users\Admin\AppData\Local\Temp\FC25.exe
    C:\Users\Admin\AppData\Local\Temp\FC25.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:528
    • C:\Users\Admin\AppData\Local\Temp\FC25.exe
      C:\Users\Admin\AppData\Local\Temp\FC25.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1296
  • C:\Users\Admin\AppData\Local\Temp\FD8D.exe
    C:\Users\Admin\AppData\Local\Temp\FD8D.exe
    1⤵
    • Executes dropped EXE
    PID:480
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 480 -s 492
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:1640
  • C:\Users\Admin\AppData\Local\Temp\CA.exe
    C:\Users\Admin\AppData\Local\Temp\CA.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1260
    • C:\Users\Admin\AppData\Local\Temp\CA.exe
      C:\Users\Admin\AppData\Local\Temp\CA.exe
      2⤵
      • Executes dropped EXE
      PID:1664
  • C:\Users\Admin\AppData\Local\Temp\61A.exe
    C:\Users\Admin\AppData\Local\Temp\61A.exe
    1⤵
    • Executes dropped EXE
    PID:2464
  • C:\Users\Admin\AppData\Local\Temp\1464.exe
    C:\Users\Admin\AppData\Local\Temp\1464.exe
    1⤵
    • Executes dropped EXE
    PID:4220
  • C:\Users\Admin\AppData\Roaming\cdddcrc
    C:\Users\Admin\AppData\Roaming\cdddcrc
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:5084
    • C:\Users\Admin\AppData\Roaming\cdddcrc
      C:\Users\Admin\AppData\Roaming\cdddcrc
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1544

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FC25.exe.log
    MD5

    41fbed686f5700fc29aaccf83e8ba7fd

    SHA1

    5271bc29538f11e42a3b600c8dc727186e912456

    SHA256

    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

    SHA512

    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

  • C:\Users\Admin\AppData\Local\Temp\1464.exe
    MD5

    81f60282c49313ee738f4557c3b463c6

    SHA1

    999749d7f927e024f5df4ac69754d4ffd5e3a17f

    SHA256

    5decfeda21c9dd9bd48be72f96d50b392c3a0d1ea065e5e35b67d1fb0ee8e0d0

    SHA512

    5b911946550cde9779b6e6e4006e8ab94cd64aa760a3ffbcb6a3c222ada5d4abbf7f66ac9258a04e4c9e633ad8581fbb56070f6cd62d8b40ff14fd2339d5d494

  • C:\Users\Admin\AppData\Local\Temp\1464.exe
    MD5

    81f60282c49313ee738f4557c3b463c6

    SHA1

    999749d7f927e024f5df4ac69754d4ffd5e3a17f

    SHA256

    5decfeda21c9dd9bd48be72f96d50b392c3a0d1ea065e5e35b67d1fb0ee8e0d0

    SHA512

    5b911946550cde9779b6e6e4006e8ab94cd64aa760a3ffbcb6a3c222ada5d4abbf7f66ac9258a04e4c9e633ad8581fbb56070f6cd62d8b40ff14fd2339d5d494

  • C:\Users\Admin\AppData\Local\Temp\61A.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\61A.exe
    MD5

    0f9d1f2e3aaad601bb95a039b0aedcfb

    SHA1

    141e7b7b2a4a31b2a7e599b2d2064239fcc66707

    SHA256

    db4ec306ea32c01cb486566c699b9b88013beb26c2830319785bf5a4ee4735b5

    SHA512

    b68708a0aa425a3f90df3c1639aeb2358f34fa5bfb3691d3010cd528cdce99692269b13cda9f05172d8608fc08b7b7ca5449d495290a5e9e81221edfe9d052e7

  • C:\Users\Admin\AppData\Local\Temp\CA.exe
    MD5

    5d3c0a391011c1673061dd001b79c754

    SHA1

    14c4e5e86200a63eda9164060e75347a78ab97a2

    SHA256

    960d0efb87061f0ca60e641816a5a6b79da38fe7138fba7caf35a15cdfeb3978

    SHA512

    75e3d11a8c7b5d15d6747413256f554cb41a9b79a1bcc79d9db95ac43bdb0cfc74445f3696be46c300af70dce5b5d3a7495d2b9c98e2f86020045559bad275e4

  • C:\Users\Admin\AppData\Local\Temp\CA.exe
    MD5

    5d3c0a391011c1673061dd001b79c754

    SHA1

    14c4e5e86200a63eda9164060e75347a78ab97a2

    SHA256

    960d0efb87061f0ca60e641816a5a6b79da38fe7138fba7caf35a15cdfeb3978

    SHA512

    75e3d11a8c7b5d15d6747413256f554cb41a9b79a1bcc79d9db95ac43bdb0cfc74445f3696be46c300af70dce5b5d3a7495d2b9c98e2f86020045559bad275e4

  • C:\Users\Admin\AppData\Local\Temp\CA.exe
    MD5

    5d3c0a391011c1673061dd001b79c754

    SHA1

    14c4e5e86200a63eda9164060e75347a78ab97a2

    SHA256

    960d0efb87061f0ca60e641816a5a6b79da38fe7138fba7caf35a15cdfeb3978

    SHA512

    75e3d11a8c7b5d15d6747413256f554cb41a9b79a1bcc79d9db95ac43bdb0cfc74445f3696be46c300af70dce5b5d3a7495d2b9c98e2f86020045559bad275e4

  • C:\Users\Admin\AppData\Local\Temp\F761.exe
    MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

    SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

    SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

    SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

  • C:\Users\Admin\AppData\Local\Temp\F761.exe
    MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

    SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

    SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

    SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

  • C:\Users\Admin\AppData\Local\Temp\F761.exe
    MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

    SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

    SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

    SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

  • C:\Users\Admin\AppData\Local\Temp\FC25.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\FC25.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\FC25.exe
    MD5

    5e34695c9f46f1e69ce731d3b7359c88

    SHA1

    e1e5bb43f0c7556bcccc8cb698f854694bdc024a

    SHA256

    97f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc

    SHA512

    659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43

  • C:\Users\Admin\AppData\Local\Temp\FD8D.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Local\Temp\FD8D.exe
    MD5

    d985b4cfdceecc3c0fe4f3e4fda4e416

    SHA1

    f3c14a4d87569e54faaf0eac73ec1aafa2621dfa

    SHA256

    a8b37d6b073ee045ae63473cb1a592c974e896b19e3db06d552f955901c06db7

    SHA512

    560a056c076db6893f6407807d9a10d1078c148aa588d9de6ce1874eeac0a4feaf2102b656ba96316a32c89df97986f20cf77e55117e2c9bf97e52ef3381335c

  • C:\Users\Admin\AppData\Roaming\cdddcrc
    MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

    SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

    SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

    SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

  • C:\Users\Admin\AppData\Roaming\cdddcrc
    MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

    SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

    SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

    SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

  • C:\Users\Admin\AppData\Roaming\cdddcrc
    MD5

    0e9c700cc6884bb6171b0cd8d8dd1460

    SHA1

    c7a280f9dc20e26ff65433d0589044b0c8a71a0d

    SHA256

    1341f00a5dc618b6fd4d3e7892d063e477a8e42be70697776aa84e112abe3d5b

    SHA512

    3e5efc59af6a673b3868c17c5a9bbe74e63a5fba20d23da983721b819b9f0479f593287729372abee92588390e2b39346ac385598ef3979b1131b0c1b691fe2e

  • memory/480-132-0x0000000000000000-mapping.dmp
  • memory/480-148-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/480-147-0x0000000000440000-0x00000000004EE000-memory.dmp
    Filesize

    696KB

  • memory/480-146-0x0000000000440000-0x00000000004EE000-memory.dmp
    Filesize

    696KB

  • memory/528-138-0x0000000005130000-0x0000000005131000-memory.dmp
    Filesize

    4KB

  • memory/528-137-0x00000000051B0000-0x00000000051B1000-memory.dmp
    Filesize

    4KB

  • memory/528-142-0x0000000005870000-0x0000000005871000-memory.dmp
    Filesize

    4KB

  • memory/528-141-0x0000000005360000-0x0000000005361000-memory.dmp
    Filesize

    4KB

  • memory/528-129-0x0000000000000000-mapping.dmp
  • memory/528-135-0x0000000000950000-0x0000000000951000-memory.dmp
    Filesize

    4KB

  • memory/808-139-0x0000000000440000-0x000000000058A000-memory.dmp
    Filesize

    1.3MB

  • memory/808-140-0x0000000000440000-0x000000000058A000-memory.dmp
    Filesize

    1.3MB

  • memory/808-123-0x0000000000000000-mapping.dmp
  • memory/1260-143-0x0000000000000000-mapping.dmp
  • memory/1260-163-0x0000000000500000-0x00000000005AE000-memory.dmp
    Filesize

    696KB

  • memory/1260-162-0x00000000004B0000-0x00000000004D2000-memory.dmp
    Filesize

    136KB

  • memory/1296-171-0x0000000000418EEA-mapping.dmp
  • memory/1296-180-0x0000000004E20000-0x0000000005426000-memory.dmp
    Filesize

    6.0MB

  • memory/1296-192-0x0000000005390000-0x0000000005391000-memory.dmp
    Filesize

    4KB

  • memory/1296-197-0x0000000007000000-0x0000000007001000-memory.dmp
    Filesize

    4KB

  • memory/1296-170-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1296-195-0x0000000005BB0000-0x0000000005BB1000-memory.dmp
    Filesize

    4KB

  • memory/1296-196-0x0000000006900000-0x0000000006901000-memory.dmp
    Filesize

    4KB

  • memory/1544-202-0x0000000000402DD8-mapping.dmp
  • memory/1664-168-0x0000000004AE3000-0x0000000004AE4000-memory.dmp
    Filesize

    4KB

  • memory/1664-160-0x0000000005600000-0x0000000005601000-memory.dmp
    Filesize

    4KB

  • memory/1664-167-0x0000000004AE2000-0x0000000004AE3000-memory.dmp
    Filesize

    4KB

  • memory/1664-166-0x0000000004A70000-0x0000000004A71000-memory.dmp
    Filesize

    4KB

  • memory/1664-164-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1664-169-0x0000000004AE4000-0x0000000004AE6000-memory.dmp
    Filesize

    8KB

  • memory/1664-161-0x0000000004A30000-0x0000000004A31000-memory.dmp
    Filesize

    4KB

  • memory/1664-150-0x000000000040CD2F-mapping.dmp
  • memory/1664-159-0x00000000049C0000-0x00000000049C1000-memory.dmp
    Filesize

    4KB

  • memory/1664-156-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
    Filesize

    4KB

  • memory/1664-152-0x0000000000670000-0x000000000068C000-memory.dmp
    Filesize

    112KB

  • memory/1664-149-0x0000000000400000-0x0000000000433000-memory.dmp
    Filesize

    204KB

  • memory/1664-154-0x0000000002480000-0x000000000249B000-memory.dmp
    Filesize

    108KB

  • memory/1664-165-0x0000000004AE0000-0x0000000004AE1000-memory.dmp
    Filesize

    4KB

  • memory/2236-206-0x0000000005210000-0x0000000005226000-memory.dmp
    Filesize

    88KB

  • memory/2236-122-0x0000000000D20000-0x0000000000D36000-memory.dmp
    Filesize

    88KB

  • memory/2236-181-0x00000000048D0000-0x00000000048E6000-memory.dmp
    Filesize

    88KB

  • memory/2464-155-0x0000000000000000-mapping.dmp
  • memory/2464-187-0x0000000002C86000-0x0000000002CD6000-memory.dmp
    Filesize

    320KB

  • memory/2464-189-0x00000000047E0000-0x000000000486F000-memory.dmp
    Filesize

    572KB

  • memory/2464-190-0x0000000000400000-0x0000000002B85000-memory.dmp
    Filesize

    39.5MB

  • memory/2960-127-0x0000000000402DD8-mapping.dmp
  • memory/4220-188-0x0000000000400000-0x0000000000491000-memory.dmp
    Filesize

    580KB

  • memory/4220-185-0x0000000000560000-0x00000000006AA000-memory.dmp
    Filesize

    1.3MB

  • memory/4220-186-0x0000000002050000-0x00000000020DF000-memory.dmp
    Filesize

    572KB

  • memory/4220-182-0x0000000000000000-mapping.dmp
  • memory/4356-118-0x0000000000400000-0x0000000000409000-memory.dmp
    Filesize

    36KB

  • memory/4356-119-0x0000000000402DD8-mapping.dmp
  • memory/4484-120-0x0000000000550000-0x0000000000558000-memory.dmp
    Filesize

    32KB

  • memory/4484-121-0x0000000002020000-0x0000000002029000-memory.dmp
    Filesize

    36KB

  • memory/5084-204-0x00000000004A0000-0x00000000005EA000-memory.dmp
    Filesize

    1.3MB

  • memory/5084-205-0x00000000004A0000-0x00000000005EA000-memory.dmp
    Filesize

    1.3MB