Analysis
- max time kernel
150s - max time network
144s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
15/11/2021, 00:46
General
- Target 5c833832be02cb12a7d808e81b051f4e.exe
- Size 219KB
- Sample211115-a4m38seabq
- SHA256 a5e15b60683685e7a359e8461ac29b991b1ff20903e121df8a7a09d9fdc78b32
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
185.159.80.90:38637
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 5 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 10 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 2 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 4 IoCs
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5c833832be02cb12a7d808e81b051f4e.exe"C:\Users\Admin\AppData\Local\Temp\5c833832be02cb12a7d808e81b051f4e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5c833832be02cb12a7d808e81b051f4e.exe"C:\Users\Admin\AppData\Local\Temp\5c833832be02cb12a7d808e81b051f4e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1B83.exeC:\Users\Admin\AppData\Local\Temp\1B83.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1B83.exeC:\Users\Admin\AppData\Local\Temp\1B83.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\2047.exeC:\Users\Admin\AppData\Local\Temp\2047.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2047.exeC:\Users\Admin\AppData\Local\Temp\2047.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\2307.exeC:\Users\Admin\AppData\Local\Temp\2307.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1588 -s 4882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\252B.exeC:\Users\Admin\AppData\Local\Temp\252B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\252B.exeC:\Users\Admin\AppData\Local\Temp\252B.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2A6B.exeC:\Users\Admin\AppData\Local\Temp\2A6B.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4056.exeC:\Users\Admin\AppData\Local\Temp\4056.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\56CD.exeC:\Users\Admin\AppData\Local\Temp\56CD.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1836 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-155-0x0000000000690000-0x00000000006B2000-memory.dmp
memory/664-157-0x00000000006C0000-0x00000000006F0000-memory.dmp
memory/1176-152-0x0000000004BF2000-0x0000000004BF3000-memory.dmp
memory/1176-160-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/1176-156-0x00000000023B0000-0x00000000023CB000-memory.dmp
memory/1176-166-0x0000000004BF4000-0x0000000004BF6000-memory.dmp
memory/1176-159-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1176-143-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1176-161-0x0000000004BF3000-0x0000000004BF4000-memory.dmp
memory/1176-165-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/1176-158-0x0000000005100000-0x0000000005101000-memory.dmp
memory/1176-164-0x0000000004B30000-0x0000000004B31000-memory.dmp
memory/1176-163-0x0000000004A20000-0x0000000004A21000-memory.dmp
memory/1176-162-0x0000000002570000-0x0000000002571000-memory.dmp
memory/1176-150-0x00000000021C0000-0x00000000021DC000-memory.dmp
memory/1404-142-0x0000000003210000-0x0000000003211000-memory.dmp
memory/1404-146-0x0000000005E00000-0x0000000005E01000-memory.dmp
memory/1404-153-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/1404-136-0x0000000005700000-0x0000000005701000-memory.dmp
memory/1404-134-0x0000000000E90000-0x0000000000E91000-memory.dmp
memory/1580-183-0x0000000000400000-0x0000000002B85000-memory.dmp
memory/1580-182-0x00000000046B0000-0x000000000473F000-memory.dmp
memory/1588-151-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1588-140-0x0000000002020000-0x0000000002028000-memory.dmp
memory/1588-141-0x0000000002040000-0x0000000002049000-memory.dmp
memory/1700-215-0x0000000008D50000-0x0000000008D51000-memory.dmp
memory/1700-187-0x0000000000B70000-0x0000000000B71000-memory.dmp
memory/1700-190-0x0000000077280000-0x000000007740E000-memory.dmp
memory/1700-195-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/1836-206-0x00000000027A0000-0x0000000002800000-memory.dmp
memory/2216-130-0x00000000004A0000-0x00000000004A9000-memory.dmp
memory/2216-129-0x0000000000490000-0x0000000000498000-memory.dmp
memory/2744-118-0x00000000004A0000-0x000000000054E000-memory.dmp
memory/2744-117-0x00000000004A0000-0x000000000054E000-memory.dmp
memory/2916-200-0x0000000005D90000-0x0000000005D91000-memory.dmp
memory/2916-197-0x0000000005520000-0x0000000005521000-memory.dmp
memory/2916-201-0x0000000006AA0000-0x0000000006AA1000-memory.dmp
memory/2916-202-0x00000000071A0000-0x00000000071A1000-memory.dmp
memory/2916-177-0x0000000004FB0000-0x00000000055B6000-memory.dmp
memory/2916-168-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3004-119-0x0000000000650000-0x0000000000666000-memory.dmp
memory/3004-167-0x0000000002920000-0x0000000002936000-memory.dmp
memory/3248-115-0x0000000000400000-0x0000000000409000-memory.dmp