Analysis
- max time kernel
152s - max time network
147s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
15/11/2021, 04:17
General
- Target e348eacf82901caa56f47736b3acaba9.exe
- Size 219KB
- Sample211115-ewdl2sebdq
- SHA256 21947e9b48daa1bd000e165ade4eb930a4fa90614da348e3af08daa76971b293
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
- Deletes itself 1 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 20 IoCs
- Suspicious use of WriteProcessMemory 36 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e348eacf82901caa56f47736b3acaba9.exe"C:\Users\Admin\AppData\Local\Temp\e348eacf82901caa56f47736b3acaba9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e348eacf82901caa56f47736b3acaba9.exe"C:\Users\Admin\AppData\Local\Temp\e348eacf82901caa56f47736b3acaba9.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1E61.exeC:\Users\Admin\AppData\Local\Temp\1E61.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1E61.exeC:\Users\Admin\AppData\Local\Temp\1E61.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\23A2.exeC:\Users\Admin\AppData\Local\Temp\23A2.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3416 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\27BA.exeC:\Users\Admin\AppData\Local\Temp\27BA.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\27BA.exeC:\Users\Admin\AppData\Local\Temp\27BA.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2BA3.exeC:\Users\Admin\AppData\Local\Temp\2BA3.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\4C5B.exeC:\Users\Admin\AppData\Local\Temp\4C5B.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2028 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/892-159-0x0000000002E16000-0x0000000002E66000-memory.dmp
memory/892-161-0x0000000000400000-0x0000000002B85000-memory.dmp
memory/892-160-0x0000000004820000-0x00000000048AF000-memory.dmp
memory/972-151-0x0000000004972000-0x0000000004973000-memory.dmp
memory/972-156-0x0000000004974000-0x0000000004976000-memory.dmp
memory/972-152-0x0000000004973000-0x0000000004974000-memory.dmp
memory/972-150-0x0000000004970000-0x0000000004971000-memory.dmp
memory/972-149-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/972-137-0x0000000000400000-0x0000000000433000-memory.dmp
memory/972-148-0x0000000004910000-0x000000000492B000-memory.dmp
memory/972-158-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/972-153-0x00000000054E0000-0x00000000054E1000-memory.dmp
memory/972-147-0x0000000004980000-0x0000000004981000-memory.dmp
memory/972-155-0x0000000005620000-0x0000000005621000-memory.dmp
memory/972-154-0x0000000005510000-0x0000000005511000-memory.dmp
memory/972-145-0x0000000000400000-0x0000000000433000-memory.dmp
memory/972-146-0x0000000002300000-0x000000000231C000-memory.dmp
memory/2028-165-0x0000000002770000-0x00000000027D0000-memory.dmp
memory/2724-117-0x00000000006B0000-0x00000000006B8000-memory.dmp
memory/2724-118-0x00000000006C0000-0x00000000006C9000-memory.dmp
memory/3020-157-0x0000000002AE0000-0x0000000002AF6000-memory.dmp
memory/3020-119-0x0000000000820000-0x0000000000836000-memory.dmp
memory/3364-115-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3376-129-0x0000000000440000-0x00000000004EE000-memory.dmp
memory/3376-130-0x0000000000440000-0x00000000004EE000-memory.dmp
memory/3416-136-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3416-135-0x00000000005A0000-0x00000000005A9000-memory.dmp
memory/3416-134-0x0000000000590000-0x0000000000598000-memory.dmp
memory/4048-143-0x00000000004B0000-0x00000000004D2000-memory.dmp
memory/4048-144-0x0000000000510000-0x000000000065A000-memory.dmp