Analysis
- max time kernel
151s - max time network
152s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
15/11/2021, 08:12
General
- Target f6839a3fcf7ceceb2de4bc8660cb5217.exe
- Size 220KB
- Sample211115-j3valaeeem
- SHA256 3d609b245011159c0eeced43065a077488fbdb4273db8e2a93daff79392dc68e
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
185.159.80.90:38637
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 5 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- Downloads MZ/PE file
- Executes dropped EXE 10 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 4 IoCs
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 50 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f6839a3fcf7ceceb2de4bc8660cb5217.exe"C:\Users\Admin\AppData\Local\Temp\f6839a3fcf7ceceb2de4bc8660cb5217.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f6839a3fcf7ceceb2de4bc8660cb5217.exe"C:\Users\Admin\AppData\Local\Temp\f6839a3fcf7ceceb2de4bc8660cb5217.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\179B.exeC:\Users\Admin\AppData\Local\Temp\179B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\179B.exeC:\Users\Admin\AppData\Local\Temp\179B.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\1C30.exeC:\Users\Admin\AppData\Local\Temp\1C30.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1C30.exeC:\Users\Admin\AppData\Local\Temp\1C30.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1DA8.exeC:\Users\Admin\AppData\Local\Temp\1DA8.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3308 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\1FDB.exeC:\Users\Admin\AppData\Local\Temp\1FDB.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1FDB.exeC:\Users\Admin\AppData\Local\Temp\1FDB.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\2441.exeC:\Users\Admin\AppData\Local\Temp\2441.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3CEB.exeC:\Users\Admin\AppData\Local\Temp\3CEB.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2736 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\52B6.exeC:\Users\Admin\AppData\Local\Temp\52B6.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3556 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1032-180-0x0000000002DD6000-0x0000000002E26000-memory.dmp
memory/1032-184-0x00000000046A0000-0x000000000472F000-memory.dmp
memory/1032-186-0x0000000000400000-0x0000000002B85000-memory.dmp
memory/1400-168-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1400-190-0x0000000006220000-0x0000000006221000-memory.dmp
memory/1400-196-0x0000000007560000-0x0000000007561000-memory.dmp
memory/1400-179-0x0000000005260000-0x0000000005866000-memory.dmp
memory/1400-195-0x0000000006E60000-0x0000000006E61000-memory.dmp
memory/1400-188-0x0000000005620000-0x0000000005621000-memory.dmp
memory/1424-151-0x00000000006C0000-0x00000000006E2000-memory.dmp
memory/1424-152-0x00000000006F0000-0x0000000000720000-memory.dmp
memory/1572-139-0x0000000004A50000-0x0000000004A51000-memory.dmp
memory/1572-147-0x0000000004A10000-0x0000000004A11000-memory.dmp
memory/1572-134-0x0000000000210000-0x0000000000211000-memory.dmp
memory/1572-155-0x00000000049D0000-0x0000000004A46000-memory.dmp
memory/2736-185-0x00000000027A0000-0x0000000002800000-memory.dmp
memory/2772-115-0x00000000001E0000-0x00000000001E8000-memory.dmp
memory/2772-116-0x0000000002170000-0x0000000002179000-memory.dmp
memory/2972-129-0x0000000000540000-0x000000000068A000-memory.dmp
memory/2972-128-0x0000000000520000-0x0000000000528000-memory.dmp
memory/3020-119-0x0000000000520000-0x0000000000536000-memory.dmp
memory/3020-167-0x0000000002680000-0x0000000002696000-memory.dmp
memory/3096-117-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3108-153-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/3108-158-0x0000000005210000-0x0000000005211000-memory.dmp
memory/3108-165-0x0000000002720000-0x0000000002721000-memory.dmp
memory/3108-140-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3108-164-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/3108-163-0x0000000004D03000-0x0000000004D04000-memory.dmp
memory/3108-162-0x0000000004D02000-0x0000000004D03000-memory.dmp
memory/3108-161-0x0000000004B10000-0x0000000004B11000-memory.dmp
memory/3108-159-0x0000000002560000-0x0000000002561000-memory.dmp
memory/3108-166-0x0000000004D04000-0x0000000004D06000-memory.dmp
memory/3108-157-0x00000000022A0000-0x00000000022BB000-memory.dmp
memory/3108-156-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/3108-148-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3108-154-0x0000000002050000-0x000000000206C000-memory.dmp
memory/3308-150-0x0000000000400000-0x0000000000433000-memory.dmp
memory/3308-149-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/3308-144-0x00000000001D0000-0x00000000001D8000-memory.dmp