Analysis
- max time kernel
150s - max time network
144s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
15/11/2021, 08:02
General
- Target d67557b9c2e2eedfe6ac9531444ffdbd.exe
- Size 220KB
- Sample211115-jw468aeedk
- SHA256 e5ad94ed3a665a25dc7a9aeba84af60f52d134878bdfda700f48d915c819d626
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
185.159.80.90:38637
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 7 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 10 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 61 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\4F96.exeC:\Users\Admin\AppData\Local\Temp\4F96.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4F96.exeC:\Users\Admin\AppData\Local\Temp\4F96.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\55DE.exeC:\Users\Admin\AppData\Local\Temp\55DE.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\55DE.exeC:\Users\Admin\AppData\Local\Temp\55DE.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\58CC.exeC:\Users\Admin\AppData\Local\Temp\58CC.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5C94.exeC:\Users\Admin\AppData\Local\Temp\5C94.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5C94.exeC:\Users\Admin\AppData\Local\Temp\5C94.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\6137.exeC:\Users\Admin\AppData\Local\Temp\6137.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\715E.exeC:\Users\Admin\AppData\Local\Temp\715E.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8607.exeC:\Users\Admin\AppData\Local\Temp\8607.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/652-74-0x0000000000220000-0x0000000000228000-memory.dmp
memory/796-57-0x0000000075321000-0x0000000075323000-memory.dmp
memory/796-55-0x0000000000400000-0x0000000000409000-memory.dmp
memory/804-58-0x0000000000220000-0x0000000000228000-memory.dmp
memory/804-59-0x0000000000230000-0x0000000000239000-memory.dmp
memory/916-81-0x00000000001B0000-0x00000000001B8000-memory.dmp
memory/916-84-0x00000000001C0000-0x00000000001C9000-memory.dmp
memory/916-83-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1008-114-0x0000000000D00000-0x0000000000D60000-memory.dmp
memory/1012-92-0x0000000000280000-0x00000000002B0000-memory.dmp
memory/1012-90-0x0000000000220000-0x0000000000242000-memory.dmp
memory/1060-72-0x0000000000970000-0x0000000000971000-memory.dmp
memory/1060-80-0x0000000000730000-0x0000000000731000-memory.dmp
memory/1400-60-0x0000000002560000-0x0000000002576000-memory.dmp
memory/1400-105-0x0000000004380000-0x0000000004396000-memory.dmp
memory/1672-106-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1672-100-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1672-111-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/1672-102-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1672-109-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1672-104-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1672-99-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1712-96-0x0000000001D00000-0x0000000001D1B000-memory.dmp
memory/1712-97-0x0000000004731000-0x0000000004732000-memory.dmp
memory/1712-103-0x0000000004734000-0x0000000004736000-memory.dmp
memory/1712-98-0x0000000004732000-0x0000000004733000-memory.dmp
memory/1712-101-0x0000000004733000-0x0000000004734000-memory.dmp
memory/1712-95-0x0000000001CE0000-0x0000000001CFC000-memory.dmp
memory/1712-94-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1712-89-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1964-115-0x0000000002D1B000-0x0000000002D6A000-memory.dmp
memory/1964-117-0x0000000002B90000-0x0000000002C1F000-memory.dmp
memory/1964-118-0x0000000000400000-0x0000000002B85000-memory.dmp