Analysis
- max time kernel
151s - max time network
142s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
15/11/2021, 08:02
General
- Target d67557b9c2e2eedfe6ac9531444ffdbd.exe
- Size 220KB
- Sample211115-jw468aeedk
- SHA256 e5ad94ed3a665a25dc7a9aeba84af60f52d134878bdfda700f48d915c819d626
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
185.159.80.90:38637
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- Downloads MZ/PE file
- Executes dropped EXE 12 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 4 IoCs
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 44 IoCs
- Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"C:\Users\Admin\AppData\Local\Temp\d67557b9c2e2eedfe6ac9531444ffdbd.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\DBF9.exeC:\Users\Admin\AppData\Local\Temp\DBF9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\DBF9.exeC:\Users\Admin\AppData\Local\Temp\DBF9.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\E07E.exeC:\Users\Admin\AppData\Local\Temp\E07E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E07E.exeC:\Users\Admin\AppData\Local\Temp\E07E.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\E07E.exeC:\Users\Admin\AppData\Local\Temp\E07E.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\E07E.exeC:\Users\Admin\AppData\Local\Temp\E07E.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\E1F6.exeC:\Users\Admin\AppData\Local\Temp\E1F6.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1004 -s 4882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\E478.exeC:\Users\Admin\AppData\Local\Temp\E478.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\E478.exeC:\Users\Admin\AppData\Local\Temp\E478.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\E8EE.exeC:\Users\Admin\AppData\Local\Temp\E8EE.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\F514.exeC:\Users\Admin\AppData\Local\Temp\F514.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3920 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\E98.exeC:\Users\Admin\AppData\Local\Temp\E98.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3524 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/596-166-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/596-160-0x0000000000400000-0x0000000000433000-memory.dmp
memory/596-169-0x0000000004924000-0x0000000004926000-memory.dmp
memory/596-159-0x00000000048F0000-0x000000000490B000-memory.dmp
memory/596-164-0x0000000004923000-0x0000000004924000-memory.dmp
memory/596-165-0x0000000004ED0000-0x0000000004ED1000-memory.dmp
memory/596-163-0x0000000004922000-0x0000000004923000-memory.dmp
memory/596-168-0x0000000005090000-0x0000000005091000-memory.dmp
memory/596-167-0x0000000005010000-0x0000000005011000-memory.dmp
memory/596-162-0x0000000004920000-0x0000000004921000-memory.dmp
memory/596-161-0x0000000005480000-0x0000000005481000-memory.dmp
memory/596-155-0x00000000021C0000-0x00000000021DC000-memory.dmp
memory/596-152-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1004-148-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1004-147-0x00000000004A0000-0x00000000004A9000-memory.dmp
memory/1004-145-0x0000000000490000-0x0000000000498000-memory.dmp
memory/1340-133-0x0000000000440000-0x00000000004EE000-memory.dmp
memory/1340-132-0x0000000000440000-0x00000000004EE000-memory.dmp
memory/1884-118-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2252-157-0x0000000000460000-0x00000000005AA000-memory.dmp
memory/2252-158-0x0000000001F90000-0x0000000001FC0000-memory.dmp
memory/2780-176-0x0000000002EC6000-0x0000000002F16000-memory.dmp
memory/2780-179-0x0000000000400000-0x0000000002B85000-memory.dmp
memory/2780-178-0x0000000002CE0000-0x0000000002E2A000-memory.dmp
memory/3028-174-0x00000000044B0000-0x00000000044C6000-memory.dmp
memory/3028-122-0x0000000000AD0000-0x0000000000AE6000-memory.dmp
memory/3040-120-0x0000000000620000-0x0000000000628000-memory.dmp
memory/3040-121-0x00000000006C0000-0x00000000006C9000-memory.dmp
memory/3420-191-0x0000000005100000-0x0000000005706000-memory.dmp
memory/3420-201-0x00000000071F0000-0x00000000071F1000-memory.dmp
memory/3420-200-0x0000000006AF0000-0x0000000006AF1000-memory.dmp
memory/3420-199-0x00000000056A0000-0x00000000056A1000-memory.dmp
memory/3420-196-0x0000000005590000-0x0000000005591000-memory.dmp
memory/3420-180-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3792-146-0x00000000050F0000-0x00000000050F1000-memory.dmp
memory/3792-137-0x0000000000050000-0x0000000000051000-memory.dmp
memory/3792-139-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/3792-144-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/3792-140-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/3920-175-0x0000000002630000-0x0000000002690000-memory.dmp