Analysis
- max time kernel
150s - max time network
144s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
15/11/2021, 12:22
General
- Target 01be7676723c959c917a38f88db27cae.exe
- Size 219KB
- Sample211115-pjw8qsfaan
- SHA256 ea25ebc8bab49ffe280e8432435842e26d001fad07534b586787e72efc6e2283
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
185.159.80.90:38637
Extracted
-
redline
-
SuperStar
-
185.215.113.29:36224
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 12 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 5 IoCs
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 3 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of WriteProcessMemory 56 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\01be7676723c959c917a38f88db27cae.exe"C:\Users\Admin\AppData\Local\Temp\01be7676723c959c917a38f88db27cae.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01be7676723c959c917a38f88db27cae.exe"C:\Users\Admin\AppData\Local\Temp\01be7676723c959c917a38f88db27cae.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\EB5B.exeC:\Users\Admin\AppData\Local\Temp\EB5B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EB5B.exeC:\Users\Admin\AppData\Local\Temp\EB5B.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\EFF0.exeC:\Users\Admin\AppData\Local\Temp\EFF0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\EFF0.exeC:\Users\Admin\AppData\Local\Temp\EFF0.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\F196.exeC:\Users\Admin\AppData\Local\Temp\F196.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\F502.exeC:\Users\Admin\AppData\Local\Temp\F502.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F502.exeC:\Users\Admin\AppData\Local\Temp\F502.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F8DC.exeC:\Users\Admin\AppData\Local\Temp\F8DC.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\909.exeC:\Users\Admin\AppData\Local\Temp\909.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2164 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\cswgirhC:\Users\Admin\AppData\Roaming\cswgirh1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\cswgirhC:\Users\Admin\AppData\Roaming\cswgirh2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\16E5.exeC:\Users\Admin\AppData\Local\Temp\16E5.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2064 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/612-194-0x0000000000440000-0x000000000058A000-memory.dmp
memory/612-195-0x0000000000440000-0x000000000058A000-memory.dmp
memory/740-185-0x0000000002EA6000-0x0000000002EF6000-memory.dmp
memory/740-189-0x0000000000400000-0x0000000002B85000-memory.dmp
memory/740-186-0x0000000004880000-0x000000000490F000-memory.dmp
memory/984-138-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/984-140-0x0000000005490000-0x0000000005491000-memory.dmp
memory/984-137-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/984-139-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/984-135-0x0000000000550000-0x0000000000551000-memory.dmp
memory/1724-145-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/1724-144-0x00000000001D0000-0x00000000001D8000-memory.dmp
memory/1724-146-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2164-184-0x0000000002620000-0x0000000002680000-memory.dmp
memory/2304-156-0x0000000005000000-0x0000000005001000-memory.dmp
memory/2304-160-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/2304-166-0x0000000004A70000-0x0000000004A71000-memory.dmp
memory/2304-167-0x0000000004AF4000-0x0000000004AF6000-memory.dmp
memory/2304-165-0x0000000004AF3000-0x0000000004AF4000-memory.dmp
memory/2304-164-0x0000000004AF2000-0x0000000004AF3000-memory.dmp
memory/2304-162-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2304-163-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/2304-158-0x0000000005610000-0x0000000005611000-memory.dmp
memory/2304-157-0x0000000002570000-0x0000000002571000-memory.dmp
memory/2304-155-0x00000000023E0000-0x00000000023FB000-memory.dmp
memory/2304-153-0x0000000002110000-0x000000000212C000-memory.dmp
memory/2304-150-0x0000000000400000-0x0000000000433000-memory.dmp
memory/2588-159-0x00000000004E0000-0x000000000062A000-memory.dmp
memory/2588-161-0x00000000004E0000-0x000000000062A000-memory.dmp
memory/2884-121-0x0000000002160000-0x0000000002169000-memory.dmp
memory/2884-120-0x0000000002150000-0x0000000002158000-memory.dmp
memory/2984-118-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3016-122-0x00000000014F0000-0x0000000001506000-memory.dmp
memory/3016-180-0x0000000003630000-0x0000000003646000-memory.dmp
memory/3016-203-0x0000000003580000-0x0000000003596000-memory.dmp
memory/3392-179-0x0000000004C00000-0x0000000005206000-memory.dmp
memory/3392-193-0x0000000005060000-0x0000000005061000-memory.dmp
memory/3392-168-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3392-201-0x0000000005C30000-0x0000000005C31000-memory.dmp
memory/3392-204-0x00000000068F0000-0x00000000068F1000-memory.dmp
memory/3392-205-0x0000000006FF0000-0x0000000006FF1000-memory.dmp