Analysis
- max time kernel
151s - max time network
144s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
16/11/2021, 04:31
General
- Target 8705c5d7e60a14a519f662913494d624.exe
- Size 219KB
- Sample211116-e5dneaccg2
- SHA256 a6c90b4cf3dac72a1cf401cd8995b5e8a7e11b38efb76ba1c06af7867683d76d
Malware Config
Extracted
-
smokeloader
-
2020
-
http://membro.at/upload/
-
http://jeevanpunetha.com/upload/
-
http://misipu.cn/upload/
-
http://zavodooo.ru/upload/
-
http://targiko.ru/upload/
-
http://vues3d.com/upload/
Extracted
-
raccoon
-
1.8.3-hotfix
-
4fc7b281a211dd243b4b1e5cb64d3f854a218b97
-
url4cnc
http://91.219.236.162/youyouhell0world
http://185.163.47.176/youyouhell0world
http://193.38.54.238/youyouhell0world
http://74.119.192.122/youyouhell0world
http://91.219.236.240/youyouhell0world
https://t.me/youyouhell0world
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8705c5d7e60a14a519f662913494d624.exe"C:\Users\Admin\AppData\Local\Temp\8705c5d7e60a14a519f662913494d624.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\53F8.exeC:\Users\Admin\AppData\Local\Temp\53F8.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Temp\F653.exeC:\Users\Admin\AppData\Local\Temp\F653.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/920-137-0x0000000004470000-0x00000000044FF000-memory.dmp
memory/920-138-0x0000000000400000-0x00000000027B5000-memory.dmp
memory/920-136-0x0000000002988000-0x00000000029D7000-memory.dmp
memory/2056-121-0x0000000001340000-0x0000000001356000-memory.dmp
memory/3504-131-0x0000000004359000-0x00000000043D9000-memory.dmp
memory/3504-132-0x0000000000400000-0x00000000027E6000-memory.dmp
memory/3520-119-0x0000000000680000-0x0000000000689000-memory.dmp
memory/3520-120-0x0000000000400000-0x0000000000440000-memory.dmp
memory/3520-118-0x0000000000490000-0x0000000000498000-memory.dmp
memory/4084-125-0x00000000042F1000-0x0000000004371000-memory.dmp
memory/4084-126-0x0000000004510000-0x00000000045A1000-memory.dmp
memory/4084-127-0x0000000000400000-0x00000000027E6000-memory.dmp