Analysis
- max time kernel
151s - max time network
140s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
16/11/2021, 03:56
General
- Target 6177d85be52132376166b865ebca55b1.exe
- Size 164KB
- Sample211116-ehc4csccb5
- SHA256 f6c10cababdca8d6de20f8977489182b31ce24bb2ac9399965d32cedf0f526fe
Malware Config
Extracted
-
smokeloader
-
2020
-
http://membro.at/upload/
-
http://jeevanpunetha.com/upload/
-
http://misipu.cn/upload/
-
http://zavodooo.ru/upload/
-
http://targiko.ru/upload/
-
http://vues3d.com/upload/
Extracted
-
raccoon
-
1.8.3-hotfix
-
4fc7b281a211dd243b4b1e5cb64d3f854a218b97
-
url4cnc
http://91.219.236.162/youyouhell0world
http://185.163.47.176/youyouhell0world
http://193.38.54.238/youyouhell0world
http://74.119.192.122/youyouhell0world
http://91.219.236.240/youyouhell0world
https://t.me/youyouhell0world
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6177d85be52132376166b865ebca55b1.exe"C:\Users\Admin\AppData\Local\Temp\6177d85be52132376166b865ebca55b1.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1038.exeC:\Users\Admin\AppData\Local\Temp\1038.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Temp\565A.exeC:\Users\Admin\AppData\Local\Temp\565A.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1252-138-0x0000000000400000-0x00000000027B5000-memory.dmp
memory/1252-137-0x00000000043E0000-0x000000000446F000-memory.dmp
memory/1976-118-0x00000000001E0000-0x00000000001E8000-memory.dmp
memory/1976-119-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/1976-120-0x0000000000400000-0x0000000000430000-memory.dmp
memory/2036-121-0x0000000000DE0000-0x0000000000DF6000-memory.dmp
memory/3080-125-0x0000000002889000-0x0000000002909000-memory.dmp
memory/3080-126-0x0000000004430000-0x00000000044C1000-memory.dmp
memory/3080-127-0x0000000000400000-0x00000000027E6000-memory.dmp
memory/3204-132-0x0000000000400000-0x00000000027E6000-memory.dmp
memory/3204-131-0x0000000002B59000-0x0000000002BD9000-memory.dmp