Analysis
- max time kernel
151s - max time network
131s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
16/11/2021, 06:27
General
- Target f52402eda80d1ee27ace606b85351e5c.exe
- Size 149KB
- Sample211116-g7rn6ahfbk
- SHA256 ca66ff7c6e083cb26d29df9aba7b00af2d7263a8bebf71bd89077914588eebdb
Malware Config
Extracted
-
smokeloader
-
2020
-
http://membro.at/upload/
-
http://jeevanpunetha.com/upload/
-
http://misipu.cn/upload/
-
http://zavodooo.ru/upload/
-
http://targiko.ru/upload/
-
http://vues3d.com/upload/
Extracted
-
raccoon
-
1.8.3-hotfix
-
4fc7b281a211dd243b4b1e5cb64d3f854a218b97
-
url4cnc
http://91.219.236.162/youyouhell0world
http://185.163.47.176/youyouhell0world
http://193.38.54.238/youyouhell0world
http://74.119.192.122/youyouhell0world
http://91.219.236.240/youyouhell0world
https://t.me/youyouhell0world
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f52402eda80d1ee27ace606b85351e5c.exe"C:\Users\Admin\AppData\Local\Temp\f52402eda80d1ee27ace606b85351e5c.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\218E.exeC:\Users\Admin\AppData\Local\Temp\218E.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Temp\AEEA.exeC:\Users\Admin\AppData\Local\Temp\AEEA.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1464-137-0x0000000004320000-0x00000000043AF000-memory.dmp
memory/1464-138-0x0000000000400000-0x00000000027B8000-memory.dmp
memory/1464-136-0x0000000002998000-0x00000000029E7000-memory.dmp
memory/1912-120-0x0000000000400000-0x0000000000430000-memory.dmp
memory/1912-119-0x0000000000520000-0x0000000000529000-memory.dmp
memory/1912-118-0x0000000000510000-0x0000000000518000-memory.dmp
memory/2392-132-0x0000000000400000-0x00000000027E9000-memory.dmp
memory/2392-131-0x0000000002AC9000-0x0000000002B49000-memory.dmp
memory/3028-121-0x0000000000AD0000-0x0000000000AE6000-memory.dmp
memory/3620-130-0x0000000000400000-0x00000000027E9000-memory.dmp
memory/3620-126-0x00000000044E0000-0x0000000004571000-memory.dmp
memory/3620-125-0x00000000029D8000-0x0000000002A58000-memory.dmp