Analysis
- max time kernel
152s - max time network
128s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
16/11/2021, 15:47
General
- Target 33a3cc86c130bc762dd77ec72d829dd8.exe
- Size 326KB
- Sample211116-s792aabebp
- SHA256 e58ea2af775f4ae34d100e668d39e11e439579bfe1cd5e0031ebaf65d59c1aa1
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-file-host6.com/
-
http://host-host-file8.com/
Extracted
-
redline
-
185.159.80.90:38637
Extracted
-
raccoon
-
1.8.3-hotfix
-
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 9 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 3 IoCs
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 38 IoCs
- Suspicious use of WriteProcessMemory 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\33a3cc86c130bc762dd77ec72d829dd8.exe"C:\Users\Admin\AppData\Local\Temp\33a3cc86c130bc762dd77ec72d829dd8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\33a3cc86c130bc762dd77ec72d829dd8.exe"C:\Users\Admin\AppData\Local\Temp\33a3cc86c130bc762dd77ec72d829dd8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\2353.exeC:\Users\Admin\AppData\Local\Temp\2353.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\2353.exeC:\Users\Admin\AppData\Local\Temp\2353.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\399B.exeC:\Users\Admin\AppData\Local\Temp\399B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\399B.exeC:\Users\Admin\AppData\Local\Temp\399B.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\399B.exeC:\Users\Admin\AppData\Local\Temp\399B.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\4498.exeC:\Users\Admin\AppData\Local\Temp\4498.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1072 -s 4802⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\5D90.exeC:\Users\Admin\AppData\Local\Temp\5D90.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\7995.exeC:\Users\Admin\AppData\Local\Temp\7995.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3396 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\9EE1.exeC:\Users\Admin\AppData\Local\Temp\9EE1.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1348 -s 4002⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-147-0x00000000007B0000-0x00000000007C6000-memory.dmp
memory/396-122-0x00000000006D0000-0x00000000006E6000-memory.dmp
memory/740-121-0x0000000002410000-0x00000000024BE000-memory.dmp
memory/1072-145-0x0000000000440000-0x000000000058A000-memory.dmp
memory/1072-146-0x0000000000400000-0x0000000000433000-memory.dmp
memory/1072-144-0x0000000000440000-0x000000000058A000-memory.dmp
memory/2172-164-0x0000000001FF0000-0x000000000207F000-memory.dmp
memory/2172-163-0x0000000000510000-0x00000000005BE000-memory.dmp
memory/2172-165-0x0000000000400000-0x0000000000491000-memory.dmp
memory/3168-148-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3168-167-0x00000000051A0000-0x00000000051A1000-memory.dmp
memory/3168-154-0x0000000005250000-0x0000000005251000-memory.dmp
memory/3168-155-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/3168-156-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/3168-157-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/3168-158-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/3168-159-0x0000000004C40000-0x0000000005246000-memory.dmp
memory/3168-172-0x0000000006E80000-0x0000000006E81000-memory.dmp
memory/3168-171-0x0000000006780000-0x0000000006781000-memory.dmp
memory/3168-170-0x0000000005A20000-0x0000000005A21000-memory.dmp
memory/3208-133-0x0000000002500000-0x0000000002509000-memory.dmp
memory/3396-176-0x00000000025B0000-0x0000000002610000-memory.dmp
memory/3868-119-0x0000000000400000-0x0000000000409000-memory.dmp
memory/4312-134-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/4312-136-0x0000000004BF0000-0x0000000004BF1000-memory.dmp
memory/4312-137-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/4312-138-0x0000000005250000-0x0000000005251000-memory.dmp
memory/4312-139-0x0000000004D40000-0x0000000004D41000-memory.dmp