Analysis
-
max time kernel
152s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
18-11-2021 09:25
Static task
static1
Behavioral task
behavioral1
Sample
743f8fec87ebf7c5d6b392261ec3988f.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
743f8fec87ebf7c5d6b392261ec3988f.exe
Resource
win10-en-20211014
General
-
Target
743f8fec87ebf7c5d6b392261ec3988f.exe
-
Size
334KB
-
MD5
743f8fec87ebf7c5d6b392261ec3988f
-
SHA1
1bc862eecde55f2c1de69bc9e3fdd7468de373d0
-
SHA256
c9f18cc71c7a1fa61d43a32dfb858f9aa247324a188f8182981b853266d3b1c7
-
SHA512
59156212c7c800920da3a3f22191799ac4632dda5a3128b4f7bb8a2856a924dedf16c470766ac37ef431df7cc76cc98df4bb1af180c70584caf71cdd28819413
Malware Config
Extracted
smokeloader
2020
http://host-file-host6.com/
http://host-host-file8.com/
Extracted
redline
185.159.80.90:38637
Extracted
raccoon
1.8.3-hotfix
ddf183af4241e3172885cf1b2c4c1fb4ee03d05a
-
url4cnc
http://91.219.236.27/capibar
http://5.181.156.92/capibar
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2368-141-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/2368-142-0x0000000000418EEA-mapping.dmp family_redline behavioral2/memory/2368-162-0x0000000004F60000-0x0000000005566000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
.NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/2368-162-0x0000000004F60000-0x0000000005566000-memory.dmp net_reactor -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
4254.exe4785.exe4EF9.exe4254.exe5BCB.exe4785.exepid process 3172 4254.exe 3948 4785.exe 3320 4EF9.exe 1060 4254.exe 1964 5BCB.exe 2368 4785.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
5BCB.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 5BCB.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5BCB.exe -
Deletes itself 1 IoCs
Processes:
pid process 3064 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\5BCB.exe themida behavioral2/memory/1964-150-0x0000000000A20000-0x0000000000A21000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
5BCB.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5BCB.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
5BCB.exepid process 1964 5BCB.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
743f8fec87ebf7c5d6b392261ec3988f.exe4254.exe4785.exedescription pid process target process PID 3136 set thread context of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3172 set thread context of 1060 3172 4254.exe 4254.exe PID 3948 set thread context of 2368 3948 4785.exe 4785.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
743f8fec87ebf7c5d6b392261ec3988f.exe4254.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 743f8fec87ebf7c5d6b392261ec3988f.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 743f8fec87ebf7c5d6b392261ec3988f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4254.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4254.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4254.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 743f8fec87ebf7c5d6b392261ec3988f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
743f8fec87ebf7c5d6b392261ec3988f.exepid process 664 743f8fec87ebf7c5d6b392261ec3988f.exe 664 743f8fec87ebf7c5d6b392261ec3988f.exe 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 3064 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3064 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
743f8fec87ebf7c5d6b392261ec3988f.exe4254.exepid process 664 743f8fec87ebf7c5d6b392261ec3988f.exe 1060 4254.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
5BCB.exe4785.exedescription pid process Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeDebugPrivilege 1964 5BCB.exe Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeDebugPrivilege 2368 4785.exe Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 Token: SeShutdownPrivilege 3064 Token: SeCreatePagefilePrivilege 3064 -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
743f8fec87ebf7c5d6b392261ec3988f.exe4785.exe4254.exedescription pid process target process PID 3136 wrote to memory of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3136 wrote to memory of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3136 wrote to memory of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3136 wrote to memory of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3136 wrote to memory of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3136 wrote to memory of 664 3136 743f8fec87ebf7c5d6b392261ec3988f.exe 743f8fec87ebf7c5d6b392261ec3988f.exe PID 3064 wrote to memory of 3172 3064 4254.exe PID 3064 wrote to memory of 3172 3064 4254.exe PID 3064 wrote to memory of 3172 3064 4254.exe PID 3064 wrote to memory of 3948 3064 4785.exe PID 3064 wrote to memory of 3948 3064 4785.exe PID 3064 wrote to memory of 3948 3064 4785.exe PID 3064 wrote to memory of 3320 3064 4EF9.exe PID 3064 wrote to memory of 3320 3064 4EF9.exe PID 3064 wrote to memory of 3320 3064 4EF9.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3172 wrote to memory of 1060 3172 4254.exe 4254.exe PID 3172 wrote to memory of 1060 3172 4254.exe 4254.exe PID 3172 wrote to memory of 1060 3172 4254.exe 4254.exe PID 3172 wrote to memory of 1060 3172 4254.exe 4254.exe PID 3172 wrote to memory of 1060 3172 4254.exe 4254.exe PID 3172 wrote to memory of 1060 3172 4254.exe 4254.exe PID 3064 wrote to memory of 1964 3064 5BCB.exe PID 3064 wrote to memory of 1964 3064 5BCB.exe PID 3064 wrote to memory of 1964 3064 5BCB.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe PID 3948 wrote to memory of 2368 3948 4785.exe 4785.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\743f8fec87ebf7c5d6b392261ec3988f.exe"C:\Users\Admin\AppData\Local\Temp\743f8fec87ebf7c5d6b392261ec3988f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\743f8fec87ebf7c5d6b392261ec3988f.exe"C:\Users\Admin\AppData\Local\Temp\743f8fec87ebf7c5d6b392261ec3988f.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4254.exeC:\Users\Admin\AppData\Local\Temp\4254.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4254.exeC:\Users\Admin\AppData\Local\Temp\4254.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4785.exeC:\Users\Admin\AppData\Local\Temp\4785.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4785.exeC:\Users\Admin\AppData\Local\Temp\4785.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\4EF9.exeC:\Users\Admin\AppData\Local\Temp\4EF9.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\5BCB.exeC:\Users\Admin\AppData\Local\Temp\5BCB.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\4785.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Temp\4254.exeMD5
8ef1ae58e545946baca2dbc17e135577
SHA15c885447330a3bfd39a1432e876f5315227dc63a
SHA2560c4f067db78d493cf8966b08555ff8a50e920fe4737786cea5be5348d9785c3c
SHA51235ca7cfedbd9cd70913a57ca1e1b2be976e8fb067471805b70867b232a8b89772d773eafb0fe49aa7bcc14e6a49d85918657ee3ebf2785d15f5e18b5d660eee2
-
C:\Users\Admin\AppData\Local\Temp\4254.exeMD5
8ef1ae58e545946baca2dbc17e135577
SHA15c885447330a3bfd39a1432e876f5315227dc63a
SHA2560c4f067db78d493cf8966b08555ff8a50e920fe4737786cea5be5348d9785c3c
SHA51235ca7cfedbd9cd70913a57ca1e1b2be976e8fb067471805b70867b232a8b89772d773eafb0fe49aa7bcc14e6a49d85918657ee3ebf2785d15f5e18b5d660eee2
-
C:\Users\Admin\AppData\Local\Temp\4254.exeMD5
8ef1ae58e545946baca2dbc17e135577
SHA15c885447330a3bfd39a1432e876f5315227dc63a
SHA2560c4f067db78d493cf8966b08555ff8a50e920fe4737786cea5be5348d9785c3c
SHA51235ca7cfedbd9cd70913a57ca1e1b2be976e8fb067471805b70867b232a8b89772d773eafb0fe49aa7bcc14e6a49d85918657ee3ebf2785d15f5e18b5d660eee2
-
C:\Users\Admin\AppData\Local\Temp\4785.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\4785.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\4785.exeMD5
5e34695c9f46f1e69ce731d3b7359c88
SHA1e1e5bb43f0c7556bcccc8cb698f854694bdc024a
SHA25697f96815d81f9c1c8ede31f1c21fda2bee7cbab3490184ef833d9d2e8c17e6fc
SHA512659fa0b695942c35dd4ef499d6c01d9b2a8c23254ea31465a126fd71a0d542ee71da9349ffc8226083393ed37c0668f63c97cc7ef3e014eae793b1f1ba7d6b43
-
C:\Users\Admin\AppData\Local\Temp\4EF9.exeMD5
9733aef1c8ec194a3198ab8e0130b7d4
SHA1cf886d1cbabe2c572edd001c0fa55a13d3e191bd
SHA256fa30571b12211c46fc47639a9d4df6fdeacc8ea6ecffd0a3022f82ffe43d50b1
SHA51249a343a6fc4e4d75f1177ca8d7f65682f853b956a46bb65fa6b22c2a8d5121fd949cfbbb22c44e7fb5631350f97c10ca726260544bcc0b8a706085f9f9f7ff77
-
C:\Users\Admin\AppData\Local\Temp\4EF9.exeMD5
9733aef1c8ec194a3198ab8e0130b7d4
SHA1cf886d1cbabe2c572edd001c0fa55a13d3e191bd
SHA256fa30571b12211c46fc47639a9d4df6fdeacc8ea6ecffd0a3022f82ffe43d50b1
SHA51249a343a6fc4e4d75f1177ca8d7f65682f853b956a46bb65fa6b22c2a8d5121fd949cfbbb22c44e7fb5631350f97c10ca726260544bcc0b8a706085f9f9f7ff77
-
C:\Users\Admin\AppData\Local\Temp\5BCB.exeMD5
a77f1ed5881d44fc95bf3da05c349385
SHA17a80066b7f8b335ccc1a85d9847a29251f2875ca
SHA25658be03e1a79fedf4f6181c0ce9d819f85cb656b00831c55673e15433183d0206
SHA512308a8bfbc3396c53ab3d38d55238c692eaaf42bfb1fa074cf432f6c980ab790144697a726d7e8b60db82e60a600a280879fb5d833e4dd8eb6eef8198aa368641
-
memory/664-118-0x0000000000402DD8-mapping.dmp
-
memory/664-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1060-137-0x0000000000402DD8-mapping.dmp
-
memory/1964-161-0x0000000003160000-0x0000000003161000-memory.dmpFilesize
4KB
-
memory/1964-139-0x0000000000000000-mapping.dmp
-
memory/1964-180-0x0000000007540000-0x0000000007541000-memory.dmpFilesize
4KB
-
memory/1964-179-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/1964-178-0x0000000006FE0000-0x0000000006FE1000-memory.dmpFilesize
4KB
-
memory/1964-174-0x00000000064E0000-0x00000000064E1000-memory.dmpFilesize
4KB
-
memory/1964-168-0x0000000005810000-0x0000000005811000-memory.dmpFilesize
4KB
-
memory/1964-164-0x0000000005510000-0x0000000005511000-memory.dmpFilesize
4KB
-
memory/1964-160-0x00000000778B0000-0x0000000077A3E000-memory.dmpFilesize
1.6MB
-
memory/1964-150-0x0000000000A20000-0x0000000000A21000-memory.dmpFilesize
4KB
-
memory/2368-162-0x0000000004F60000-0x0000000005566000-memory.dmpFilesize
6.0MB
-
memory/2368-142-0x0000000000418EEA-mapping.dmp
-
memory/2368-147-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/2368-141-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2368-152-0x00000000029F0000-0x00000000029F1000-memory.dmpFilesize
4KB
-
memory/2368-154-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/2368-158-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/3064-167-0x0000000004200000-0x0000000004216000-memory.dmpFilesize
88KB
-
memory/3064-119-0x0000000000850000-0x0000000000866000-memory.dmpFilesize
88KB
-
memory/3136-116-0x0000000002140000-0x0000000002149000-memory.dmpFilesize
36KB
-
memory/3136-115-0x00000000022D9000-0x00000000022E9000-memory.dmpFilesize
64KB
-
memory/3172-120-0x0000000000000000-mapping.dmp
-
memory/3172-135-0x0000000002128000-0x0000000002139000-memory.dmpFilesize
68KB
-
memory/3320-130-0x0000000000000000-mapping.dmp
-
memory/3320-163-0x00000000024E0000-0x000000000262A000-memory.dmpFilesize
1.3MB
-
memory/3320-166-0x0000000000400000-0x00000000023E7000-memory.dmpFilesize
31.9MB
-
memory/3948-126-0x0000000000890000-0x0000000000891000-memory.dmpFilesize
4KB
-
memory/3948-123-0x0000000000000000-mapping.dmp
-
memory/3948-134-0x0000000002B40000-0x0000000002B41000-memory.dmpFilesize
4KB
-
memory/3948-133-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/3948-128-0x0000000005160000-0x0000000005161000-memory.dmpFilesize
4KB
-
memory/3948-129-0x0000000002B10000-0x0000000002B11000-memory.dmpFilesize
4KB