Analysis
- max time kernel
162s - max time network
157s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
30/11/2021, 18:06
General
- Target 678cc6db09623eee7d46215ee2cef226cf8a40c001821e72d44a196f04e21b86.exe
- Size 159KB
- Sample211130-wpvqesffgl
- SHA256 678cc6db09623eee7d46215ee2cef226cf8a40c001821e72d44a196f04e21b86
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
-
http://srtuiyhuali.at/
-
http://fufuiloirtu.com/
-
http://amogohuigotuli.at/
-
http://novohudosovu.com/
-
http://brutuilionust.com/
-
http://bubushkalioua.com/
-
http://dumuilistrati.at/
-
http://verboliatsiaeeees.com/
Extracted
-
arkei
-
Default
-
http://file-file-host4.com/tratata.php
Extracted
-
redline
-
92.255.76.197:38637
Extracted
-
amadey
-
2.85
-
185.215.113.35/d2VxjasuwS/index.php
Extracted
-
icedid
-
2904573523
-
placingapie.ink
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Arkei
Arkei is an infostealer written in C++.
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- suricata: ET MALWARE Win32/IcedID Request Cookie
suricata: ET MALWARE Win32/IcedID Request Cookie
- suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
- Arkei Stealer Payload 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 15 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 6 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 58 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\678cc6db09623eee7d46215ee2cef226cf8a40c001821e72d44a196f04e21b86.exe"C:\Users\Admin\AppData\Local\Temp\678cc6db09623eee7d46215ee2cef226cf8a40c001821e72d44a196f04e21b86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\678cc6db09623eee7d46215ee2cef226cf8a40c001821e72d44a196f04e21b86.exe"C:\Users\Admin\AppData\Local\Temp\678cc6db09623eee7d46215ee2cef226cf8a40c001821e72d44a196f04e21b86.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\6703.exeC:\Users\Admin\AppData\Local\Temp\6703.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6703.exeC:\Users\Admin\AppData\Local\Temp\6703.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6ED4.exeC:\Users\Admin\AppData\Local\Temp\6ED4.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7240.exeC:\Users\Admin\AppData\Local\Temp\7240.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7240.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\787B.exeC:\Users\Admin\AppData\Local\Temp\787B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\787B.exeC:\Users\Admin\AppData\Local\Temp\787B.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\8973.exeC:\Users\Admin\AppData\Local\Temp\8973.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\8FAE.dll1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\982B.exeC:\Users\Admin\AppData\Local\Temp\982B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\982B.exeC:\Users\Admin\AppData\Local\Temp\982B.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\982B.exeC:\Users\Admin\AppData\Local\Temp\982B.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\6⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\1972.exeC:\Users\Admin\AppData\Local\Temp\1972.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\xOQIQhTK & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1972.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-159-0x00000000010E0000-0x00000000017C2000-memory.dmp
memory/732-163-0x0000000077600000-0x000000007778E000-memory.dmp
memory/732-162-0x00000000010E0000-0x00000000017C2000-memory.dmp
memory/732-161-0x00000000010E0000-0x00000000017C2000-memory.dmp
memory/732-158-0x00000000010E0000-0x00000000017C2000-memory.dmp
memory/908-181-0x0000000005480000-0x0000000005481000-memory.dmp
memory/908-176-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/908-184-0x0000000005CE0000-0x0000000005CE1000-memory.dmp
memory/908-174-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/908-178-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/908-167-0x00000000005C0000-0x00000000005C1000-memory.dmp
memory/908-177-0x0000000001140000-0x0000000001141000-memory.dmp
memory/1204-228-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1288-142-0x0000000000400000-0x0000000002B6E000-memory.dmp
memory/1288-138-0x0000000004660000-0x0000000004681000-memory.dmp
memory/1288-137-0x0000000004640000-0x0000000004653000-memory.dmp
memory/1484-193-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1484-190-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1676-118-0x0000000000400000-0x0000000000409000-memory.dmp
memory/1748-238-0x00000000002D0000-0x0000000000A12000-memory.dmp
memory/1748-237-0x00000000002D0000-0x0000000000A12000-memory.dmp
memory/1748-236-0x00000000002D0000-0x0000000000A12000-memory.dmp
memory/1748-240-0x0000000077600000-0x000000007778E000-memory.dmp
memory/1748-239-0x00000000002D0000-0x0000000000A12000-memory.dmp
memory/1892-257-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/1892-254-0x0000000005000000-0x0000000005001000-memory.dmp
memory/1892-256-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/1960-245-0x00000000030B0000-0x0000000003124000-memory.dmp
memory/1960-246-0x0000000003040000-0x00000000030AB000-memory.dmp
memory/2124-134-0x0000000002BC0000-0x0000000002BC9000-memory.dmp
memory/2124-135-0x0000000002BE0000-0x0000000002C8E000-memory.dmp
memory/2124-136-0x0000000000400000-0x0000000002B64000-memory.dmp
memory/2308-143-0x0000000004A00000-0x0000000004A01000-memory.dmp
memory/2308-149-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/2308-150-0x0000000004C20000-0x0000000004C21000-memory.dmp
memory/2308-155-0x0000000005130000-0x0000000005131000-memory.dmp
memory/2308-132-0x00000000001F0000-0x00000000001F1000-memory.dmp
memory/2568-122-0x0000000001130000-0x0000000001146000-memory.dmp
memory/2568-154-0x0000000003250000-0x0000000003266000-memory.dmp
memory/2724-179-0x0000000003020000-0x0000000003021000-memory.dmp
memory/2724-169-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2724-175-0x0000000005BC0000-0x0000000005BC1000-memory.dmp
memory/2724-180-0x00000000056C0000-0x00000000056C1000-memory.dmp
memory/2724-182-0x00000000055F0000-0x00000000055F1000-memory.dmp
memory/2724-183-0x00000000055B0000-0x0000000005BB6000-memory.dmp
memory/2724-186-0x0000000005630000-0x0000000005631000-memory.dmp
memory/2724-210-0x0000000007160000-0x0000000007161000-memory.dmp
memory/2724-203-0x0000000005910000-0x0000000005911000-memory.dmp
memory/3188-148-0x0000000002DB0000-0x0000000002DB9000-memory.dmp
memory/3188-147-0x0000000002C60000-0x0000000002DAA000-memory.dmp
memory/3668-222-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/3668-217-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/3668-223-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/3868-248-0x00000000006A0000-0x00000000006A7000-memory.dmp
memory/3868-249-0x0000000000690000-0x000000000069C000-memory.dmp
memory/3944-120-0x0000000002C00000-0x0000000002CAE000-memory.dmp
memory/3944-121-0x0000000002C00000-0x0000000002CAE000-memory.dmp
memory/3948-264-0x0000000000400000-0x000000000043D000-memory.dmp
memory/4000-242-0x0000000001010000-0x0000000001073000-memory.dmp