Analysis
- max time kernel
151s - max time network
154s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
01/12/2021, 09:26
General
- Target a01cd71777793775949d174733418b59.exe
- Size 329KB
- Sample211201-ld7kqsbbfq
- SHA256 68c8752d947c83bbbf1291676e0c0e192843b92c8abc17ed2722cf1cdb0175fe
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
-
http://srtuiyhuali.at/
-
http://fufuiloirtu.com/
-
http://amogohuigotuli.at/
-
http://novohudosovu.com/
-
http://brutuilionust.com/
-
http://bubushkalioua.com/
-
http://dumuilistrati.at/
-
http://verboliatsiaeeees.com/
Extracted
-
arkei
-
Default
-
http://file-file-host4.com/tratata.php
Extracted
-
redline
-
92.255.76.197:38637
Extracted
-
amadey
-
2.85
-
185.215.113.35/d2VxjasuwS/index.php
Extracted
-
icedid
-
2904573523
-
placingapie.ink
Extracted
-
raccoon
-
1.8.3-hotfix
-
2b57df1b9672fee319e2dc39c0f6a5bc1eef79f4
-
url4cnc
http://91.219.236.207/forestbump12
http://185.225.19.18/forestbump12
http://91.219.237.227/forestbump12
https://t.me/forestbump12
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Arkei
Arkei is an infostealer written in C++.
- CryptBot
A C++ stealer distributed widely in bundle with other software.
- IcedID, BokBot
IcedID is a banking trojan capable of stealing credentials.
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- suricata: ET MALWARE Amadey CnC Check-In
suricata: ET MALWARE Amadey CnC Check-In
- suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
- Arkei Stealer Payload 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 20 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 12 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 8 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 2 IoCs
- Runs ping.exe 1 TTPs 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a01cd71777793775949d174733418b59.exe"C:\Users\Admin\AppData\Local\Temp\a01cd71777793775949d174733418b59.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a01cd71777793775949d174733418b59.exe"C:\Users\Admin\AppData\Local\Temp\a01cd71777793775949d174733418b59.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\B56.exeC:\Users\Admin\AppData\Local\Temp\B56.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\B56.exeC:\Users\Admin\AppData\Local\Temp\B56.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F3F.exeC:\Users\Admin\AppData\Local\Temp\F3F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F3F.exeC:\Users\Admin\AppData\Local\Temp\F3F.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F3F.exeC:\Users\Admin\AppData\Local\Temp\F3F.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\F3F.exeC:\Users\Admin\AppData\Local\Temp\F3F.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\15D8.exeC:\Users\Admin\AppData\Local\Temp\15D8.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1CFD.exeC:\Users\Admin\AppData\Local\Temp\1CFD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1CFD.exe" & exit2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\28F4.exeC:\Users\Admin\AppData\Local\Temp\28F4.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\35C7.dll1⤵
- Loads dropped DLL
-
C:\Users\Admin\AppData\Local\Temp\3C11.exeC:\Users\Admin\AppData\Local\Temp\3C11.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3C11.exeC:\Users\Admin\AppData\Local\Temp\3C11.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:N"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /P "Admin:R" /E4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"3⤵
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:N"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\6829558ede" /P "Admin:R" /E4⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe4⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\5⤵
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\6829558ede\6⤵
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe" /F5⤵
- Creates scheduled task(s)
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\886D.exeC:\Users\Admin\AppData\Local\Temp\886D.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c rd /s /q C:\Users\Admin\AppData\Local\Temp\ooLDHYFDdX & timeout 4 & del /f /q "C:\Users\Admin\AppData\Local\Temp\886D.exe"2⤵
-
C:\Windows\SysWOW64\timeout.exetimeout 43⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\94F1.exeC:\Users\Admin\AppData\Local\Temp\94F1.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" bing.com3⤵
- Runs ping.exe
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" ping bing.com2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\PING.EXE"C:\Windows\system32\PING.EXE" bing.com3⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\94F1.exeC:\Users\Admin\AppData\Local\Temp\94F1.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1848 -s 14883⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exeC:\Users\Admin\AppData\Local\Temp\6829558ede\tkools.exe2⤵
- Executes dropped EXE
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/400-320-0x0000000000400000-0x000000000043D000-memory.dmp
memory/528-119-0x0000000000400000-0x0000000000409000-memory.dmp
memory/608-154-0x0000000000060000-0x0000000000742000-memory.dmp
memory/608-152-0x0000000077250000-0x00000000773DE000-memory.dmp
memory/608-153-0x0000000000060000-0x0000000000742000-memory.dmp
memory/608-156-0x0000000000060000-0x0000000000742000-memory.dmp
memory/608-157-0x0000000000060000-0x0000000000742000-memory.dmp
memory/712-329-0x00000000032F0000-0x00000000032F1000-memory.dmp
memory/712-328-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/716-163-0x00000000001C0000-0x00000000001E1000-memory.dmp
memory/716-164-0x0000000000400000-0x00000000004D7000-memory.dmp
memory/960-287-0x0000000000980000-0x00000000009E3000-memory.dmp
memory/1320-218-0x0000000004B60000-0x0000000004B61000-memory.dmp
memory/1320-219-0x00000000049B0000-0x00000000049B1000-memory.dmp
memory/1428-276-0x0000000003170000-0x0000000003171000-memory.dmp
memory/1428-290-0x0000000006ED2000-0x0000000006ED3000-memory.dmp
memory/1428-289-0x0000000006ED0000-0x0000000006ED1000-memory.dmp
memory/1428-296-0x0000000006ED3000-0x0000000006ED4000-memory.dmp
memory/1428-297-0x0000000006ED4000-0x0000000006ED6000-memory.dmp
memory/1428-275-0x0000000003170000-0x0000000003171000-memory.dmp
memory/1796-314-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/1796-315-0x00000000049A0000-0x00000000049A1000-memory.dmp
memory/1808-229-0x0000000000400000-0x000000000043D000-memory.dmp
memory/1848-305-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1912-138-0x0000000002C50000-0x0000000002C59000-memory.dmp
memory/1912-139-0x0000000002C70000-0x0000000002DBA000-memory.dmp
memory/1912-140-0x0000000000400000-0x0000000002B64000-memory.dmp
memory/1920-235-0x0000000001350000-0x0000000001A92000-memory.dmp
memory/1920-239-0x0000000077250000-0x00000000773DE000-memory.dmp
memory/1920-238-0x0000000001350000-0x0000000001A92000-memory.dmp
memory/1920-237-0x0000000001350000-0x0000000001A92000-memory.dmp
memory/1920-236-0x0000000001350000-0x0000000001A92000-memory.dmp
memory/2056-184-0x0000000005800000-0x0000000005801000-memory.dmp
memory/2056-182-0x00000000060B0000-0x00000000060B1000-memory.dmp
memory/2056-185-0x0000000005790000-0x0000000005791000-memory.dmp
memory/2056-181-0x0000000005810000-0x0000000005811000-memory.dmp
memory/2056-186-0x00000000065E0000-0x00000000065E1000-memory.dmp
memory/2056-179-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/2056-183-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/2176-194-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2176-187-0x0000000000400000-0x000000000043D000-memory.dmp
memory/2180-257-0x0000000000400000-0x0000000000474000-memory.dmp
memory/2180-258-0x0000000000160000-0x00000000001CB000-memory.dmp
memory/2400-284-0x0000000006D83000-0x0000000006D84000-memory.dmp
memory/2400-265-0x0000000007C40000-0x0000000007C41000-memory.dmp
memory/2400-254-0x0000000006C60000-0x0000000006C61000-memory.dmp
memory/2400-255-0x00000000073C0000-0x00000000073C1000-memory.dmp
memory/2400-252-0x00000000047E0000-0x00000000047E1000-memory.dmp
memory/2400-253-0x00000000047E0000-0x00000000047E1000-memory.dmp
memory/2400-259-0x0000000006D80000-0x0000000006D81000-memory.dmp
memory/2400-260-0x0000000006D82000-0x0000000006D83000-memory.dmp
memory/2400-261-0x0000000007380000-0x0000000007381000-memory.dmp
memory/2400-262-0x0000000007CB0000-0x0000000007CB1000-memory.dmp
memory/2400-264-0x0000000007D20000-0x0000000007D21000-memory.dmp
memory/2400-285-0x0000000006D84000-0x0000000006D86000-memory.dmp
memory/2400-272-0x00000000047E0000-0x00000000047E1000-memory.dmp
memory/2416-304-0x00000000012F3000-0x00000000012F5000-memory.dmp
memory/2416-249-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/2416-245-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/2416-256-0x00000000012F0000-0x00000000012F1000-memory.dmp
memory/2564-121-0x0000000000030000-0x0000000000039000-memory.dmp
memory/2756-270-0x00000000008B0000-0x00000000008BC000-memory.dmp
memory/2756-269-0x00000000008C0000-0x00000000008C7000-memory.dmp
memory/3024-122-0x0000000001340000-0x0000000001356000-memory.dmp
memory/3024-158-0x0000000003470000-0x0000000003486000-memory.dmp
memory/3192-170-0x0000000005270000-0x0000000005271000-memory.dmp
memory/3192-172-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3192-173-0x0000000004D20000-0x0000000004D21000-memory.dmp
memory/3192-174-0x0000000004CC0000-0x0000000004CC1000-memory.dmp
memory/3192-175-0x0000000004C60000-0x0000000005266000-memory.dmp
memory/3192-171-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/3192-205-0x0000000006750000-0x0000000006751000-memory.dmp
memory/3192-165-0x0000000000400000-0x0000000000420000-memory.dmp
memory/3192-200-0x0000000005C50000-0x0000000005C51000-memory.dmp
memory/3640-135-0x00000000031B0000-0x0000000003226000-memory.dmp
memory/3640-133-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/3640-132-0x0000000003200000-0x0000000003201000-memory.dmp
memory/3640-131-0x0000000003340000-0x0000000003341000-memory.dmp
memory/3640-129-0x0000000000F70000-0x0000000000F71000-memory.dmp