Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
03-12-2021 15:34
Static task
static1
Behavioral task
behavioral1
Sample
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe
Resource
win10-en-20211014
General
-
Target
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe
-
Size
1.1MB
-
MD5
c5401e1bb35d1b357e92c7d811d21796
-
SHA1
bb1c65213310d73e7fe6b780c0f4f4459fb71d26
-
SHA256
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90
-
SHA512
2d298e80b63f65887bc04abb1f8d03e34e8e5a0af0bd3adea01daa719f5d7389fea571d8fc330d42e901684b8970066c37670090771f478aadc317d2094c8571
Malware Config
Extracted
raccoon
Extracted
raccoon
1.8.3-hotfix
fe1f102f3334068962b64125bcb00816dba46087
-
url4cnc
http://91.219.236.27/ocherednyara1
http://5.181.156.92/ocherednyara1
http://91.219.236.207/ocherednyara1
http://185.225.19.18/ocherednyara1
http://91.219.237.227/ocherednyara1
https://t.me/ocherednyara1
Extracted
smokeloader
2020
http://185.215.113.40/
http://1fdsdfsdfdsf.space/
http://2fds33rdsrsdrs.space/
http://3fds4544gfgf.space/
http://4jgfdjgdh5fds.space/
http://5gfdtktkkt44.space/
Signatures
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
Processes:
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exedescription pid process target process PID 2680 created 3020 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe Explorer.EXE PID 2680 created 3020 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe Explorer.EXE -
Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exedescription pid process target process PID 2680 set thread context of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 set thread context of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exeExplorer.EXEpid process 3496 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe 3496 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 3020 Explorer.EXE -
Suspicious behavior: MapViewOfSection 7 IoCs
Processes:
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exeExplorer.EXEpid process 3496 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE 3020 Explorer.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exeExplorer.EXEdescription pid process target process PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 2660 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 2680 wrote to memory of 3496 2680 a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 3488 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 3240 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 3240 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 3240 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 1248 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 1248 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 1248 3020 Explorer.EXE explorer.exe PID 3020 wrote to memory of 1248 3020 Explorer.EXE explorer.exe -
outlook_office_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe -
outlook_win_path 1 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676 explorer.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe"C:\Users\Admin\AppData\Local\Temp\a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe"C:\Users\Admin\AppData\Local\Temp\a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe"C:\Users\Admin\AppData\Local\Temp\a6ea6406da66ddd3123cd438e60cf953d5476fc9201834717d21d9faa92c2f90.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1248-131-0x0000000000000000-mapping.dmp
-
memory/1248-132-0x0000000001200000-0x0000000001222000-memory.dmpFilesize
136KB
-
memory/1248-133-0x0000000000FC0000-0x0000000000FE7000-memory.dmpFilesize
156KB
-
memory/2660-123-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2660-120-0x000000000043F176-mapping.dmp
-
memory/2660-119-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/2680-116-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB
-
memory/2680-118-0x0000000000400000-0x0000000000594000-memory.dmpFilesize
1.6MB
-
memory/2680-115-0x0000000000899000-0x000000000096B000-memory.dmpFilesize
840KB
-
memory/2680-117-0x0000000000A00000-0x0000000000AE4000-memory.dmpFilesize
912KB
-
memory/3020-124-0x0000000000820000-0x0000000000836000-memory.dmpFilesize
88KB
-
memory/3240-129-0x0000000001200000-0x0000000001207000-memory.dmpFilesize
28KB
-
memory/3240-126-0x0000000000000000-mapping.dmp
-
memory/3240-130-0x0000000000FF0000-0x0000000000FFC000-memory.dmpFilesize
48KB
-
memory/3488-127-0x0000000000D80000-0x0000000000DF4000-memory.dmpFilesize
464KB
-
memory/3488-128-0x0000000000D10000-0x0000000000D7B000-memory.dmpFilesize
428KB
-
memory/3488-125-0x0000000000000000-mapping.dmp
-
memory/3496-122-0x0000000000402F69-mapping.dmp
-
memory/3496-121-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB