Analysis
- max time kernel
152s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
04/12/2021, 06:51
General
- Target 6d8672cdfdbf8a4a73699d582f5e81c0.exe
- Size 318KB
- Sample211204-hmkwjsaedr
- SHA256 afd96a8e1fd8b41cf41130c5b9055f96209acdb7aa4c31f8f1091b5ee775c96b
Malware Config
Extracted
-
smokeloader
-
2020
-
http://host-data-coin-11.com/
-
http://file-coin-host-12.com/
-
http://srtuiyhuali.at/
-
http://fufuiloirtu.com/
-
http://amogohuigotuli.at/
-
http://novohudosovu.com/
-
http://brutuilionust.com/
-
http://bubushkalioua.com/
-
http://dumuilistrati.at/
-
http://verboliatsiaeeees.com/
Extracted
-
raccoon
-
1.8.3-hotfix
-
049dc5184bb65eb56e4e860bf61427e2a0fcba1e
-
url4cnc
http://185.225.19.18/duglassa1
http://91.219.237.227/duglassa1
https://t.me/duglassa1
Extracted
-
raccoon
-
1.8.3-hotfix
-
b620be4c85b4051a92040003edbc322be4eb082d
-
url4cnc
http://91.219.236.207/capibar
http://185.225.19.18/capibar
http://91.219.237.227/capibar
https://t.me/capibar
Extracted
-
raccoon
-
1.8.3-hotfix
-
8b6023dd139bdc34aab99c286fae23d1442b4956
-
url4cnc
http://91.219.236.27/h_electricryptors2
http://5.181.156.92/h_electricryptors2
http://91.219.236.207/h_electricryptors2
http://185.225.19.18/h_electricryptors2
http://91.219.237.227/h_electricryptors2
https://t.me/h_electricryptors2
Extracted
-
arkei
-
Default
-
http://153.92.210.92/lYWcN6H7B1.php
Signatures
- Arkei
Arkei is an infostealer written in C++.
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil
- Arkei Stealer Payload 3 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 16 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 9 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 7 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of FindShellTrayWindow 28 IoCs
- Suspicious use of SendNotifyMessage 15 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe"C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe"C:\Users\Admin\AppData\Local\Temp\6d8672cdfdbf8a4a73699d582f5e81c0.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\51A6.exeC:\Users\Admin\AppData\Local\Temp\51A6.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\AA76.exeC:\Users\Admin\AppData\Local\Temp\AA76.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AA76.exeC:\Users\Admin\AppData\Local\Temp\AA76.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\AFD6.exeC:\Users\Admin\AppData\Local\Temp\AFD6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\AFD6.exeC:\Users\Admin\AppData\Local\Temp\AFD6.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\B99B.exeC:\Users\Admin\AppData\Local\Temp\B99B.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\C4C7.exeC:\Users\Admin\AppData\Local\Temp\C4C7.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\CA94.exeC:\Users\Admin\AppData\Local\Temp\CA94.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\D5FF.exeC:\Users\Admin\AppData\Local\Temp\D5FF.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\DCA7.exeC:\Users\Admin\AppData\Local\Temp\DCA7.exe1⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\expand.exeexpand2⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c cmd < Confronto.vsd2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^zsXALugVPsbikcLGmlTQMSJGkUUtRoHQkZmHLQyLLuVpnCdInRQPNWfBIsgQkprGKGWkWrUJtiyFXmiJDk$" Che.vsd4⤵
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.comRitroverai.exe.com B4⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com B5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com B6⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com B7⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.comC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Ritroverai.exe.com B8⤵
- Executes dropped EXE
-
-
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping JQKTJDNJ4⤵
- Runs ping.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\EE4.exeC:\Users\Admin\AppData\Local\Temp\EE4.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/212-247-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-249-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-245-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-246-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-236-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-238-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-248-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-244-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-241-0x00000000768C0000-0x0000000076A82000-memory.dmp
memory/212-250-0x0000000077240000-0x00000000773CE000-memory.dmp
memory/212-243-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-242-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-240-0x0000000001010000-0x0000000001011000-memory.dmp
memory/212-235-0x0000000000280000-0x000000000074A000-memory.dmp
memory/212-234-0x0000000001180000-0x00000000011C5000-memory.dmp
memory/596-157-0x0000000071CB0000-0x0000000071D30000-memory.dmp
memory/596-184-0x00000000742C0000-0x0000000075608000-memory.dmp
memory/596-169-0x0000000004E10000-0x0000000004E11000-memory.dmp
memory/596-259-0x0000000007030000-0x0000000007031000-memory.dmp
memory/596-178-0x0000000004E90000-0x0000000004E91000-memory.dmp
memory/596-140-0x0000000000910000-0x0000000000A85000-memory.dmp
memory/596-141-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/596-181-0x0000000076BD0000-0x0000000077154000-memory.dmp
memory/596-142-0x0000000002610000-0x0000000002653000-memory.dmp
memory/596-143-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/596-144-0x00000000768C0000-0x0000000076A82000-memory.dmp
memory/596-148-0x00000000761C0000-0x00000000762B1000-memory.dmp
memory/596-206-0x00000000051C0000-0x00000000051C1000-memory.dmp
memory/596-151-0x0000000000910000-0x0000000000911000-memory.dmp
memory/596-190-0x000000006D300000-0x000000006D34B000-memory.dmp
memory/596-167-0x00000000054B0000-0x00000000054B1000-memory.dmp
memory/596-174-0x0000000004FB0000-0x0000000004FB1000-memory.dmp
memory/1064-165-0x0000000000400000-0x0000000003269000-memory.dmp
memory/1064-146-0x0000000000400000-0x0000000003269000-memory.dmp
memory/1064-200-0x0000000000400000-0x0000000003269000-memory.dmp
memory/1064-202-0x0000000000400000-0x0000000003269000-memory.dmp
memory/1064-199-0x000000000341C000-0x000000000346B000-memory.dmp
memory/1064-201-0x0000000004EB0000-0x0000000004F3F000-memory.dmp
memory/1088-222-0x0000000009050000-0x0000000009051000-memory.dmp
memory/1088-160-0x00000000761C0000-0x00000000762B1000-memory.dmp
memory/1088-191-0x000000006D300000-0x000000006D34B000-memory.dmp
memory/1088-166-0x0000000071CB0000-0x0000000071D30000-memory.dmp
memory/1088-262-0x000000000A540000-0x000000000A541000-memory.dmp
memory/1088-261-0x0000000009A90000-0x0000000009A91000-memory.dmp
memory/1088-155-0x0000000000260000-0x00000000003C8000-memory.dmp
memory/1088-209-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/1088-211-0x0000000009590000-0x0000000009591000-memory.dmp
memory/1088-176-0x00000000055A0000-0x00000000055A1000-memory.dmp
memory/1088-162-0x0000000000260000-0x0000000000261000-memory.dmp
memory/1088-180-0x0000000005410000-0x0000000005411000-memory.dmp
memory/1088-163-0x0000000000E60000-0x0000000000E61000-memory.dmp
memory/1088-217-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/1088-179-0x0000000076BD0000-0x0000000077154000-memory.dmp
memory/1088-183-0x00000000742C0000-0x0000000075608000-memory.dmp
memory/1088-158-0x00000000768C0000-0x0000000076A82000-memory.dmp
memory/1088-161-0x0000000000F10000-0x0000000000F57000-memory.dmp
memory/1088-188-0x0000000009540000-0x0000000009541000-memory.dmp
memory/1088-156-0x00000000009E0000-0x00000000009E1000-memory.dmp
memory/1684-258-0x00000000006D0000-0x00000000006DC000-memory.dmp
memory/1684-257-0x00000000006E0000-0x00000000006E7000-memory.dmp
memory/1856-196-0x00000000007B8000-0x0000000000807000-memory.dmp
memory/1856-198-0x0000000000400000-0x0000000000491000-memory.dmp
memory/1856-197-0x0000000000710000-0x000000000079F000-memory.dmp
memory/2268-145-0x0000000000811000-0x0000000000877000-memory.dmp
memory/2268-159-0x0000000000660000-0x00000000007AA000-memory.dmp
memory/2588-116-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2860-220-0x0000000000811000-0x0000000000860000-memory.dmp
memory/2860-226-0x0000000000400000-0x000000000050F000-memory.dmp
memory/2860-225-0x0000000000510000-0x000000000065A000-memory.dmp
memory/3040-126-0x0000000002DC0000-0x0000000002DD6000-memory.dmp
memory/3040-119-0x00000000011F0000-0x0000000001206000-memory.dmp
memory/3040-182-0x00000000031E0000-0x00000000031F6000-memory.dmp
memory/4384-118-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4620-124-0x0000000002C90000-0x0000000002DDA000-memory.dmp
memory/4620-123-0x0000000002C90000-0x0000000002DDA000-memory.dmp
memory/4620-125-0x0000000000400000-0x0000000002B64000-memory.dmp
memory/4936-254-0x0000000003200000-0x0000000003274000-memory.dmp
memory/4936-256-0x0000000002F50000-0x0000000002FBB000-memory.dmp