Analysis

  • max time kernel
    152s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    07/12/2021, 21:34

General

  • Target

    f8992764ad4be6c6c315be9b97796463abd997e534ee18b3446463a2a556b3ae.exe

  • Size

    341KB

  • MD5

    0632c821ea5bbadb6d2103a007ee4689

  • SHA1

    8216bc0a376f467bf7b071648a13cbe7003d4569

  • SHA256

    f8992764ad4be6c6c315be9b97796463abd997e534ee18b3446463a2a556b3ae

  • SHA512

    04458d753bd6db1cef4b0536cd2f680555a2e7506e03310799f6fd8914bc7102afb1d55f841e1f9066c5a4028130cb92deeaaf41075a0e7804e3a6b05f48af3c

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://94.158.245.167/capibar

    http://185.163.204.216/capibar

    http://185.225.19.238/capibar

    http://185.163.204.218/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

amadey

Version

2.86

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fd4f23250443a724a3d1548e6ab07c481dfc2814

Attributes
  • url4cnc

    http://91.219.236.27/duglassa1

    http://94.158.245.167/duglassa1

    http://185.163.204.216/duglassa1

    http://185.225.19.238/duglassa1

    http://185.163.204.218/duglassa1

    https://t.me/duglassa1

rc4.plain
rc4.plain

Extracted

Family

arkei

Botnet

Default

C2

http://195.133.18.126/ZIaKfGwC3P.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • Arkei Stealer Payload 3 IoCs
  • Bazar/Team9 Loader payload 1 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 50 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f8992764ad4be6c6c315be9b97796463abd997e534ee18b3446463a2a556b3ae.exe
    "C:\Users\Admin\AppData\Local\Temp\f8992764ad4be6c6c315be9b97796463abd997e534ee18b3446463a2a556b3ae.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4024
    • C:\Users\Admin\AppData\Local\Temp\f8992764ad4be6c6c315be9b97796463abd997e534ee18b3446463a2a556b3ae.exe
      "C:\Users\Admin\AppData\Local\Temp\f8992764ad4be6c6c315be9b97796463abd997e534ee18b3446463a2a556b3ae.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4336
  • C:\Users\Admin\AppData\Local\Temp\143F.exe
    C:\Users\Admin\AppData\Local\Temp\143F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4424
    • C:\Users\Admin\AppData\Local\Temp\143F.exe
      C:\Users\Admin\AppData\Local\Temp\143F.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:4584
  • C:\Users\Admin\AppData\Local\Temp\8B07.exe
    C:\Users\Admin\AppData\Local\Temp\8B07.exe
    1⤵
    • Executes dropped EXE
    PID:648
  • C:\Users\Admin\AppData\Local\Temp\8DA8.exe
    C:\Users\Admin\AppData\Local\Temp\8DA8.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:816
  • C:\Users\Admin\AppData\Roaming\iitshhh
    C:\Users\Admin\AppData\Roaming\iitshhh
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1488
    • C:\Users\Admin\AppData\Roaming\iitshhh
      C:\Users\Admin\AppData\Roaming\iitshhh
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2460
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\CDA0.dll
    1⤵
    • Loads dropped DLL
    PID:2732
  • C:\Users\Admin\AppData\Local\Temp\D14A.exe
    C:\Users\Admin\AppData\Local\Temp\D14A.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:3596
  • C:\Users\Admin\AppData\Local\Temp\E214.exe
    C:\Users\Admin\AppData\Local\Temp\E214.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:5112
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2340
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:5084
        • C:\Windows\SysWOW64\cacls.exe
          CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
          3⤵
            PID:1492
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
            3⤵
              PID:4744
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:4936
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:3560
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
                3⤵
                  PID:3540
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                2⤵
                  PID:396
                  • C:\Windows\SysWOW64\cacls.exe
                    CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                    3⤵
                      PID:4852
                  • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                    "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:720
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                      3⤵
                        PID:1348
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                          4⤵
                            PID:1584
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:940
                    • C:\Users\Admin\AppData\Local\Temp\FC15.exe
                      C:\Users\Admin\AppData\Local\Temp\FC15.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2988
                    • C:\Users\Admin\AppData\Local\Temp\3F1A.exe
                      C:\Users\Admin\AppData\Local\Temp\3F1A.exe
                      1⤵
                      • Executes dropped EXE
                      • Checks BIOS information in registry
                      • Loads dropped DLL
                      • Checks whether UAC is enabled
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      • Checks processor information in registry
                      PID:2072
                    • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      1⤵
                      • Executes dropped EXE
                      PID:3956

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/648-140-0x0000000001F80000-0x000000000200F000-memory.dmp

                            Filesize

                            572KB

                          • memory/648-153-0x0000000000400000-0x0000000000491000-memory.dmp

                            Filesize

                            580KB

                          • memory/720-223-0x0000000000628000-0x0000000000646000-memory.dmp

                            Filesize

                            120KB

                          • memory/720-228-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/816-150-0x00000000058D0000-0x00000000058D1000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-154-0x0000000005A40000-0x0000000005A41000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-155-0x0000000005910000-0x0000000005911000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-159-0x0000000006B70000-0x0000000006B71000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-160-0x0000000005C40000-0x0000000005C41000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-161-0x0000000005D60000-0x0000000005D61000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-162-0x0000000005D40000-0x0000000005D41000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-163-0x0000000006840000-0x0000000006841000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-165-0x0000000007340000-0x0000000007341000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-166-0x0000000007A40000-0x0000000007A41000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-152-0x0000000076520000-0x0000000077868000-memory.dmp

                            Filesize

                            19.3MB

                          • memory/816-137-0x0000000000E50000-0x0000000000EB9000-memory.dmp

                            Filesize

                            420KB

                          • memory/816-156-0x00000000730D0000-0x000000007311B000-memory.dmp

                            Filesize

                            300KB

                          • memory/816-151-0x0000000075620000-0x0000000075BA4000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/816-149-0x0000000005A50000-0x0000000005A51000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-148-0x0000000003740000-0x0000000003741000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-147-0x0000000006060000-0x0000000006061000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-146-0x0000000073530000-0x00000000735B0000-memory.dmp

                            Filesize

                            512KB

                          • memory/816-144-0x0000000000E50000-0x0000000000E51000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-143-0x0000000074AB0000-0x0000000074BA1000-memory.dmp

                            Filesize

                            964KB

                          • memory/816-142-0x0000000074D30000-0x0000000074EF2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/816-141-0x0000000000FD0000-0x0000000000FD1000-memory.dmp

                            Filesize

                            4KB

                          • memory/816-139-0x0000000002E40000-0x0000000002E85000-memory.dmp

                            Filesize

                            276KB

                          • memory/2072-248-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-246-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-253-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-247-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-252-0x0000000077BA0000-0x0000000077D2E000-memory.dmp

                            Filesize

                            1.6MB

                          • memory/2072-250-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-239-0x0000000001420000-0x000000000156A000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/2072-249-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-240-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-251-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-245-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-241-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2072-244-0x0000000074D30000-0x0000000074EF2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/2072-243-0x00000000013E0000-0x00000000013E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/2072-242-0x0000000000BB0000-0x0000000000F7B000-memory.dmp

                            Filesize

                            3.8MB

                          • memory/2236-130-0x0000000002B90000-0x0000000002BA6000-memory.dmp

                            Filesize

                            88KB

                          • memory/2236-122-0x0000000000D20000-0x0000000000D36000-memory.dmp

                            Filesize

                            88KB

                          • memory/2236-173-0x0000000002BE0000-0x0000000002BF6000-memory.dmp

                            Filesize

                            88KB

                          • memory/2732-238-0x0000000002890000-0x00000000028D0000-memory.dmp

                            Filesize

                            256KB

                          • memory/2732-233-0x00000000022D0000-0x00000000022D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2732-234-0x00000000022D0000-0x00000000022D2000-memory.dmp

                            Filesize

                            8KB

                          • memory/2988-231-0x0000000000600000-0x000000000074A000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/2988-232-0x0000000000400000-0x0000000000515000-memory.dmp

                            Filesize

                            1.1MB

                          • memory/3596-190-0x0000000076520000-0x0000000077868000-memory.dmp

                            Filesize

                            19.3MB

                          • memory/3596-193-0x0000000005170000-0x0000000005171000-memory.dmp

                            Filesize

                            4KB

                          • memory/3596-177-0x0000000000300000-0x00000000003B2000-memory.dmp

                            Filesize

                            712KB

                          • memory/3596-178-0x0000000000400000-0x0000000000401000-memory.dmp

                            Filesize

                            4KB

                          • memory/3596-179-0x0000000074D30000-0x0000000074EF2000-memory.dmp

                            Filesize

                            1.8MB

                          • memory/3596-192-0x0000000073720000-0x000000007376B000-memory.dmp

                            Filesize

                            300KB

                          • memory/3596-191-0x0000000002E70000-0x0000000002E71000-memory.dmp

                            Filesize

                            4KB

                          • memory/3596-180-0x0000000074AB0000-0x0000000074BA1000-memory.dmp

                            Filesize

                            964KB

                          • memory/3596-181-0x0000000000300000-0x0000000000301000-memory.dmp

                            Filesize

                            4KB

                          • memory/3596-216-0x00000000067F0000-0x00000000067F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/3596-189-0x0000000075620000-0x0000000075BA4000-memory.dmp

                            Filesize

                            5.5MB

                          • memory/3596-184-0x0000000074390000-0x0000000074410000-memory.dmp

                            Filesize

                            512KB

                          • memory/3596-183-0x0000000002720000-0x0000000002765000-memory.dmp

                            Filesize

                            276KB

                          • memory/3956-261-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB

                          • memory/3956-260-0x00000000004B0000-0x00000000005FA000-memory.dmp

                            Filesize

                            1.3MB

                          • memory/3956-258-0x000000000063E000-0x000000000065C000-memory.dmp

                            Filesize

                            120KB

                          • memory/4024-119-0x0000000000030000-0x0000000000039000-memory.dmp

                            Filesize

                            36KB

                          • memory/4024-118-0x0000000000861000-0x0000000000872000-memory.dmp

                            Filesize

                            68KB

                          • memory/4336-120-0x0000000000400000-0x0000000000409000-memory.dmp

                            Filesize

                            36KB

                          • memory/4424-126-0x0000000000581000-0x0000000000592000-memory.dmp

                            Filesize

                            68KB

                          • memory/5112-199-0x0000000002070000-0x00000000020A9000-memory.dmp

                            Filesize

                            228KB

                          • memory/5112-200-0x0000000000400000-0x000000000045E000-memory.dmp

                            Filesize

                            376KB