Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211104
  • submitted
    07/12/2021, 23:47

General

  • Target

    a4822c960055c8c34fcc130bae6f0d86.exe

  • Size

    319KB

  • MD5

    a4822c960055c8c34fcc130bae6f0d86

  • SHA1

    bd5f62284b8c1c905a72b3c7f66240a4704e1bfa

  • SHA256

    f6401919fd20e698ec964ca0df4eee18c1f13852eef32a9246fe4605cff79969

  • SHA512

    7bb794fddd9d43483ddf17d4d1a8957db6044d4d4d8271f3c3631b416c0bb788e61ddb2a8a0ea16bbe3d0baa416534b4e8e475628e38bb08922c62f4cae45061

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

f797145799b7b1b77b35d81de942eee0908da519

Attributes
  • url4cnc

    http://91.219.236.27/capibar

    http://94.158.245.167/capibar

    http://185.163.204.216/capibar

    http://185.225.19.238/capibar

    http://185.163.204.218/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Extracted

Family

amadey

Version

2.86

C2

185.215.113.35/d2VxjasuwS/index.php

Extracted

Family

raccoon

Version

1.8.3-hotfix

Botnet

fd4f23250443a724a3d1548e6ab07c481dfc2814

Attributes
  • url4cnc

    http://91.219.236.27/duglassa1

    http://94.158.245.167/duglassa1

    http://185.163.204.216/duglassa1

    http://185.225.19.238/duglassa1

    http://185.163.204.218/duglassa1

    https://t.me/duglassa1

rc4.plain
rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • BitRAT

    BitRAT is a remote access tool written in C++ and uses leaked source code from other families.

  • BitRAT Payload 4 IoCs
  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

    suricata: ET MALWARE Observed Malicious SSL Cert (BitRAT CnC)

  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

  • Bazar/Team9 Loader payload 1 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe
    "C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2040
    • C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe
      "C:\Users\Admin\AppData\Local\Temp\a4822c960055c8c34fcc130bae6f0d86.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:3916
  • C:\Users\Admin\AppData\Local\Temp\6E56.exe
    C:\Users\Admin\AppData\Local\Temp\6E56.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2300
    • C:\Users\Admin\AppData\Local\Temp\6E56.exe
      C:\Users\Admin\AppData\Local\Temp\6E56.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2788
  • C:\Users\Admin\AppData\Local\Temp\84BD.exe
    C:\Users\Admin\AppData\Local\Temp\84BD.exe
    1⤵
    • Executes dropped EXE
    PID:2584
  • C:\Users\Admin\AppData\Local\Temp\874F.exe
    C:\Users\Admin\AppData\Local\Temp\874F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1432
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\C9B8.dll
    1⤵
    • Loads dropped DLL
    PID:2972
  • C:\Users\Admin\AppData\Local\Temp\CE1E.exe
    C:\Users\Admin\AppData\Local\Temp\CE1E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1072
  • C:\Users\Admin\AppData\Local\Temp\DD90.exe
    C:\Users\Admin\AppData\Local\Temp\DD90.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2160
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2728
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /S /D /c" echo Y"
        3⤵
          PID:3128
        • C:\Windows\SysWOW64\cacls.exe
          CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"
          3⤵
            PID:3532
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:4048
          • C:\Windows\SysWOW64\cacls.exe
            CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E
            3⤵
              PID:972
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
            2⤵
            • Suspicious use of WriteProcessMemory
            PID:2328
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /S /D /c" echo Y"
              3⤵
                PID:2892
              • C:\Windows\SysWOW64\cacls.exe
                CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"
                3⤵
                  PID:2392
              • C:\Windows\SysWOW64\cmd.exe
                "C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3204
                • C:\Windows\SysWOW64\cacls.exe
                  CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E
                  3⤵
                    PID:3160
                • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                  "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:3252
                  • C:\Windows\SysWOW64\cmd.exe
                    "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                    3⤵
                      PID:1208
                      • C:\Windows\SysWOW64\reg.exe
                        REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                        4⤵
                          PID:3808
                      • C:\Windows\SysWOW64\schtasks.exe
                        "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                        3⤵
                        • Creates scheduled task(s)
                        PID:3096
                  • C:\Users\Admin\AppData\Local\Temp\FC15.exe
                    C:\Users\Admin\AppData\Local\Temp\FC15.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2344
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      2⤵
                        PID:4068
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        2⤵
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Modifies registry class
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of SetWindowsHookEx
                        PID:3168
                        • C:\Windows\System32\fodhelper.exe
                          "C:\Windows\System32\fodhelper.exe"
                          3⤵
                          • Drops file in Windows directory
                          PID:2172
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe" -wdkill
                            4⤵
                              PID:3256
                      • C:\Users\Admin\AppData\Local\Temp\13F4.exe
                        C:\Users\Admin\AppData\Local\Temp\13F4.exe
                        1⤵
                        • Executes dropped EXE
                        PID:2472
                      • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                        C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                        1⤵
                        • Executes dropped EXE
                        PID:1872

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/1072-178-0x0000000073250000-0x000000007329B000-memory.dmp

                              Filesize

                              300KB

                            • memory/1072-175-0x00000000746F0000-0x0000000074C74000-memory.dmp

                              Filesize

                              5.5MB

                            • memory/1072-170-0x00000000736B0000-0x0000000073730000-memory.dmp

                              Filesize

                              512KB

                            • memory/1072-168-0x0000000002A00000-0x0000000002A45000-memory.dmp

                              Filesize

                              276KB

                            • memory/1072-167-0x0000000000E90000-0x0000000000E91000-memory.dmp

                              Filesize

                              4KB

                            • memory/1072-166-0x0000000074510000-0x0000000074601000-memory.dmp

                              Filesize

                              964KB

                            • memory/1072-165-0x00000000770D0000-0x0000000077292000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/1072-164-0x00000000005C0000-0x00000000005C1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1072-163-0x0000000000E90000-0x0000000000F42000-memory.dmp

                              Filesize

                              712KB

                            • memory/1072-176-0x0000000074CF0000-0x0000000076038000-memory.dmp

                              Filesize

                              19.3MB

                            • memory/1072-179-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-148-0x00000000027A0000-0x00000000027A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-147-0x0000000005580000-0x0000000005581000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-138-0x00000000004B0000-0x00000000004B1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-155-0x0000000073250000-0x000000007329B000-memory.dmp

                              Filesize

                              300KB

                            • memory/1432-154-0x0000000004EE0000-0x0000000004EE1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-153-0x0000000074CF0000-0x0000000076038000-memory.dmp

                              Filesize

                              19.3MB

                            • memory/1432-152-0x0000000004F60000-0x0000000004F61000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-151-0x00000000746F0000-0x0000000074C74000-memory.dmp

                              Filesize

                              5.5MB

                            • memory/1432-150-0x0000000004EA0000-0x0000000004EA1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-149-0x0000000005080000-0x0000000005081000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-140-0x0000000002640000-0x0000000002685000-memory.dmp

                              Filesize

                              276KB

                            • memory/1432-139-0x00000000770D0000-0x0000000077292000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/1432-146-0x00000000736B0000-0x0000000073730000-memory.dmp

                              Filesize

                              512KB

                            • memory/1432-144-0x0000000000310000-0x0000000000311000-memory.dmp

                              Filesize

                              4KB

                            • memory/1432-143-0x0000000074510000-0x0000000074601000-memory.dmp

                              Filesize

                              964KB

                            • memory/1432-137-0x0000000000310000-0x0000000000379000-memory.dmp

                              Filesize

                              420KB

                            • memory/1872-222-0x000000000067E000-0x000000000069C000-memory.dmp

                              Filesize

                              120KB

                            • memory/1872-224-0x0000000000400000-0x000000000045E000-memory.dmp

                              Filesize

                              376KB

                            • memory/2040-118-0x00000000007E1000-0x00000000007F2000-memory.dmp

                              Filesize

                              68KB

                            • memory/2040-121-0x0000000000030000-0x0000000000039000-memory.dmp

                              Filesize

                              36KB

                            • memory/2156-122-0x0000000001120000-0x0000000001136000-memory.dmp

                              Filesize

                              88KB

                            • memory/2156-156-0x0000000002F90000-0x0000000002FA6000-memory.dmp

                              Filesize

                              88KB

                            • memory/2160-183-0x00000000006D8000-0x00000000006F6000-memory.dmp

                              Filesize

                              120KB

                            • memory/2160-187-0x0000000001F60000-0x0000000001F99000-memory.dmp

                              Filesize

                              228KB

                            • memory/2160-188-0x0000000000400000-0x000000000045E000-memory.dmp

                              Filesize

                              376KB

                            • memory/2344-226-0x000000001D740000-0x000000001D741000-memory.dmp

                              Filesize

                              4KB

                            • memory/2344-227-0x000000001DA20000-0x000000001DDE6000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/2344-228-0x00000000031D0000-0x00000000031D1000-memory.dmp

                              Filesize

                              4KB

                            • memory/2344-211-0x0000000001420000-0x0000000001422000-memory.dmp

                              Filesize

                              8KB

                            • memory/2344-225-0x000000001C420000-0x000000001C7E8000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/2344-210-0x0000000001400000-0x000000000140D000-memory.dmp

                              Filesize

                              52KB

                            • memory/2344-208-0x0000000000E80000-0x0000000000E81000-memory.dmp

                              Filesize

                              4KB

                            • memory/2472-220-0x0000000000400000-0x0000000000515000-memory.dmp

                              Filesize

                              1.1MB

                            • memory/2472-219-0x00000000007B0000-0x000000000083F000-memory.dmp

                              Filesize

                              572KB

                            • memory/2584-142-0x0000000000400000-0x0000000000491000-memory.dmp

                              Filesize

                              580KB

                            • memory/2584-141-0x0000000002160000-0x00000000021EF000-memory.dmp

                              Filesize

                              572KB

                            • memory/2972-216-0x0000000002790000-0x0000000002792000-memory.dmp

                              Filesize

                              8KB

                            • memory/2972-215-0x0000000002790000-0x0000000002792000-memory.dmp

                              Filesize

                              8KB

                            • memory/2972-217-0x0000000002240000-0x0000000002280000-memory.dmp

                              Filesize

                              256KB

                            • memory/3168-231-0x0000000000400000-0x00000000007CE000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/3168-229-0x0000000000400000-0x00000000007CE000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/3168-232-0x0000000000400000-0x00000000007CE000-memory.dmp

                              Filesize

                              3.8MB

                            • memory/3252-206-0x0000000000400000-0x000000000045E000-memory.dmp

                              Filesize

                              376KB

                            • memory/3256-235-0x0000000000740000-0x0000000000741000-memory.dmp

                              Filesize

                              4KB

                            • memory/3916-119-0x0000000000400000-0x0000000000409000-memory.dmp

                              Filesize

                              36KB