Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
07-12-2021 02:11
Static task
static1
Behavioral task
behavioral1
Sample
9801da7c6ea06dd8c9e7cbcc872b97e8.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
9801da7c6ea06dd8c9e7cbcc872b97e8.exe
Resource
win10-en-20211104
General
-
Target
9801da7c6ea06dd8c9e7cbcc872b97e8.exe
-
Size
234KB
-
MD5
9801da7c6ea06dd8c9e7cbcc872b97e8
-
SHA1
58c08605d3f1b5d12c282ce7867d6a27082a405e
-
SHA256
e2d05e5660b4cae33a0283efa07c052bf7f2c776e782004e8f690bbf3ae6f48c
-
SHA512
9d28e5ab6313eecab32f6db23a32ce6165cad83a7ba1937ea5c60726d052289e2b14d789896338f844c5c4de7ff7520c1ce4f0ecbc3d75b65bcbcd173387a5ed
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Extracted
raccoon
1.8.3-hotfix
f797145799b7b1b77b35d81de942eee0908da519
-
url4cnc
http://91.219.236.27/capibar
http://94.158.245.167/capibar
http://185.163.204.216/capibar
http://185.225.19.238/capibar
http://185.163.204.218/capibar
https://t.me/capibar
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1452-74-0x0000000000990000-0x0000000000A13000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
21A4.exe2849.exe3094.exe21A4.exepid process 1976 21A4.exe 1880 2849.exe 1452 3094.exe 1816 21A4.exe -
Deletes itself 1 IoCs
Processes:
pid process 1260 -
Loads dropped DLL 1 IoCs
Processes:
21A4.exepid process 1976 21A4.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
3094.exepid process 1452 3094.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
9801da7c6ea06dd8c9e7cbcc872b97e8.exe21A4.exedescription pid process target process PID 1100 set thread context of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1976 set thread context of 1816 1976 21A4.exe 21A4.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
9801da7c6ea06dd8c9e7cbcc872b97e8.exe21A4.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9801da7c6ea06dd8c9e7cbcc872b97e8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9801da7c6ea06dd8c9e7cbcc872b97e8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 9801da7c6ea06dd8c9e7cbcc872b97e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 21A4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 21A4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 21A4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
9801da7c6ea06dd8c9e7cbcc872b97e8.exepid process 1484 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 1484 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1260 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
9801da7c6ea06dd8c9e7cbcc872b97e8.exepid process 1484 9801da7c6ea06dd8c9e7cbcc872b97e8.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1260 1260 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1260 1260 -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
9801da7c6ea06dd8c9e7cbcc872b97e8.exe21A4.exedescription pid process target process PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1100 wrote to memory of 1484 1100 9801da7c6ea06dd8c9e7cbcc872b97e8.exe 9801da7c6ea06dd8c9e7cbcc872b97e8.exe PID 1260 wrote to memory of 1976 1260 21A4.exe PID 1260 wrote to memory of 1976 1260 21A4.exe PID 1260 wrote to memory of 1976 1260 21A4.exe PID 1260 wrote to memory of 1976 1260 21A4.exe PID 1260 wrote to memory of 1880 1260 2849.exe PID 1260 wrote to memory of 1880 1260 2849.exe PID 1260 wrote to memory of 1880 1260 2849.exe PID 1260 wrote to memory of 1880 1260 2849.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1260 wrote to memory of 1452 1260 3094.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe PID 1976 wrote to memory of 1816 1976 21A4.exe 21A4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9801da7c6ea06dd8c9e7cbcc872b97e8.exe"C:\Users\Admin\AppData\Local\Temp\9801da7c6ea06dd8c9e7cbcc872b97e8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9801da7c6ea06dd8c9e7cbcc872b97e8.exe"C:\Users\Admin\AppData\Local\Temp\9801da7c6ea06dd8c9e7cbcc872b97e8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\21A4.exeC:\Users\Admin\AppData\Local\Temp\21A4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\21A4.exeC:\Users\Admin\AppData\Local\Temp\21A4.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
-
C:\Users\Admin\AppData\Local\Temp\2849.exeC:\Users\Admin\AppData\Local\Temp\2849.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3094.exeC:\Users\Admin\AppData\Local\Temp\3094.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\21A4.exeMD5
53bd1244d2c85a2d90856079911eee24
SHA148bb7a1466cae478076e2b64f5761a0ea0bf61af
SHA256dc189a482f8fd5ddd6e8aa505e7911bc6b368bb9ff97de0b05713a97489809d8
SHA51226453d8edfc0d221c9a944b1f8ccd61a8be1b68e540c0ff8550c58ad1b3a5c30a4d130abe8300e98d6683d7c656fb4a995767a232bca83e2c73bdb7d7e82849e
-
C:\Users\Admin\AppData\Local\Temp\21A4.exeMD5
53bd1244d2c85a2d90856079911eee24
SHA148bb7a1466cae478076e2b64f5761a0ea0bf61af
SHA256dc189a482f8fd5ddd6e8aa505e7911bc6b368bb9ff97de0b05713a97489809d8
SHA51226453d8edfc0d221c9a944b1f8ccd61a8be1b68e540c0ff8550c58ad1b3a5c30a4d130abe8300e98d6683d7c656fb4a995767a232bca83e2c73bdb7d7e82849e
-
C:\Users\Admin\AppData\Local\Temp\21A4.exeMD5
53bd1244d2c85a2d90856079911eee24
SHA148bb7a1466cae478076e2b64f5761a0ea0bf61af
SHA256dc189a482f8fd5ddd6e8aa505e7911bc6b368bb9ff97de0b05713a97489809d8
SHA51226453d8edfc0d221c9a944b1f8ccd61a8be1b68e540c0ff8550c58ad1b3a5c30a4d130abe8300e98d6683d7c656fb4a995767a232bca83e2c73bdb7d7e82849e
-
C:\Users\Admin\AppData\Local\Temp\2849.exeMD5
bce50d5b17bb88f22f0000511026520d
SHA1599aaed4ee72ec0e0fc4cada844a1c210e332961
SHA25677e40ca1c6001b2c01ef50b84585d68127eeb5691c899b049a9948fb60b13455
SHA512c7dea899ed181efd0474a8b181b8fd8e91c734703a03ac71381e072684c93dd6d002629ffcfeefb15b6ca79ba1cf8cc62acd2b16fe7e0faed444c6f3eebb7536
-
C:\Users\Admin\AppData\Local\Temp\3094.exeMD5
8d3dcfb2adbb29ccdf6f6e15958c8c14
SHA1659efa9597bbc44d66d1f56859fff637973b3845
SHA256c8ee4f813016ec8b590b4e588817c16fa7e8cea9a1b0365254254a5b01d898f6
SHA5124da46b66f372575b8df9d36264fb22bb596f8eb80e797f0b9696540e3d5fefca3702c672eb19ca6eb380c633b1b9e6707b3dbbce60f07e1659b0bf7782851022
-
C:\Users\Admin\AppData\Local\Temp\3094.exeMD5
8d3dcfb2adbb29ccdf6f6e15958c8c14
SHA1659efa9597bbc44d66d1f56859fff637973b3845
SHA256c8ee4f813016ec8b590b4e588817c16fa7e8cea9a1b0365254254a5b01d898f6
SHA5124da46b66f372575b8df9d36264fb22bb596f8eb80e797f0b9696540e3d5fefca3702c672eb19ca6eb380c633b1b9e6707b3dbbce60f07e1659b0bf7782851022
-
\Users\Admin\AppData\Local\Temp\21A4.exeMD5
53bd1244d2c85a2d90856079911eee24
SHA148bb7a1466cae478076e2b64f5761a0ea0bf61af
SHA256dc189a482f8fd5ddd6e8aa505e7911bc6b368bb9ff97de0b05713a97489809d8
SHA51226453d8edfc0d221c9a944b1f8ccd61a8be1b68e540c0ff8550c58ad1b3a5c30a4d130abe8300e98d6683d7c656fb4a995767a232bca83e2c73bdb7d7e82849e
-
memory/1100-59-0x0000000000220000-0x0000000000229000-memory.dmpFilesize
36KB
-
memory/1100-55-0x00000000005BB000-0x00000000005C4000-memory.dmpFilesize
36KB
-
memory/1260-60-0x0000000002A20000-0x0000000002A36000-memory.dmpFilesize
88KB
-
memory/1452-74-0x0000000000990000-0x0000000000A13000-memory.dmpFilesize
524KB
-
memory/1452-69-0x0000000000000000-mapping.dmp
-
memory/1452-83-0x0000000075980000-0x00000000759D7000-memory.dmpFilesize
348KB
-
memory/1452-73-0x0000000074CD0000-0x0000000074D1A000-memory.dmpFilesize
296KB
-
memory/1452-80-0x00000000774F0000-0x0000000077537000-memory.dmpFilesize
284KB
-
memory/1452-75-0x0000000000100000-0x0000000000101000-memory.dmpFilesize
4KB
-
memory/1452-78-0x00000000001C0000-0x0000000000205000-memory.dmpFilesize
276KB
-
memory/1452-77-0x0000000075D10000-0x0000000075DBC000-memory.dmpFilesize
688KB
-
memory/1484-58-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/1484-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1484-57-0x0000000000402F47-mapping.dmp
-
memory/1816-85-0x0000000000402F47-mapping.dmp
-
memory/1880-65-0x000000000066B000-0x00000000006BA000-memory.dmpFilesize
316KB
-
memory/1880-68-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1880-67-0x0000000001CE0000-0x0000000001D6F000-memory.dmpFilesize
572KB
-
memory/1880-63-0x0000000000000000-mapping.dmp
-
memory/1976-79-0x0000000000658000-0x0000000000669000-memory.dmpFilesize
68KB
-
memory/1976-61-0x0000000000000000-mapping.dmp