Analysis
-
max time kernel
152s -
max time network
152s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
07-12-2021 06:04
Static task
static1
Behavioral task
behavioral1
Sample
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe
Resource
win10-en-20211104
General
-
Target
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe
-
Size
319KB
-
MD5
bd0d9c788a9399ede42b878cc0e1583e
-
SHA1
ee78dbd9602863e63f4257f61bf46ab4ccd110fe
-
SHA256
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995
-
SHA512
76b561c36cae5baa7e9fe5b456897707f7b21de73688ea03730ea61888de7e16c1a1b04f90e11a372ff15a68963322db49131ea80e31bf033ccb23f2beabd056
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Extracted
raccoon
1.8.3-hotfix
f797145799b7b1b77b35d81de942eee0908da519
-
url4cnc
http://91.219.236.27/capibar
http://94.158.245.167/capibar
http://185.163.204.216/capibar
http://185.225.19.238/capibar
http://185.163.204.218/capibar
https://t.me/capibar
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1556-74-0x00000000009C0000-0x0000000000A43000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
F8EF.exeFE8B.exe550.exeF8EF.exe3834.exepid process 1972 F8EF.exe 1876 FE8B.exe 1556 550.exe 1632 F8EF.exe 1944 3834.exe -
Deletes itself 1 IoCs
Processes:
pid process 1260 -
Loads dropped DLL 2 IoCs
Processes:
F8EF.exeregsvr32.exepid process 1972 F8EF.exe 1312 regsvr32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
550.exepid process 1556 550.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exeF8EF.exedescription pid process target process PID 1760 set thread context of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1972 set thread context of 1632 1972 F8EF.exe F8EF.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1916 1312 WerFault.exe regsvr32.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exeF8EF.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F8EF.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F8EF.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F8EF.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exepid process 576 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 576 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1260 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exeF8EF.exepid process 576 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 1632 F8EF.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1260 1260 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1260 1260 -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exeF8EF.execmd.exedescription pid process target process PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1760 wrote to memory of 576 1760 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe 18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe PID 1260 wrote to memory of 1972 1260 F8EF.exe PID 1260 wrote to memory of 1972 1260 F8EF.exe PID 1260 wrote to memory of 1972 1260 F8EF.exe PID 1260 wrote to memory of 1972 1260 F8EF.exe PID 1260 wrote to memory of 1876 1260 FE8B.exe PID 1260 wrote to memory of 1876 1260 FE8B.exe PID 1260 wrote to memory of 1876 1260 FE8B.exe PID 1260 wrote to memory of 1876 1260 FE8B.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1260 wrote to memory of 1556 1260 550.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1972 wrote to memory of 1632 1972 F8EF.exe F8EF.exe PID 1260 wrote to memory of 1312 1260 regsvr32.exe PID 1260 wrote to memory of 1312 1260 regsvr32.exe PID 1260 wrote to memory of 1312 1260 regsvr32.exe PID 1260 wrote to memory of 1312 1260 regsvr32.exe PID 1260 wrote to memory of 1312 1260 regsvr32.exe PID 1260 wrote to memory of 1944 1260 3834.exe PID 1260 wrote to memory of 1944 1260 3834.exe PID 1260 wrote to memory of 1944 1260 3834.exe PID 1260 wrote to memory of 1944 1260 3834.exe PID 1612 wrote to memory of 1468 1612 cmd.exe cmd.exe PID 1612 wrote to memory of 1468 1612 cmd.exe cmd.exe PID 1612 wrote to memory of 1468 1612 cmd.exe cmd.exe PID 1612 wrote to memory of 1468 1612 cmd.exe cmd.exe PID 1612 wrote to memory of 1516 1612 cmd.exe cacls.exe PID 1612 wrote to memory of 1516 1612 cmd.exe cacls.exe PID 1612 wrote to memory of 1516 1612 cmd.exe cacls.exe PID 1612 wrote to memory of 1516 1612 cmd.exe cacls.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe"C:\Users\Admin\AppData\Local\Temp\18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe"C:\Users\Admin\AppData\Local\Temp\18043164cd4ac2d77236cfb68b40ff466c6745d0d7647077ad8b161d84523995.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F8EF.exeC:\Users\Admin\AppData\Local\Temp\F8EF.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F8EF.exeC:\Users\Admin\AppData\Local\Temp\F8EF.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\FE8B.exeC:\Users\Admin\AppData\Local\Temp\FE8B.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\550.exeC:\Users\Admin\AppData\Local\Temp\550.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\2761.dll1⤵
- Loads dropped DLL
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1312 -s 2162⤵
- Program crash
-
C:\Users\Admin\AppData\Local\Temp\3834.exeC:\Users\Admin\AppData\Local\Temp\3834.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\2761.dllMD5
c2326f5c2286b6272f7acde3e2d2915b
SHA10f283ca3c4041e3f915af729371405bec94c50b8
SHA256714616fe3515adc2c2b44781aed900a9e8e37cc4e7239be92f1ca668f40945bd
SHA512ac4592dcda03337016b25a3723d094c2dcff1477d2fea67140bec329af89d4760a602dd1e35e951856d9698655ffcc3fe87ea6680e77fe70c82d4583956f63ac
-
C:\Users\Admin\AppData\Local\Temp\3834.exeMD5
2a03cd34f26826a94fde4103644c4223
SHA1b86cbf66e1087ee7e0fb5244e3a046e5aa3fdb21
SHA256bf5b55dd90d317000bdbdc2eb08bb3ce3c0263cac10aedb67d65f01fd39c95fd
SHA5127b01998bc2547ff48eb861b76552844369f5532416764bad0d4f98fc5cad3e56a4a69c9be28b5e9adc2db054eda30382d133e7c03c1fedec88456f1374c37ebe
-
C:\Users\Admin\AppData\Local\Temp\550.exeMD5
8d3dcfb2adbb29ccdf6f6e15958c8c14
SHA1659efa9597bbc44d66d1f56859fff637973b3845
SHA256c8ee4f813016ec8b590b4e588817c16fa7e8cea9a1b0365254254a5b01d898f6
SHA5124da46b66f372575b8df9d36264fb22bb596f8eb80e797f0b9696540e3d5fefca3702c672eb19ca6eb380c633b1b9e6707b3dbbce60f07e1659b0bf7782851022
-
C:\Users\Admin\AppData\Local\Temp\550.exeMD5
8d3dcfb2adbb29ccdf6f6e15958c8c14
SHA1659efa9597bbc44d66d1f56859fff637973b3845
SHA256c8ee4f813016ec8b590b4e588817c16fa7e8cea9a1b0365254254a5b01d898f6
SHA5124da46b66f372575b8df9d36264fb22bb596f8eb80e797f0b9696540e3d5fefca3702c672eb19ca6eb380c633b1b9e6707b3dbbce60f07e1659b0bf7782851022
-
C:\Users\Admin\AppData\Local\Temp\F8EF.exeMD5
7fb57a6a6bb14f9de55cdd09b482456e
SHA13c4e537e40c2fcf3a5c749797c54b4cee43ef9fa
SHA2569d5bb2a90a43cc073fa1ebc12932f607b8577b2b5df93df24740a74613c9fa5f
SHA512659999b841dee9e996fe23dc0dfb3a1d09ad1f04b6056f77da03370850a90ffa39022179dde694a94783884ab887a8e3ef0e9a6d0bc1a9c272e59781f31065ed
-
C:\Users\Admin\AppData\Local\Temp\F8EF.exeMD5
7fb57a6a6bb14f9de55cdd09b482456e
SHA13c4e537e40c2fcf3a5c749797c54b4cee43ef9fa
SHA2569d5bb2a90a43cc073fa1ebc12932f607b8577b2b5df93df24740a74613c9fa5f
SHA512659999b841dee9e996fe23dc0dfb3a1d09ad1f04b6056f77da03370850a90ffa39022179dde694a94783884ab887a8e3ef0e9a6d0bc1a9c272e59781f31065ed
-
C:\Users\Admin\AppData\Local\Temp\F8EF.exeMD5
7fb57a6a6bb14f9de55cdd09b482456e
SHA13c4e537e40c2fcf3a5c749797c54b4cee43ef9fa
SHA2569d5bb2a90a43cc073fa1ebc12932f607b8577b2b5df93df24740a74613c9fa5f
SHA512659999b841dee9e996fe23dc0dfb3a1d09ad1f04b6056f77da03370850a90ffa39022179dde694a94783884ab887a8e3ef0e9a6d0bc1a9c272e59781f31065ed
-
C:\Users\Admin\AppData\Local\Temp\FE8B.exeMD5
bce50d5b17bb88f22f0000511026520d
SHA1599aaed4ee72ec0e0fc4cada844a1c210e332961
SHA25677e40ca1c6001b2c01ef50b84585d68127eeb5691c899b049a9948fb60b13455
SHA512c7dea899ed181efd0474a8b181b8fd8e91c734703a03ac71381e072684c93dd6d002629ffcfeefb15b6ca79ba1cf8cc62acd2b16fe7e0faed444c6f3eebb7536
-
\Users\Admin\AppData\Local\Temp\2761.dllMD5
c2326f5c2286b6272f7acde3e2d2915b
SHA10f283ca3c4041e3f915af729371405bec94c50b8
SHA256714616fe3515adc2c2b44781aed900a9e8e37cc4e7239be92f1ca668f40945bd
SHA512ac4592dcda03337016b25a3723d094c2dcff1477d2fea67140bec329af89d4760a602dd1e35e951856d9698655ffcc3fe87ea6680e77fe70c82d4583956f63ac
-
\Users\Admin\AppData\Local\Temp\F8EF.exeMD5
7fb57a6a6bb14f9de55cdd09b482456e
SHA13c4e537e40c2fcf3a5c749797c54b4cee43ef9fa
SHA2569d5bb2a90a43cc073fa1ebc12932f607b8577b2b5df93df24740a74613c9fa5f
SHA512659999b841dee9e996fe23dc0dfb3a1d09ad1f04b6056f77da03370850a90ffa39022179dde694a94783884ab887a8e3ef0e9a6d0bc1a9c272e59781f31065ed
-
memory/576-58-0x00000000768A1000-0x00000000768A3000-memory.dmpFilesize
8KB
-
memory/576-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/576-57-0x0000000000402F47-mapping.dmp
-
memory/1260-60-0x0000000002A20000-0x0000000002A36000-memory.dmpFilesize
88KB
-
memory/1260-98-0x0000000003DF0000-0x0000000003E06000-memory.dmpFilesize
88KB
-
memory/1312-100-0x000007FEFBFE1000-0x000007FEFBFE3000-memory.dmpFilesize
8KB
-
memory/1312-99-0x0000000000000000-mapping.dmp
-
memory/1468-107-0x0000000000000000-mapping.dmp
-
memory/1516-108-0x0000000000000000-mapping.dmp
-
memory/1556-95-0x00000000768A0000-0x00000000774EA000-memory.dmpFilesize
12.3MB
-
memory/1556-94-0x0000000001FE0000-0x0000000001FE1000-memory.dmpFilesize
4KB
-
memory/1556-75-0x0000000000110000-0x0000000000111000-memory.dmpFilesize
4KB
-
memory/1556-79-0x0000000000880000-0x00000000008C5000-memory.dmpFilesize
276KB
-
memory/1556-77-0x0000000075D10000-0x0000000075DBC000-memory.dmpFilesize
688KB
-
memory/1556-83-0x00000000774F0000-0x0000000077537000-memory.dmpFilesize
284KB
-
memory/1556-104-0x0000000075220000-0x0000000075237000-memory.dmpFilesize
92KB
-
memory/1556-74-0x00000000009C0000-0x0000000000A43000-memory.dmpFilesize
524KB
-
memory/1556-86-0x0000000075980000-0x00000000759D7000-memory.dmpFilesize
348KB
-
memory/1556-89-0x00000000754F0000-0x000000007564C000-memory.dmpFilesize
1.4MB
-
memory/1556-90-0x00000000009C0000-0x00000000009C1000-memory.dmpFilesize
4KB
-
memory/1556-92-0x0000000075730000-0x00000000757BF000-memory.dmpFilesize
572KB
-
memory/1556-93-0x00000000743C0000-0x0000000074440000-memory.dmpFilesize
512KB
-
memory/1556-103-0x0000000074F00000-0x0000000075090000-memory.dmpFilesize
1.6MB
-
memory/1556-69-0x0000000000000000-mapping.dmp
-
memory/1556-96-0x0000000075140000-0x0000000075157000-memory.dmpFilesize
92KB
-
memory/1556-97-0x0000000075A90000-0x0000000075AC5000-memory.dmpFilesize
212KB
-
memory/1556-73-0x0000000074CD0000-0x0000000074D1A000-memory.dmpFilesize
296KB
-
memory/1632-84-0x0000000000402F47-mapping.dmp
-
memory/1760-55-0x00000000006A8000-0x00000000006B9000-memory.dmpFilesize
68KB
-
memory/1760-59-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/1876-68-0x0000000000400000-0x0000000000491000-memory.dmpFilesize
580KB
-
memory/1876-67-0x00000000002E0000-0x000000000036F000-memory.dmpFilesize
572KB
-
memory/1876-65-0x000000000056B000-0x00000000005BA000-memory.dmpFilesize
316KB
-
memory/1876-63-0x0000000000000000-mapping.dmp
-
memory/1944-105-0x0000000000000000-mapping.dmp
-
memory/1972-78-0x00000000005E8000-0x00000000005F8000-memory.dmpFilesize
64KB
-
memory/1972-61-0x0000000000000000-mapping.dmp