Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
08/12/2021, 00:14
Static task
static1
Behavioral task
behavioral1
Sample
5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe
Resource
win10-en-20211014
General
-
Target
5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe
-
Size
242KB
-
MD5
09b5b0a7b9cc8ee3c0bef59dc3efeb12
-
SHA1
f0a81ebac233bda1421f490e4bfb8838cf7dbb4f
-
SHA256
5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69
-
SHA512
d5e8444f46da02db5aafabc86e19cb6bd2a313a501b4704d2ac10831d9359b2f638612810722dc67a0d3eb668f8907b46fa852042ea27e096d83dbfaabe09df9
Malware Config
Extracted
smokeloader
2020
http://host-data-coin-11.com/
http://file-coin-host-12.com/
Extracted
raccoon
1.8.3-hotfix
f797145799b7b1b77b35d81de942eee0908da519
-
url4cnc
http://91.219.236.27/capibar
http://94.158.245.167/capibar
http://185.163.204.216/capibar
http://185.225.19.238/capibar
http://185.163.204.218/capibar
https://t.me/capibar
Extracted
amadey
2.86
185.215.113.35/d2VxjasuwS/index.php
Extracted
raccoon
1.8.3-hotfix
fd4f23250443a724a3d1548e6ab07c481dfc2814
-
url4cnc
http://91.219.236.27/duglassa1
http://94.158.245.167/duglassa1
http://185.163.204.216/duglassa1
http://185.225.19.238/duglassa1
http://185.163.204.218/duglassa1
https://t.me/duglassa1
Signatures
-
Bazar Loader
Detected loader normally used to deploy BazarBackdoor malware.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/2552-136-0x0000000000890000-0x00000000008F9000-memory.dmp family_redline behavioral1/memory/2276-161-0x0000000000FD0000-0x0000000001082000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Bazar/Team9 Loader payload 1 IoCs
resource yara_rule behavioral1/memory/1200-212-0x0000000002B40000-0x0000000002B80000-memory.dmp BazarLoaderVar5 -
Downloads MZ/PE file
-
Executes dropped EXE 9 IoCs
pid Process 2068 48EC.exe 676 48EC.exe 2720 BE0D.exe 2552 C0CD.exe 2276 616.exe 2004 146F.exe 3532 2DF3.exe 3128 tkools.exe 1952 tkools.exe -
Deletes itself 1 IoCs
pid Process 2800 Process not Found -
Loads dropped DLL 1 IoCs
pid Process 1200 regsvr32.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2552 C0CD.exe 2276 616.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4056 set thread context of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 2068 set thread context of 676 2068 48EC.exe 71 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 48EC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 48EC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 48EC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 732 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1148 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 1148 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found 2800 Process not Found -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2800 Process not Found -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1148 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 676 48EC.exe -
Suspicious use of AdjustPrivilegeToken 26 IoCs
description pid Process Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found Token: SeShutdownPrivilege 2800 Process not Found Token: SeCreatePagefilePrivilege 2800 Process not Found -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4056 wrote to memory of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 4056 wrote to memory of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 4056 wrote to memory of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 4056 wrote to memory of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 4056 wrote to memory of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 4056 wrote to memory of 1148 4056 5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe 68 PID 2800 wrote to memory of 2068 2800 Process not Found 70 PID 2800 wrote to memory of 2068 2800 Process not Found 70 PID 2800 wrote to memory of 2068 2800 Process not Found 70 PID 2068 wrote to memory of 676 2068 48EC.exe 71 PID 2068 wrote to memory of 676 2068 48EC.exe 71 PID 2068 wrote to memory of 676 2068 48EC.exe 71 PID 2068 wrote to memory of 676 2068 48EC.exe 71 PID 2068 wrote to memory of 676 2068 48EC.exe 71 PID 2068 wrote to memory of 676 2068 48EC.exe 71 PID 2800 wrote to memory of 2720 2800 Process not Found 72 PID 2800 wrote to memory of 2720 2800 Process not Found 72 PID 2800 wrote to memory of 2720 2800 Process not Found 72 PID 2800 wrote to memory of 2552 2800 Process not Found 73 PID 2800 wrote to memory of 2552 2800 Process not Found 73 PID 2800 wrote to memory of 2552 2800 Process not Found 73 PID 2800 wrote to memory of 1200 2800 Process not Found 76 PID 2800 wrote to memory of 1200 2800 Process not Found 76 PID 2800 wrote to memory of 2276 2800 Process not Found 77 PID 2800 wrote to memory of 2276 2800 Process not Found 77 PID 2800 wrote to memory of 2276 2800 Process not Found 77 PID 2800 wrote to memory of 2004 2800 Process not Found 78 PID 2800 wrote to memory of 2004 2800 Process not Found 78 PID 2800 wrote to memory of 2004 2800 Process not Found 78 PID 2004 wrote to memory of 3548 2004 146F.exe 79 PID 2004 wrote to memory of 3548 2004 146F.exe 79 PID 2004 wrote to memory of 3548 2004 146F.exe 79 PID 3548 wrote to memory of 2940 3548 cmd.exe 81 PID 3548 wrote to memory of 2940 3548 cmd.exe 81 PID 3548 wrote to memory of 2940 3548 cmd.exe 81 PID 3548 wrote to memory of 3468 3548 cmd.exe 82 PID 3548 wrote to memory of 3468 3548 cmd.exe 82 PID 3548 wrote to memory of 3468 3548 cmd.exe 82 PID 2004 wrote to memory of 2384 2004 146F.exe 83 PID 2004 wrote to memory of 2384 2004 146F.exe 83 PID 2004 wrote to memory of 2384 2004 146F.exe 83 PID 2384 wrote to memory of 3400 2384 cmd.exe 85 PID 2384 wrote to memory of 3400 2384 cmd.exe 85 PID 2384 wrote to memory of 3400 2384 cmd.exe 85 PID 2004 wrote to memory of 2428 2004 146F.exe 86 PID 2004 wrote to memory of 2428 2004 146F.exe 86 PID 2004 wrote to memory of 2428 2004 146F.exe 86 PID 2428 wrote to memory of 2840 2428 cmd.exe 88 PID 2428 wrote to memory of 2840 2428 cmd.exe 88 PID 2428 wrote to memory of 2840 2428 cmd.exe 88 PID 2428 wrote to memory of 3524 2428 cmd.exe 89 PID 2428 wrote to memory of 3524 2428 cmd.exe 89 PID 2428 wrote to memory of 3524 2428 cmd.exe 89 PID 2800 wrote to memory of 3532 2800 Process not Found 90 PID 2800 wrote to memory of 3532 2800 Process not Found 90 PID 2800 wrote to memory of 3532 2800 Process not Found 90 PID 2004 wrote to memory of 3492 2004 146F.exe 91 PID 2004 wrote to memory of 3492 2004 146F.exe 91 PID 2004 wrote to memory of 3492 2004 146F.exe 91 PID 2004 wrote to memory of 3128 2004 146F.exe 92 PID 2004 wrote to memory of 3128 2004 146F.exe 92 PID 2004 wrote to memory of 3128 2004 146F.exe 92 PID 3492 wrote to memory of 2064 3492 cmd.exe 94 PID 3492 wrote to memory of 2064 3492 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe"C:\Users\Admin\AppData\Local\Temp\5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4056 -
C:\Users\Admin\AppData\Local\Temp\5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe"C:\Users\Admin\AppData\Local\Temp\5ad77e2c0157b1d07fbee143775c4e0ab30a0a8982e2ded212403beaad3f4f69.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\48EC.exeC:\Users\Admin\AppData\Local\Temp\48EC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Users\Admin\AppData\Local\Temp\48EC.exeC:\Users\Admin\AppData\Local\Temp\48EC.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:676
-
-
C:\Users\Admin\AppData\Local\Temp\BE0D.exeC:\Users\Admin\AppData\Local\Temp\BE0D.exe1⤵
- Executes dropped EXE
PID:2720
-
C:\Users\Admin\AppData\Local\Temp\C0CD.exeC:\Users\Admin\AppData\Local\Temp\C0CD.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2552
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\21D.dll1⤵
- Loads dropped DLL
PID:1200
-
C:\Users\Admin\AppData\Local\Temp\616.exeC:\Users\Admin\AppData\Local\Temp\616.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:2276
-
C:\Users\Admin\AppData\Local\Temp\146F.exeC:\Users\Admin\AppData\Local\Temp\146F.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"2⤵
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2940
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:N"3⤵PID:3468
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E2⤵
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /P "Admin:R" /E3⤵PID:3400
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c echo Y|CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"2⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"3⤵PID:2840
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:N"3⤵PID:3524
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c CACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E2⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\cacls.exeCACLS "C:\Users\Admin\AppData\Local\Temp\60bb09348e" /P "Admin:R" /E3⤵PID:2064
-
-
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"2⤵
- Executes dropped EXE
PID:3128 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\3⤵PID:1320
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\4⤵PID:2744
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F3⤵
- Creates scheduled task(s)
PID:732
-
-
-
C:\Users\Admin\AppData\Local\Temp\2DF3.exeC:\Users\Admin\AppData\Local\Temp\2DF3.exe1⤵
- Executes dropped EXE
PID:3532
-
C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exeC:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe1⤵
- Executes dropped EXE
PID:1952