Analysis

  • max time kernel
    150s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    15/01/2022, 11:32

General

  • Target

    51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe

  • Size

    312KB

  • MD5

    4f7c4888f8fb1ee61755b77a25d9227c

  • SHA1

    6eba8ea92384ec3c5e6a686b1724647d22bc9a75

  • SHA256

    51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798

  • SHA512

    ced2c90e26727ee6c76c4182426fa230bc04e2ac31af173998acad65f350f51e550b82a6a6ba2c13360a1bf1851cd2e391551083de91cfa8b2b0820705036bca

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

redline

Botnet

noname

C2

185.215.113.29:34865

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 3 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 13 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe
    "C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:2572
    • C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe
      "C:\Users\Admin\AppData\Local\Temp\51976eb945307ca6503706ae06f3f228035d655b7ecf26b9eff0401529cc4798.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2852
  • C:\Users\Admin\AppData\Local\Temp\F80D.exe
    C:\Users\Admin\AppData\Local\Temp\F80D.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:912
  • C:\Users\Admin\AppData\Local\Temp\FEF3.exe
    C:\Users\Admin\AppData\Local\Temp\FEF3.exe
    1⤵
    • Executes dropped EXE
    PID:3340
  • C:\Users\Admin\AppData\Local\Temp\2EC.exe
    C:\Users\Admin\AppData\Local\Temp\2EC.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:652
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\efqqlcqs\
      2⤵
        PID:608
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\ahyhvhar.exe" C:\Windows\SysWOW64\efqqlcqs\
        2⤵
          PID:400
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create efqqlcqs binPath= "C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe /d\"C:\Users\Admin\AppData\Local\Temp\2EC.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1140
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description efqqlcqs "wifi internet conection"
            2⤵
              PID:2528
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start efqqlcqs
              2⤵
                PID:1368
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1816
              • C:\Users\Admin\AppData\Local\Temp\4C2.exe
                C:\Users\Admin\AppData\Local\Temp\4C2.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:3004
                • C:\Users\Admin\AppData\Local\Temp\4C2.exe
                  C:\Users\Admin\AppData\Local\Temp\4C2.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  PID:868
                  • C:\Users\Admin\AppData\Local\Temp\ferrari2.exe
                    "C:\Users\Admin\AppData\Local\Temp\ferrari2.exe"
                    3⤵
                    • Executes dropped EXE
                    • Suspicious use of AdjustPrivilegeToken
                    PID:3232
              • C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe
                C:\Windows\SysWOW64\efqqlcqs\ahyhvhar.exe /d"C:\Users\Admin\AppData\Local\Temp\2EC.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:2168
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:2400
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2568
              • C:\Users\Admin\AppData\Local\Temp\67B3.exe
                C:\Users\Admin\AppData\Local\Temp\67B3.exe
                1⤵
                • Executes dropped EXE
                PID:1220
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1220 -s 884
                  2⤵
                  • Suspicious use of NtCreateProcessExOtherParentProcess
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1760
              • C:\Users\Admin\AppData\Local\Temp\6B2E.exe
                C:\Users\Admin\AppData\Local\Temp\6B2E.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                PID:892
              • C:\Users\Admin\AppData\Local\Temp\710B.exe
                C:\Users\Admin\AppData\Local\Temp\710B.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1016
              • C:\Users\Admin\AppData\Local\Temp\80EB.exe
                C:\Users\Admin\AppData\Local\Temp\80EB.exe
                1⤵
                • Executes dropped EXE
                PID:3008
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 3008 -s 400
                  2⤵
                  • Program crash
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2168
              • C:\Users\Admin\AppData\Local\Temp\8735.exe
                C:\Users\Admin\AppData\Local\Temp\8735.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:2640
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  2⤵
                    PID:948
                • C:\Users\Admin\AppData\Local\Temp\9705.exe
                  C:\Users\Admin\AppData\Local\Temp\9705.exe
                  1⤵
                  • Executes dropped EXE
                  PID:3896
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 400
                    2⤵
                    • Program crash
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2332
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                  • Accesses Microsoft Outlook profiles
                  • outlook_office_path
                  • outlook_win_path
                  PID:3768
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:2212

                  Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/652-144-0x0000000000560000-0x000000000060E000-memory.dmp

                          Filesize

                          696KB

                        • memory/652-145-0x0000000000400000-0x000000000055E000-memory.dmp

                          Filesize

                          1.4MB

                        • memory/868-179-0x0000000005410000-0x00000000054A2000-memory.dmp

                          Filesize

                          584KB

                        • memory/868-158-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/868-168-0x00000000054C0000-0x0000000005AC6000-memory.dmp

                          Filesize

                          6.0MB

                        • memory/868-178-0x00000000052F0000-0x0000000005366000-memory.dmp

                          Filesize

                          472KB

                        • memory/868-181-0x0000000005EB0000-0x0000000005F16000-memory.dmp

                          Filesize

                          408KB

                        • memory/868-177-0x0000000005FD0000-0x00000000064CE000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/868-180-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

                          Filesize

                          120KB

                        • memory/868-175-0x0000000004FD0000-0x000000000501B000-memory.dmp

                          Filesize

                          300KB

                        • memory/868-174-0x0000000004F80000-0x0000000004FBE000-memory.dmp

                          Filesize

                          248KB

                        • memory/868-176-0x0000000004EB0000-0x00000000054B6000-memory.dmp

                          Filesize

                          6.0MB

                        • memory/868-162-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/868-183-0x00000000070A0000-0x00000000075CC000-memory.dmp

                          Filesize

                          5.2MB

                        • memory/868-163-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/868-172-0x0000000005050000-0x000000000515A000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/868-170-0x0000000004F20000-0x0000000004F32000-memory.dmp

                          Filesize

                          72KB

                        • memory/868-182-0x00000000069A0000-0x0000000006B62000-memory.dmp

                          Filesize

                          1.8MB

                        • memory/892-223-0x0000000073D10000-0x0000000073D90000-memory.dmp

                          Filesize

                          512KB

                        • memory/892-219-0x0000000074930000-0x0000000074AF2000-memory.dmp

                          Filesize

                          1.8MB

                        • memory/892-216-0x00000000008E0000-0x0000000000963000-memory.dmp

                          Filesize

                          524KB

                        • memory/892-234-0x0000000076990000-0x0000000077CD8000-memory.dmp

                          Filesize

                          19.3MB

                        • memory/892-215-0x00000000007E0000-0x0000000000825000-memory.dmp

                          Filesize

                          276KB

                        • memory/892-220-0x0000000075440000-0x0000000075531000-memory.dmp

                          Filesize

                          964KB

                        • memory/892-229-0x0000000074DB0000-0x0000000075334000-memory.dmp

                          Filesize

                          5.5MB

                        • memory/892-221-0x00000000008E0000-0x0000000000963000-memory.dmp

                          Filesize

                          524KB

                        • memory/892-218-0x0000000000060000-0x0000000000061000-memory.dmp

                          Filesize

                          4KB

                        • memory/892-222-0x00000000008E0000-0x0000000000963000-memory.dmp

                          Filesize

                          524KB

                        • memory/892-242-0x0000000073B20000-0x0000000073B6B000-memory.dmp

                          Filesize

                          300KB

                        • memory/892-217-0x00000000008E0000-0x0000000000963000-memory.dmp

                          Filesize

                          524KB

                        • memory/892-224-0x00000000052C0000-0x00000000058C6000-memory.dmp

                          Filesize

                          6.0MB

                        • memory/892-225-0x0000000002B50000-0x0000000002B62000-memory.dmp

                          Filesize

                          72KB

                        • memory/892-230-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

                          Filesize

                          4KB

                        • memory/892-227-0x0000000004BD0000-0x0000000004C0E000-memory.dmp

                          Filesize

                          248KB

                        • memory/892-226-0x0000000004DC0000-0x0000000004ECA000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/912-128-0x0000000000400000-0x0000000000452000-memory.dmp

                          Filesize

                          328KB

                        • memory/912-127-0x0000000000460000-0x000000000050E000-memory.dmp

                          Filesize

                          696KB

                        • memory/912-126-0x0000000000460000-0x000000000050E000-memory.dmp

                          Filesize

                          696KB

                        • memory/948-301-0x0000000000400000-0x0000000000420000-memory.dmp

                          Filesize

                          128KB

                        • memory/1220-262-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          Filesize

                          39.8MB

                        • memory/1220-277-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          Filesize

                          39.8MB

                        • memory/1220-239-0x0000000002F00000-0x0000000002FA0000-memory.dmp

                          Filesize

                          640KB

                        • memory/1220-289-0x0000000000400000-0x0000000002BC5000-memory.dmp

                          Filesize

                          39.8MB

                        • memory/1220-248-0x000000000306F000-0x00000000030F0000-memory.dmp

                          Filesize

                          516KB

                        • memory/2168-157-0x0000000000814000-0x0000000000825000-memory.dmp

                          Filesize

                          68KB

                        • memory/2168-171-0x0000000000400000-0x000000000055E000-memory.dmp

                          Filesize

                          1.4MB

                        • memory/2168-169-0x00000000006A0000-0x00000000007EA000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/2400-167-0x0000000002C80000-0x0000000002C81000-memory.dmp

                          Filesize

                          4KB

                        • memory/2400-173-0x0000000002D70000-0x0000000002D85000-memory.dmp

                          Filesize

                          84KB

                        • memory/2400-164-0x0000000002D70000-0x0000000002D85000-memory.dmp

                          Filesize

                          84KB

                        • memory/2400-166-0x0000000002C80000-0x0000000002C81000-memory.dmp

                          Filesize

                          4KB

                        • memory/2568-206-0x0000000002910000-0x0000000002A01000-memory.dmp

                          Filesize

                          964KB

                        • memory/2568-191-0x0000000002910000-0x0000000002A01000-memory.dmp

                          Filesize

                          964KB

                        • memory/2572-118-0x00000000005F0000-0x00000000005F9000-memory.dmp

                          Filesize

                          36KB

                        • memory/2852-116-0x0000000000400000-0x0000000000409000-memory.dmp

                          Filesize

                          36KB

                        • memory/2892-156-0x0000000003260000-0x0000000003276000-memory.dmp

                          Filesize

                          88KB

                        • memory/2892-119-0x0000000000F50000-0x0000000000F66000-memory.dmp

                          Filesize

                          88KB

                        • memory/3004-140-0x0000000000520000-0x00000000005AA000-memory.dmp

                          Filesize

                          552KB

                        • memory/3004-141-0x0000000004DE0000-0x0000000004E56000-memory.dmp

                          Filesize

                          472KB

                        • memory/3004-143-0x0000000004D80000-0x0000000004D9E000-memory.dmp

                          Filesize

                          120KB

                        • memory/3004-146-0x0000000004E60000-0x0000000004E61000-memory.dmp

                          Filesize

                          4KB

                        • memory/3004-147-0x00000000028A0000-0x00000000028A1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3004-150-0x00000000053A0000-0x000000000589E000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/3004-139-0x0000000000520000-0x00000000005AA000-memory.dmp

                          Filesize

                          552KB

                        • memory/3232-189-0x0000000004B50000-0x000000000504E000-memory.dmp

                          Filesize

                          5.0MB

                        • memory/3232-203-0x0000000002370000-0x0000000002371000-memory.dmp

                          Filesize

                          4KB

                        • memory/3232-233-0x0000000006390000-0x00000000063AE000-memory.dmp

                          Filesize

                          120KB

                        • memory/3232-228-0x0000000006200000-0x0000000006276000-memory.dmp

                          Filesize

                          472KB

                        • memory/3232-238-0x00000000067A0000-0x0000000006CCC000-memory.dmp

                          Filesize

                          5.2MB

                        • memory/3232-187-0x00000000008DA000-0x0000000000906000-memory.dmp

                          Filesize

                          176KB

                        • memory/3232-211-0x0000000005B40000-0x0000000005BA6000-memory.dmp

                          Filesize

                          408KB

                        • memory/3232-207-0x0000000002373000-0x0000000002374000-memory.dmp

                          Filesize

                          4KB

                        • memory/3232-237-0x00000000065D0000-0x0000000006792000-memory.dmp

                          Filesize

                          1.8MB

                        • memory/3232-204-0x00000000058A0000-0x00000000058EB000-memory.dmp

                          Filesize

                          300KB

                        • memory/3232-194-0x0000000005050000-0x0000000005656000-memory.dmp

                          Filesize

                          6.0MB

                        • memory/3232-205-0x0000000002372000-0x0000000002373000-memory.dmp

                          Filesize

                          4KB

                        • memory/3232-231-0x00000000062A0000-0x0000000006332000-memory.dmp

                          Filesize

                          584KB

                        • memory/3232-199-0x0000000005700000-0x000000000580A000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/3232-202-0x0000000005850000-0x000000000588E000-memory.dmp

                          Filesize

                          248KB

                        • memory/3232-201-0x0000000002374000-0x0000000002376000-memory.dmp

                          Filesize

                          8KB

                        • memory/3232-200-0x0000000000400000-0x0000000000579000-memory.dmp

                          Filesize

                          1.5MB

                        • memory/3232-198-0x0000000000580000-0x00000000006CA000-memory.dmp

                          Filesize

                          1.3MB

                        • memory/3232-188-0x00000000024F0000-0x0000000002524000-memory.dmp

                          Filesize

                          208KB

                        • memory/3232-190-0x0000000002670000-0x00000000026A2000-memory.dmp

                          Filesize

                          200KB

                        • memory/3232-196-0x00000000056D0000-0x00000000056E2000-memory.dmp

                          Filesize

                          72KB

                        • memory/3340-135-0x0000000000400000-0x000000000055F000-memory.dmp

                          Filesize

                          1.4MB

                        • memory/3340-134-0x00000000006C0000-0x00000000006DC000-memory.dmp

                          Filesize

                          112KB