Analysis

  • max time kernel
    135s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    17/01/2022, 11:11

General

  • Target

    d08f0d2e9cdd8238fabd8a99cc802c83.exe

  • Size

    333KB

  • MD5

    d08f0d2e9cdd8238fabd8a99cc802c83

  • SHA1

    e770ae3bc340e120c5e0bfab76d792c28e873c24

  • SHA256

    fb78e43ae17426eb0f2066a30e1eff92116eff495f10f1789f1f69fab3c377c0

  • SHA512

    3c8fcbfc8f6fede411bffa07069a1a09c2e8289a63e0ec0b3cc8e9defc803bc0415f197ee7cd671d183977eeed921cf991c6767c14f16d063f69b4739774c1bb

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://host-data-coin-11.com/

http://file-coin-host-12.com/

http://srtuiyhuali.at/

http://fufuiloirtu.com/

http://amogohuigotuli.at/

http://novohudosovu.com/

http://brutuilionust.com/

http://bubushkalioua.com/

http://dumuilistrati.at/

http://verboliatsiaeeees.com/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

arkei

Botnet

Default

C2

http://file-file-host4.com/tratata.php

Extracted

Family

tofsee

C2

patmushta.info

parubey.info

Extracted

Family

raccoon

Version

1.8.4-hotfixs

rc4.plain

Signatures

  • Arkei

    Arkei is an infostealer written in C++.

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • Windows security bypass 2 TTPs
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • Arkei Stealer Payload 2 IoCs
  • XMRig Miner Payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Modifies Windows Firewall 1 TTPs
  • Sets service image path in registry 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Modifies data under HKEY_USERS 15 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d08f0d2e9cdd8238fabd8a99cc802c83.exe
    "C:\Users\Admin\AppData\Local\Temp\d08f0d2e9cdd8238fabd8a99cc802c83.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1144
    • C:\Users\Admin\AppData\Local\Temp\d08f0d2e9cdd8238fabd8a99cc802c83.exe
      "C:\Users\Admin\AppData\Local\Temp\d08f0d2e9cdd8238fabd8a99cc802c83.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1404
  • C:\Users\Admin\AppData\Local\Temp\2443.exe
    C:\Users\Admin\AppData\Local\Temp\2443.exe
    1⤵
    • Executes dropped EXE
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:536
  • C:\Users\Admin\AppData\Local\Temp\4993.exe
    C:\Users\Admin\AppData\Local\Temp\4993.exe
    1⤵
    • Executes dropped EXE
    PID:704
  • C:\Users\Admin\AppData\Local\Temp\5113.exe
    C:\Users\Admin\AppData\Local\Temp\5113.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\rlzrtcuq\
      2⤵
        PID:1864
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\wqoijygv.exe" C:\Windows\SysWOW64\rlzrtcuq\
        2⤵
          PID:1108
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create rlzrtcuq binPath= "C:\Windows\SysWOW64\rlzrtcuq\wqoijygv.exe /d\"C:\Users\Admin\AppData\Local\Temp\5113.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1508
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description rlzrtcuq "wifi internet conection"
            2⤵
              PID:1336
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start rlzrtcuq
              2⤵
                PID:1468
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1048
              • C:\Users\Admin\AppData\Local\Temp\55F4.exe
                C:\Users\Admin\AppData\Local\Temp\55F4.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of WriteProcessMemory
                PID:1700
                • C:\Users\Admin\AppData\Local\Temp\55F4.exe
                  C:\Users\Admin\AppData\Local\Temp\55F4.exe
                  2⤵
                  • Executes dropped EXE
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1772
              • C:\Windows\SysWOW64\rlzrtcuq\wqoijygv.exe
                C:\Windows\SysWOW64\rlzrtcuq\wqoijygv.exe /d"C:\Users\Admin\AppData\Local\Temp\5113.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1480
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:688
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1668
              • C:\Users\Admin\AppData\Local\Temp\BBAD.exe
                C:\Users\Admin\AppData\Local\Temp\BBAD.exe
                1⤵
                • Executes dropped EXE
                PID:2032
              • C:\Users\Admin\AppData\Local\Temp\C060.exe
                C:\Users\Admin\AppData\Local\Temp\C060.exe
                1⤵
                • Executes dropped EXE
                PID:1736
              • C:\Users\Admin\AppData\Local\Temp\D8E0.exe
                C:\Users\Admin\AppData\Local\Temp\D8E0.exe
                1⤵
                • Executes dropped EXE
                PID:2012
              • C:\Users\Admin\AppData\Local\Temp\E7BF.exe
                C:\Users\Admin\AppData\Local\Temp\E7BF.exe
                1⤵
                • Executes dropped EXE
                PID:1744
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  #cmd
                  2⤵
                  • Checks processor information in registry
                  • Suspicious use of AdjustPrivilegeToken
                  PID:1096
              • C:\Users\Admin\AppData\Local\Temp\142D.exe
                C:\Users\Admin\AppData\Local\Temp\142D.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Suspicious use of AdjustPrivilegeToken
                PID:396
                • C:\Windows\system32\cmd.exe
                  "cmd" /c schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
                  2⤵
                    PID:2064
                    • C:\Windows\system32\schtasks.exe
                      schtasks /create /f /sc onlogon /rl highest /tn "services" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
                      3⤵
                      • Creates scheduled task(s)
                      PID:2096
                  • C:\Windows\system32\cmd.exe
                    "cmd" cmd /c "C:\Users\Admin\AppData\Roaming\Microsoft\services.exe"
                    2⤵
                      PID:2300
                      • C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
                        C:\Users\Admin\AppData\Roaming\Microsoft\services.exe
                        3⤵
                          PID:2332
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                      • Accesses Microsoft Outlook profiles
                      • outlook_office_path
                      • outlook_win_path
                      PID:1720
                    • C:\Windows\explorer.exe
                      C:\Windows\explorer.exe
                      1⤵
                        PID:1408
                      • C:\Users\Admin\AppData\Local\Temp\2F2D.exe
                        C:\Users\Admin\AppData\Local\Temp\2F2D.exe
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of NtSetInformationThreadHideFromDebugger
                        PID:1604

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • memory/396-176-0x0000000023020000-0x0000000023022000-memory.dmp

                              Filesize

                              8KB

                            • memory/396-169-0x000000013FEF0000-0x000000014081E000-memory.dmp

                              Filesize

                              9.2MB

                            • memory/396-170-0x000000013FEF0000-0x000000014081E000-memory.dmp

                              Filesize

                              9.2MB

                            • memory/536-111-0x0000000000400000-0x0000000000452000-memory.dmp

                              Filesize

                              328KB

                            • memory/536-110-0x00000000001C0000-0x00000000001C9000-memory.dmp

                              Filesize

                              36KB

                            • memory/536-109-0x00000000001B0000-0x00000000001B9000-memory.dmp

                              Filesize

                              36KB

                            • memory/688-92-0x00000000000C0000-0x00000000000D5000-memory.dmp

                              Filesize

                              84KB

                            • memory/688-91-0x00000000000C0000-0x00000000000D5000-memory.dmp

                              Filesize

                              84KB

                            • memory/704-68-0x0000000000400000-0x00000000005DC000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/704-67-0x0000000000220000-0x000000000023C000-memory.dmp

                              Filesize

                              112KB

                            • memory/704-64-0x000000000077B000-0x000000000078C000-memory.dmp

                              Filesize

                              68KB

                            • memory/1096-173-0x0000000000400000-0x000000000046C000-memory.dmp

                              Filesize

                              432KB

                            • memory/1096-175-0x0000000000520000-0x0000000000521000-memory.dmp

                              Filesize

                              4KB

                            • memory/1096-174-0x0000000000400000-0x000000000046C000-memory.dmp

                              Filesize

                              432KB

                            • memory/1144-54-0x00000000002AB000-0x00000000002BC000-memory.dmp

                              Filesize

                              68KB

                            • memory/1144-58-0x00000000001B0000-0x00000000001B9000-memory.dmp

                              Filesize

                              36KB

                            • memory/1404-57-0x0000000074F01000-0x0000000074F03000-memory.dmp

                              Filesize

                              8KB

                            • memory/1404-55-0x0000000000400000-0x0000000000409000-memory.dmp

                              Filesize

                              36KB

                            • memory/1408-147-0x0000000000060000-0x000000000006C000-memory.dmp

                              Filesize

                              48KB

                            • memory/1408-145-0x0000000000070000-0x0000000000077000-memory.dmp

                              Filesize

                              28KB

                            • memory/1412-113-0x0000000003980000-0x0000000003996000-memory.dmp

                              Filesize

                              88KB

                            • memory/1412-59-0x0000000002170000-0x0000000002186000-memory.dmp

                              Filesize

                              88KB

                            • memory/1480-95-0x0000000000400000-0x00000000005DB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1480-88-0x000000000072B000-0x000000000073C000-memory.dmp

                              Filesize

                              68KB

                            • memory/1604-160-0x0000000074EA0000-0x0000000074EF7000-memory.dmp

                              Filesize

                              348KB

                            • memory/1604-189-0x0000000071830000-0x00000000719C0000-memory.dmp

                              Filesize

                              1.6MB

                            • memory/1604-179-0x0000000076450000-0x0000000076485000-memory.dmp

                              Filesize

                              212KB

                            • memory/1604-177-0x00000000745E0000-0x00000000745F7000-memory.dmp

                              Filesize

                              92KB

                            • memory/1604-167-0x0000000074F00000-0x0000000075B4A000-memory.dmp

                              Filesize

                              12.3MB

                            • memory/1604-168-0x0000000005300000-0x0000000005301000-memory.dmp

                              Filesize

                              4KB

                            • memory/1604-166-0x0000000074330000-0x00000000743B0000-memory.dmp

                              Filesize

                              512KB

                            • memory/1604-165-0x0000000076CB0000-0x0000000076D3F000-memory.dmp

                              Filesize

                              572KB

                            • memory/1604-164-0x00000000003E0000-0x000000000051A000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/1604-163-0x00000000003E0000-0x000000000051A000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/1604-162-0x0000000075B50000-0x0000000075CAC000-memory.dmp

                              Filesize

                              1.4MB

                            • memory/1604-159-0x0000000074E50000-0x0000000074E97000-memory.dmp

                              Filesize

                              284KB

                            • memory/1604-158-0x0000000076490000-0x000000007653C000-memory.dmp

                              Filesize

                              688KB

                            • memory/1604-156-0x00000000001C0000-0x00000000001C1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1604-155-0x00000000003E0000-0x000000000051A000-memory.dmp

                              Filesize

                              1.2MB

                            • memory/1604-154-0x0000000074910000-0x000000007495A000-memory.dmp

                              Filesize

                              296KB

                            • memory/1604-153-0x0000000000250000-0x0000000000294000-memory.dmp

                              Filesize

                              272KB

                            • memory/1660-75-0x00000000002B0000-0x00000000002C3000-memory.dmp

                              Filesize

                              76KB

                            • memory/1660-76-0x0000000000400000-0x00000000005DB000-memory.dmp

                              Filesize

                              1.9MB

                            • memory/1660-69-0x000000000067B000-0x000000000068C000-memory.dmp

                              Filesize

                              68KB

                            • memory/1668-134-0x0000000000260000-0x0000000000351000-memory.dmp

                              Filesize

                              964KB

                            • memory/1668-133-0x0000000000260000-0x0000000000351000-memory.dmp

                              Filesize

                              964KB

                            • memory/1700-89-0x0000000000270000-0x0000000000271000-memory.dmp

                              Filesize

                              4KB

                            • memory/1700-78-0x0000000000820000-0x00000000008AA000-memory.dmp

                              Filesize

                              552KB

                            • memory/1700-79-0x0000000000820000-0x00000000008AA000-memory.dmp

                              Filesize

                              552KB

                            • memory/1700-86-0x00000000009A0000-0x00000000009A1000-memory.dmp

                              Filesize

                              4KB

                            • memory/1720-144-0x0000000071141000-0x0000000071143000-memory.dmp

                              Filesize

                              8KB

                            • memory/1720-146-0x0000000000180000-0x00000000001F4000-memory.dmp

                              Filesize

                              464KB

                            • memory/1720-148-0x0000000000110000-0x000000000017B000-memory.dmp

                              Filesize

                              428KB

                            • memory/1736-119-0x0000000000220000-0x00000000002A0000-memory.dmp

                              Filesize

                              512KB

                            • memory/1736-186-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/1736-132-0x0000000004550000-0x00000000045E2000-memory.dmp

                              Filesize

                              584KB

                            • memory/1736-188-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/1736-135-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/1736-130-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/1736-131-0x00000000044E0000-0x0000000004548000-memory.dmp

                              Filesize

                              416KB

                            • memory/1772-103-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/1772-100-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/1772-101-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/1772-112-0x0000000000430000-0x0000000000431000-memory.dmp

                              Filesize

                              4KB

                            • memory/1772-104-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/1772-102-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/1772-108-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/1772-107-0x0000000000400000-0x0000000000420000-memory.dmp

                              Filesize

                              128KB

                            • memory/2012-124-0x0000000000290000-0x00000000002F0000-memory.dmp

                              Filesize

                              384KB

                            • memory/2032-121-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/2032-182-0x00000000003A0000-0x00000000003EF000-memory.dmp

                              Filesize

                              316KB

                            • memory/2032-183-0x0000000004700000-0x0000000004791000-memory.dmp

                              Filesize

                              580KB

                            • memory/2032-181-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/2032-185-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB

                            • memory/2032-116-0x0000000000220000-0x00000000002A0000-memory.dmp

                              Filesize

                              512KB

                            • memory/2032-120-0x0000000002BD0000-0x0000000002C75000-memory.dmp

                              Filesize

                              660KB

                            • memory/2032-171-0x0000000000400000-0x0000000002BC5000-memory.dmp

                              Filesize

                              39.8MB