Analysis
- max time kernel
152s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220310-en - submitted
21/03/2022, 16:26
General
- Target 5d5603fa359d5f455b21b38af8dc59c8.exe
- Size 2.5MB
- Sample220321-txja9ahdhl
- SHA256 cecab57f1a85a181d806e2a782a030616f8a23b0f1cb3d2cdc0736c9bf72678a
Malware Config
Extracted
-
smokeloader
-
2020
-
http://moonlightly.xyz/
-
http://aerostraphen.xyz/
Extracted
-
raccoon
-
4b8853263bfbfde368561fd97dd96c93b6b91e4f
-
url4cnc
http://194.180.191.241/capibar
http://103.155.93.35/capibar
https://t.me/capibar
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 6 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
suricata: ET MALWARE Sharik/Smoke CnC Beacon 11
- suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
suricata: ET MALWARE Win32.Raccoon Stealer - Telegram Mirror Checkin (generic)
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 20 IoCs
- Suspicious use of AdjustPrivilegeToken 19 IoCs
- Suspicious use of WriteProcessMemory 39 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d5603fa359d5f455b21b38af8dc59c8.exe"C:\Users\Admin\AppData\Local\Temp\5d5603fa359d5f455b21b38af8dc59c8.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\D1B5.exeC:\Users\Admin\AppData\Local\Temp\D1B5.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\D5CD.exeC:\Users\Admin\AppData\Local\Temp\D5CD.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\tcdbvhwC:\Users\Admin\AppData\Roaming\tcdbvhw1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/968-200-0x0000000000B90000-0x0000000000B96000-memory.dmp
memory/968-201-0x0000000000B80000-0x0000000000B8B000-memory.dmp
memory/1944-219-0x0000000002AE0000-0x0000000002B21000-memory.dmp
memory/1944-218-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/1944-220-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/1944-224-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/1944-223-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/1944-222-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/1944-221-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/2072-194-0x0000000000BB0000-0x0000000000BD2000-memory.dmp
memory/2072-195-0x0000000000B80000-0x0000000000BA7000-memory.dmp
memory/2288-180-0x0000000000130000-0x0000000000139000-memory.dmp
memory/2288-181-0x0000000000120000-0x000000000012F000-memory.dmp
memory/2472-179-0x0000000000690000-0x0000000000C90000-memory.dmp
memory/2472-172-0x00000000011D0000-0x00000000011D2000-memory.dmp
memory/2472-176-0x0000000000690000-0x0000000000C90000-memory.dmp
memory/2472-175-0x0000000000690000-0x0000000000C90000-memory.dmp
memory/2472-174-0x0000000000690000-0x0000000000C90000-memory.dmp
memory/2472-173-0x0000000001350000-0x0000000001397000-memory.dmp
memory/2472-184-0x0000000000690000-0x0000000000C90000-memory.dmp
memory/2472-185-0x0000000002FB0000-0x0000000002FB2000-memory.dmp
memory/3048-151-0x0000000002180000-0x0000000002196000-memory.dmp
memory/3128-187-0x0000000000F70000-0x0000000000F75000-memory.dmp
memory/3128-189-0x0000000000F60000-0x0000000000F69000-memory.dmp
memory/3492-198-0x0000000000530000-0x0000000000539000-memory.dmp
memory/3492-197-0x0000000000540000-0x0000000000545000-memory.dmp
memory/3588-202-0x0000000000750000-0x0000000000757000-memory.dmp
memory/3588-203-0x0000000000740000-0x000000000074D000-memory.dmp
memory/3756-177-0x0000000000590000-0x0000000000597000-memory.dmp
memory/3756-178-0x0000000000580000-0x000000000058B000-memory.dmp
memory/3988-205-0x0000000000470000-0x000000000047B000-memory.dmp
memory/3988-204-0x0000000000480000-0x0000000000488000-memory.dmp
memory/4360-145-0x0000000077360000-0x0000000077503000-memory.dmp
memory/4360-134-0x0000000002BF0000-0x0000000002C31000-memory.dmp
memory/4360-144-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/4360-141-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-142-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-140-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-139-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-143-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-148-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-149-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-150-0x0000000000400000-0x0000000000D5E000-memory.dmp
memory/4360-137-0x0000000000150000-0x0000000000151000-memory.dmp
memory/4508-159-0x0000000000850000-0x000000000096F000-memory.dmp
memory/4508-208-0x0000000006C20000-0x00000000071C4000-memory.dmp
memory/4508-154-0x0000000000850000-0x000000000096F000-memory.dmp
memory/4508-196-0x0000000005A70000-0x0000000005AAC000-memory.dmp
memory/4508-155-0x00000000013E0000-0x00000000013E1000-memory.dmp
memory/4508-190-0x00000000059E0000-0x00000000059F2000-memory.dmp
memory/4508-199-0x000000006D160000-0x000000006D1AC000-memory.dmp
memory/4508-188-0x0000000006050000-0x0000000006668000-memory.dmp
memory/4508-186-0x0000000075F20000-0x00000000764D3000-memory.dmp
memory/4508-183-0x00000000037E0000-0x00000000037E1000-memory.dmp
memory/4508-182-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/4508-165-0x0000000072BB0000-0x0000000072C39000-memory.dmp
memory/4508-164-0x0000000074120000-0x00000000748D0000-memory.dmp
memory/4508-206-0x0000000005D90000-0x0000000005E06000-memory.dmp
memory/4508-207-0x0000000005EB0000-0x0000000005F42000-memory.dmp
memory/4508-193-0x0000000005B40000-0x0000000005C4A000-memory.dmp
memory/4508-209-0x0000000006890000-0x00000000068AE000-memory.dmp
memory/4508-210-0x0000000006960000-0x00000000069C6000-memory.dmp
memory/4508-211-0x0000000007380000-0x00000000073D0000-memory.dmp
memory/4508-212-0x0000000008150000-0x0000000008312000-memory.dmp
memory/4508-213-0x0000000008850000-0x0000000008D7C000-memory.dmp
memory/4508-163-0x0000000000850000-0x000000000096F000-memory.dmp
memory/4508-162-0x0000000000850000-0x000000000096F000-memory.dmp
memory/4508-161-0x0000000001400000-0x0000000001401000-memory.dmp
memory/4508-160-0x0000000000850000-0x000000000096F000-memory.dmp
memory/4508-158-0x0000000002F80000-0x0000000002FC6000-memory.dmp
memory/4508-157-0x0000000076E00000-0x0000000077015000-memory.dmp
memory/4508-156-0x0000000000850000-0x000000000096F000-memory.dmp
memory/4928-191-0x0000000000170000-0x0000000000176000-memory.dmp
memory/4928-192-0x0000000000160000-0x000000000016C000-memory.dmp