Analysis
- max time kernel
150s - max time network
139s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
24/01/2023, 22:32
General
- Target file.exe
- Size 201KB
- Sample230124-2fxrbaff6y
- SHA256 fd81eb4c53e788ac14584f8fd628304c710db8f5cfe22a99aa4876f19d9858bf
Malware Config
Extracted
-
raccoon
-
e79a2ad5e7d3c239b7fbf8a6b92ae32f
-
http://193.149.189.174/
-
http://193.149.185.159/
Signatures
- Detects Smokeloader packer 1 IoCs
- Raccoon
Raccoon is an infostealer written in C++ and first seen in 2019.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\884A.exeC:\Users\Admin\AppData\Local\Temp\884A.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
sqlite3.dll
884A.exe
884A.exe
memory/2836-139-0x0000000000400000-0x0000000000E65000-memory.dmp
memory/2836-144-0x0000000000400000-0x0000000000E65000-memory.dmp
memory/4956-132-0x0000000002E5D000-0x0000000002E70000-memory.dmp
memory/4956-133-0x0000000002DF0000-0x0000000002DF9000-memory.dmp
memory/4956-134-0x0000000000400000-0x0000000002B9D000-memory.dmp
memory/4956-135-0x0000000000400000-0x0000000002B9D000-memory.dmp