Analysis

  • max time kernel
    0s
  • max time network
    150s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    30-12-2023 00:25

General

  • Target

    087f267a177c35b5d313efa4b9013c14.exe

  • Size

    3.8MB

  • MD5

    087f267a177c35b5d313efa4b9013c14

  • SHA1

    052ac70eb05ae560a882a3f97e73c80be01734e6

  • SHA256

    b8338eda2c7390860da3bd4a37104b409235131406d9b4d30a78b5d4189cf317

  • SHA512

    f13a98b4b2a3cc9e146ec6b58ba844d192962ea443a93f0f0237204818c7de3d4f6538fd40be7a72a53c7efc59c91a80a89539a6b92f4a448358c823b87393a1

  • SSDEEP

    98304:Ub/fEIQBU9HIJ08yFximXbXVdJw1mLPUZ4ygx2EjufjKWtK:UbfEIvdIJ0/xHXDHJwSsZ3rEAjKx

Malware Config

Extracted

Family

ffdroider

C2

http://128.1.32.84

Extracted

Family

smokeloader

Botnet

pub2

Extracted

Family

smokeloader

Version

2020

C2

http://conceitosseg.com/upload/

http://integrasidata.com/upload/

http://ozentekstil.com/upload/

http://finbelportal.com/upload/

http://telanganadigital.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

92.119.112.202:13340

Signatures

  • FFDroider

    Stealer targeting social media platform users first seen in April 2022.

  • FFDroider payload 2 IoCs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • SectopRAT

    SectopRAT is a remote access trojan first seen in November 2019.

  • SectopRAT payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
  • Executes dropped EXE 9 IoCs
  • Loads dropped DLL 29 IoCs
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 1 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 23 IoCs
  • Modifies registry class 8 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
      PID:488
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k SystemNetworkService
        2⤵
        • Modifies registry class
        PID:1736
      • C:\Windows\system32\svchost.exe
        C:\Windows\system32\svchost.exe -k netsvcs
        2⤵
        • Suspicious use of NtCreateUserProcessOtherParentProcess
        • Suspicious use of SetThreadContext
        • Modifies registry class
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:844
        • C:\Windows\system32\taskeng.exe
          taskeng.exe {408D0E14-3EE7-45E0-A99C-D9EE5177610F} S-1-5-21-3818056530-936619650-3554021955-1000:SFVRQGEO\Admin:Interactive:[1]
          3⤵
            PID:2096
            • C:\Users\Admin\AppData\Roaming\gcbjcgu
              C:\Users\Admin\AppData\Roaming\gcbjcgu
              4⤵
                PID:2948
            • C:\Windows\system32\wbem\WMIADAP.EXE
              wmiadap.exe /F /T /R
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of WriteProcessMemory
              PID:1284
        • C:\Users\Admin\AppData\Local\Temp\087f267a177c35b5d313efa4b9013c14.exe
          "C:\Users\Admin\AppData\Local\Temp\087f267a177c35b5d313efa4b9013c14.exe"
          1⤵
          • Loads dropped DLL
          • Checks whether UAC is enabled
          • Suspicious use of WriteProcessMemory
          PID:1056
          • C:\Users\Admin\AppData\Local\Temp\xtect20.exe
            "C:\Users\Admin\AppData\Local\Temp\xtect20.exe"
            2⤵
              PID:696
            • C:\Users\Admin\AppData\Local\Temp\pub2.exe
              "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
              2⤵
                PID:3068
              • C:\Users\Admin\AppData\Local\Temp\Install.exe
                "C:\Users\Admin\AppData\Local\Temp\Install.exe"
                2⤵
                  PID:1440
                  • C:\Windows\SysWOW64\cmd.exe
                    cmd.exe /c taskkill /f /im chrome.exe
                    3⤵
                      PID:1772
                  • C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe
                    "C:\Users\Admin\AppData\Local\Temp\md9_1sjm.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1472
                  • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                    "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:324
                  • C:\Users\Admin\AppData\Local\Temp\Files.exe
                    "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:2008
                  • C:\Users\Admin\AppData\Local\Temp\BearVpn_3.exe
                    "C:\Users\Admin\AppData\Local\Temp\BearVpn_3.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1944
                  • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                    "C:\Users\Admin\AppData\Local\Temp\Folder.exe"
                    2⤵
                    • Executes dropped EXE
                    • Loads dropped DLL
                    • Suspicious use of WriteProcessMemory
                    PID:2908
                  • C:\Users\Admin\AppData\Local\Temp\Fille.exe
                    "C:\Users\Admin\AppData\Local\Temp\Fille.exe"
                    2⤵
                    • Executes dropped EXE
                    • Suspicious use of WriteProcessMemory
                    PID:2480
                • C:\Windows\system32\rUNdlL32.eXe
                  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                  1⤵
                  • Process spawned unexpected child process
                  • Suspicious use of WriteProcessMemory
                  PID:2884
                  • C:\Windows\SysWOW64\rundll32.exe
                    rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
                    2⤵
                    • Loads dropped DLL
                    • Modifies registry class
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious use of WriteProcessMemory
                    PID:624
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1472 -s 184
                  1⤵
                  • Program crash
                  PID:1668
                • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mantenere.exe.com
                  C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mantenere.exe.com k
                  1⤵
                  • Executes dropped EXE
                  PID:1296
                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
                    C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\RegAsm.exe
                    2⤵
                      PID:2620
                  • C:\Windows\SysWOW64\PING.EXE
                    ping 127.0.0.1 -n 30
                    1⤵
                    • Runs ping.exe
                    PID:1420
                  • C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Mantenere.exe.com
                    Mantenere.exe.com k
                    1⤵
                      PID:1284
                    • C:\Windows\SysWOW64\findstr.exe
                      findstr /V /R "^lmesxrORijUjeOjnoLtleIpFEzCCKScCJihKoesqpDBLYVUYVpGiCQFBdvNwBjigQsDUABfuxtqninHJmDGAjhqSBLxMfdnXvjUGsqbxTANbPixRPrCXGGeDdLaPiD$" Piramide.ini
                      1⤵
                        PID:2488
                      • C:\Windows\SysWOW64\cmd.exe
                        cmd
                        1⤵
                        • Loads dropped DLL
                        • Suspicious use of WriteProcessMemory
                        PID:1052
                      • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                        "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2772 CREDAT:275457 /prefetch:2
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of SetWindowsHookEx
                        PID:2112
                      • C:\Windows\SysWOW64\cmd.exe
                        "C:\Windows\System32\cmd.exe" /c cmd < Crescente.ini
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:2968
                      • C:\Program Files\Internet Explorer\iexplore.exe
                        "C:\Program Files\Internet Explorer\iexplore.exe" -Embedding
                        1⤵
                        • Modifies Internet Explorer settings
                        • Suspicious use of FindShellTrayWindow
                        • Suspicious use of SetWindowsHookEx
                        • Suspicious use of WriteProcessMemory
                        PID:2772
                      • C:\Users\Admin\AppData\Local\Temp\Folder.exe
                        "C:\Users\Admin\AppData\Local\Temp\Folder.exe" -a
                        1⤵
                        • Executes dropped EXE
                        PID:2780
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /f /im chrome.exe
                        1⤵
                        • Kills process with taskkill
                        PID:360

                      Network

                      MITRE ATT&CK Enterprise v15

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • C:\Users\Admin\AppData\Local\Temp\Fille.exe

                        Filesize

                        92KB

                        MD5

                        ed05149204ae4fef93d2f49ebbb80d8c

                        SHA1

                        8858a7ad731e2253d90983957daeb95906da3e1b

                        SHA256

                        ccc997bc7e99c67f1cde9da1e0df49d3459e2a83bf128c7be60a2b33092fe9eb

                        SHA512

                        eddfbb2a600409deb77cab48ed74b7fcefbeccaf3e7a872966261f8b8461370c059287dc44872f0ed28a8d2823856ec7c68f683dcd3d8f8d04e3219c658d7cb8

                      • \Users\Admin\AppData\Local\Temp\Fille.exe

                        Filesize

                        1.1MB

                        MD5

                        e35987fd2d4cd3ff879d467319e43709

                        SHA1

                        f55a7b78b464043abfb153e7f6d2d0688b78b261

                        SHA256

                        4ca6fef9e1702bbe7f84460fb9bb7cbd2085553b7fa489936e145291846175c8

                        SHA512

                        fee1fd18f42956b48f033cbcc8183c5893b9ec1a458165d585ef32e3c258f13739f74ddd3e6cf58ac200cbc1fca3fded71bf97692b9179396b2aab51a14f7b63

                      • \Users\Admin\AppData\Local\Temp\Fille.exe

                        Filesize

                        894KB

                        MD5

                        4067d96df16fb57b6dad87964b8b9903

                        SHA1

                        20d46f809429fa984e3dc1b8e05433d076d806dd

                        SHA256

                        d4accaead4a9c4d1579fa740f928848f33eba86e49608bd430c8ec5a958a0e4f

                        SHA512

                        9b7931a3156b1f940b12e991b223c94cc3dc120eb314cdd25f5da3d6379de231d781e6f483897d6ead457ef318c6a2fca09615fdf093d0410ccaf334b5325313

                      • memory/324-186-0x0000000000340000-0x0000000000346000-memory.dmp

                        Filesize

                        24KB

                      • memory/324-196-0x0000000000350000-0x0000000000356000-memory.dmp

                        Filesize

                        24KB

                      • memory/324-198-0x000007FEF5B90000-0x000007FEF657C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/324-195-0x00000000005A0000-0x00000000005C6000-memory.dmp

                        Filesize

                        152KB

                      • memory/324-200-0x000000001AB80000-0x000000001AC00000-memory.dmp

                        Filesize

                        512KB

                      • memory/324-155-0x0000000000360000-0x0000000000392000-memory.dmp

                        Filesize

                        200KB

                      • memory/324-460-0x000007FEF5B90000-0x000007FEF657C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/624-98-0x0000000000580000-0x00000000005DD000-memory.dmp

                        Filesize

                        372KB

                      • memory/624-92-0x0000000000580000-0x00000000005DD000-memory.dmp

                        Filesize

                        372KB

                      • memory/624-86-0x00000000003F0000-0x00000000004F1000-memory.dmp

                        Filesize

                        1.0MB

                      • memory/844-202-0x0000000000CA0000-0x0000000000D11000-memory.dmp

                        Filesize

                        452KB

                      • memory/844-94-0x0000000000CA0000-0x0000000000D11000-memory.dmp

                        Filesize

                        452KB

                      • memory/844-93-0x0000000000220000-0x000000000026C000-memory.dmp

                        Filesize

                        304KB

                      • memory/844-87-0x0000000000220000-0x000000000026C000-memory.dmp

                        Filesize

                        304KB

                      • memory/1056-71-0x0000000003380000-0x0000000003382000-memory.dmp

                        Filesize

                        8KB

                      • memory/1056-153-0x0000000003CB0000-0x0000000003EEB000-memory.dmp

                        Filesize

                        2.2MB

                      • memory/1056-150-0x0000000003CB0000-0x0000000003EEB000-memory.dmp

                        Filesize

                        2.2MB

                      • memory/1056-149-0x0000000003CB0000-0x0000000003EEB000-memory.dmp

                        Filesize

                        2.2MB

                      • memory/1200-1054-0x0000000004190000-0x00000000041A5000-memory.dmp

                        Filesize

                        84KB

                      • memory/1200-587-0x0000000004060000-0x0000000004075000-memory.dmp

                        Filesize

                        84KB

                      • memory/1296-982-0x0000000000110000-0x0000000000111000-memory.dmp

                        Filesize

                        4KB

                      • memory/1472-152-0x0000000000400000-0x000000000063B000-memory.dmp

                        Filesize

                        2.2MB

                      • memory/1472-199-0x0000000000400000-0x000000000063B000-memory.dmp

                        Filesize

                        2.2MB

                      • memory/1736-231-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1736-1513-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1736-1634-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1736-1058-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1736-97-0x0000000000060000-0x00000000000AC000-memory.dmp

                        Filesize

                        304KB

                      • memory/1736-1632-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1736-100-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1736-1022-0x00000000004F0000-0x0000000000561000-memory.dmp

                        Filesize

                        452KB

                      • memory/1944-201-0x000000001B020000-0x000000001B0A0000-memory.dmp

                        Filesize

                        512KB

                      • memory/1944-1039-0x000007FEF5B90000-0x000007FEF657C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1944-197-0x000007FEF5B90000-0x000007FEF657C000-memory.dmp

                        Filesize

                        9.9MB

                      • memory/1944-1040-0x000000001B020000-0x000000001B0A0000-memory.dmp

                        Filesize

                        512KB

                      • memory/1944-151-0x0000000001360000-0x0000000001368000-memory.dmp

                        Filesize

                        32KB

                      • memory/2620-1036-0x0000000000090000-0x00000000000AE000-memory.dmp

                        Filesize

                        120KB

                      • memory/2620-1032-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

                        Filesize

                        4KB

                      • memory/2620-1033-0x0000000000090000-0x00000000000AE000-memory.dmp

                        Filesize

                        120KB

                      • memory/2620-1038-0x0000000000090000-0x00000000000AE000-memory.dmp

                        Filesize

                        120KB

                      • memory/2620-984-0x0000000000090000-0x00000000000AE000-memory.dmp

                        Filesize

                        120KB

                      • memory/2948-1052-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/2948-1051-0x00000000002B0000-0x00000000003B0000-memory.dmp

                        Filesize

                        1024KB

                      • memory/2948-1055-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/3068-588-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB

                      • memory/3068-246-0x0000000000580000-0x0000000000680000-memory.dmp

                        Filesize

                        1024KB

                      • memory/3068-253-0x0000000000220000-0x0000000000229000-memory.dmp

                        Filesize

                        36KB

                      • memory/3068-254-0x0000000000400000-0x0000000000455000-memory.dmp

                        Filesize

                        340KB