Overview

overview

10

Static

static

60BB63DD81...F9.exe

windows7_x64

10

60BB63DD81...F9.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14-05-2021 20:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    60BB63DD8161C7FAE9436975F2E945F9.exe

  • Size

    3.3MB

  • MD5

    60bb63dd8161c7fae9436975f2e945f9

  • SHA1

    2e813eec9a866ec93e707ea129edf578e882cd01

  • SHA256

    ffecd6261932159067dd93f5c1df26f8da517f37ded13d122db853c1c84e7924

  • SHA512

    f65ffa06ed91d94a7a938dbc5cc92944a9b9f8be48abd8e7bde74d66c5e25e700734cf5fcda8ac78c198e68df32fde21df6e7605668d75f3c22f1f18b6a4063a

Score
10/10
plugxredlinesmokeloadersource1backdoorevasioninfostealerpersistencespywarestealertrojanupx

Malware Config

Extracted

Family

redline

Botnet

source1

C2

199.195.251.96:43073

Extracted

Family

smokeloader

Version

2020

C2

http://khaleelahmed.com/upload/

http://twvickiassociation.com/upload/

http://www20833.com/upload/

http://cocinasintonterias.com/upload/

http://masaofukunaga.com/upload/

http://gnckids.com/upload/
rc4.i32
rc4.i32

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
  • Executes dropped EXE 11 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
    1⤵
      PID:2788
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2804
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2712
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2588
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2536
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1872
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1396
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1264
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1196
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1076
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                      • Drops file in System32 directory
                      PID:408
                      • C:\Users\Admin\AppData\Roaming\ecjjcrc
                        C:\Users\Admin\AppData\Roaming\ecjjcrc
                        2⤵
                        • Executes dropped EXE
                        PID:4304
                        • C:\Windows\SysWOW64\WerFault.exe
                          C:\Windows\SysWOW64\WerFault.exe -u -p 4304 -s 236
                          3⤵
                          • Suspicious use of NtCreateProcessExOtherParentProcess
                          • Drops file in Windows directory
                          • Program crash
                          PID:4052
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:68
                      • C:\Users\Admin\AppData\Local\Temp\60BB63DD8161C7FAE9436975F2E945F9.exe
                        "C:\Users\Admin\AppData\Local\Temp\60BB63DD8161C7FAE9436975F2E945F9.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:740
                        • C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe
                          "C:\Users\Admin\AppData\Local\Temp\jg2_2qua.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          PID:2952
                        • C:\Users\Admin\AppData\Local\Temp\Files.exe
                          "C:\Users\Admin\AppData\Local\Temp\Files.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:184
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
                            3⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3408
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              4⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:4184
                        • C:\Users\Admin\AppData\Local\Temp\KRSetp.exe
                          "C:\Users\Admin\AppData\Local\Temp\KRSetp.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          PID:3140
                        • C:\Users\Admin\AppData\Local\Temp\wf-game.exe
                          "C:\Users\Admin\AppData\Local\Temp\wf-game.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Suspicious use of WriteProcessMemory
                          PID:1840
                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",install
                            3⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4052
                        • C:\Users\Admin\AppData\Local\Temp\agdsk.exe
                          "C:\Users\Admin\AppData\Local\Temp\agdsk.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:940
                          • C:\Windows\SysWOW64\cmd.exe
                            cmd.exe /c taskkill /f /im chrome.exe
                            3⤵
                            • Suspicious use of WriteProcessMemory
                            PID:4208
                            • C:\Windows\SysWOW64\taskkill.exe
                              taskkill /f /im chrome.exe
                              4⤵
                              • Kills process with taskkill
                              PID:1724
                        • C:\Users\Admin\AppData\Local\Temp\pub2.exe
                          "C:\Users\Admin\AppData\Local\Temp\pub2.exe"
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious behavior: MapViewOfSection
                          PID:1420
                        • C:\Users\Admin\AppData\Local\Temp\pzyh.exe
                          "C:\Users\Admin\AppData\Local\Temp\pzyh.exe"
                          2⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of WriteProcessMemory
                          PID:2840
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            3⤵
                            • Executes dropped EXE
                            PID:4132
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            3⤵
                            • Executes dropped EXE
                            PID:3176
                      • \??\c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                        1⤵
                        • Suspicious use of SetThreadContext
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:840
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                            PID:1016
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
                          1⤵
                          • Drops file in Windows directory
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of SetWindowsHookEx
                          PID:4532
                        • C:\Windows\system32\browser_broker.exe
                          C:\Windows\system32\browser_broker.exe -Embedding
                          1⤵
                          • Modifies Internet Explorer settings
                          PID:4584
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetWindowsHookEx
                          • Suspicious use of WriteProcessMemory
                          PID:4820
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies Internet Explorer settings
                          • Modifies registry class
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4892
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:1416
                        • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
                          "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
                          1⤵
                          • Modifies registry class
                          PID:4344

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/68-174-0x0000017005380000-0x00000170053F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/408-216-0x0000018F43360000-0x0000018F433D0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/840-160-0x000001D8E13C0000-0x000001D8E1430000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1016-169-0x000001919DE40000-0x000001919DEB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1076-212-0x0000022814D90000-0x0000022814E00000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1196-222-0x000001FE35360000-0x000001FE353D0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1264-224-0x0000026461080000-0x00000264610F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1396-218-0x000001D711C00000-0x000001D711C70000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1420-214-0x0000000000400000-0x0000000000845000-memory.dmp

                          Filesize

                          4.3MB

                          Download

                        • memory/1420-209-0x00000000001F0000-0x00000000001F9000-memory.dmp

                          Filesize

                          36KB

                          Download

                        • memory/1872-220-0x0000028A62380000-0x0000028A623F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2536-204-0x0000028630940000-0x00000286309B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2588-179-0x0000020B57E10000-0x0000020B57E80000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2712-168-0x0000021272F00000-0x0000021272F70000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2712-163-0x0000021272D10000-0x0000021272D5B000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/2724-233-0x0000000000D20000-0x0000000000D36000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/2788-226-0x0000017B65840000-0x0000017B658B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2804-205-0x000001BA8A640000-0x000001BA8A6B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2952-248-0x0000000003660000-0x0000000003670000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/2952-242-0x00000000034C0000-0x00000000034D0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3140-142-0x0000000002380000-0x000000000239D000-memory.dmp

                          Filesize

                          116KB

                          Download

                        • memory/3140-140-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3140-144-0x000000001AF40000-0x000000001AF42000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/3140-143-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3140-129-0x0000000000280000-0x0000000000281000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3408-171-0x0000000004940000-0x0000000004E3E000-memory.dmp

                          Filesize

                          5.0MB

                          Download

                        • memory/3408-192-0x0000000004E00000-0x0000000004E16000-memory.dmp

                          Filesize

                          88KB

                          Download

                        • memory/3408-148-0x0000000000130000-0x0000000000131000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3408-150-0x0000000004E40000-0x0000000004E41000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3408-155-0x00000000049F0000-0x00000000049F1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3408-180-0x0000000004AA0000-0x0000000004AA1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3408-196-0x0000000005910000-0x0000000005911000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3408-186-0x0000000004AB0000-0x0000000004AEB000-memory.dmp

                          Filesize

                          236KB

                          Download

                        • memory/4052-157-0x0000000003F47000-0x0000000004048000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/4052-159-0x00000000041B0000-0x000000000420C000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/4184-206-0x0000000000400000-0x000000000041C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/4184-228-0x0000000002B10000-0x0000000002B11000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4184-215-0x0000000005600000-0x0000000005601000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4184-232-0x0000000005270000-0x0000000005271000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4184-231-0x0000000005030000-0x0000000005031000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4184-230-0x0000000002B30000-0x0000000002B6E000-memory.dmp

                          Filesize

                          248KB

                          Download

                        • memory/4184-229-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/4304-259-0x0000000000850000-0x00000000008FE000-memory.dmp

                          Filesize

                          696KB

                          Download

                        • memory/4304-260-0x0000000000400000-0x0000000000845000-memory.dmp

                          Filesize

                          4.3MB

                          Download