Analysis
- max time kernel
62s - max time network
65s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/06/2021, 13:10
Errors
General
- Target 3d647da17e5d6d7056767f977905eb2b.exe
- Size 345KB
- Sample210624-t64xb87f8e
- SHA256 f82c86b4d9b27c55326bc2af4e715a473e645deccf2217af82dee93606fb45d2
Malware Config
Extracted
-
smokeloader
-
2020
-
http://ppcspb.com/upload/
-
http://mebbing.com/upload/
-
http://twcamel.com/upload/
-
http://howdycash.com/upload/
-
http://lahuertasonora.com/upload/
-
http://kpotiques.com/upload/
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Deletes itself 1 IoCs
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d647da17e5d6d7056767f977905eb2b.exe"C:\Users\Admin\AppData\Local\Temp\3d647da17e5d6d7056767f977905eb2b.exe"1⤵
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DFF6.exeC:\Users\Admin\AppData\Local\Temp\DFF6.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EDA3.exeC:\Users\Admin\AppData\Local\Temp\EDA3.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2B2.exeC:\Users\Admin\AppData\Local\Temp\2B2.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1296-143-0x0000000077540000-0x00000000776CE000-memory.dmp
memory/1876-128-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/1876-134-0x0000000005072000-0x0000000005073000-memory.dmp
memory/1876-125-0x0000000005080000-0x0000000005081000-memory.dmp
memory/1876-126-0x0000000002790000-0x00000000027A9000-memory.dmp
memory/1876-127-0x0000000005580000-0x0000000005581000-memory.dmp
memory/1876-129-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/1876-130-0x0000000000910000-0x0000000000A5A000-memory.dmp
memory/1876-131-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/1876-132-0x0000000000400000-0x0000000000907000-memory.dmp
memory/1876-133-0x0000000005070000-0x0000000005071000-memory.dmp
memory/1876-124-0x0000000000C20000-0x0000000000C3A000-memory.dmp
memory/1876-135-0x0000000005073000-0x0000000005074000-memory.dmp
memory/1876-136-0x0000000005074000-0x0000000005076000-memory.dmp
memory/1876-137-0x0000000005C20000-0x0000000005C21000-memory.dmp
memory/2716-117-0x0000000000F00000-0x0000000000F16000-memory.dmp
memory/3172-116-0x0000000000400000-0x00000000008F5000-memory.dmp
memory/3172-115-0x0000000000A60000-0x0000000000A69000-memory.dmp
memory/3976-141-0x0000000000AC0000-0x0000000000B2B000-memory.dmp
memory/3976-142-0x0000000000400000-0x0000000000946000-memory.dmp