Resubmissions

12-07-2021 16:55

210712-cvz622xsbj 10

10-07-2021 13:25

210710-pdfh7kft96 10

09-07-2021 23:00

210709-hewxkm1xlj 10

09-07-2021 16:08

210709-5ql27kyjqa 10

09-07-2021 14:08

210709-pt977a4bhe 10

08-07-2021 22:09

210708-3ypfnj5j7x 10

08-07-2021 13:30

210708-4hsk7y9f2x 10

08-07-2021 12:14

210708-8t5f9z9egj 10

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    08-07-2021 13:30

General

  • Target

    toolspab2 (13).exe

  • Size

    315KB

  • MD5

    1d20e1f65938e837ef1b88f10f1bd6c3

  • SHA1

    703d7098dbfc476d2181b7fc041cc23e49c368f1

  • SHA256

    05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d

  • SHA512

    f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

1

C2

45.32.235.238:45555

Extracted

Family

redline

Botnet

agressor

C2

65.21.122.45:8085

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 10 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe
    "C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:980
    • C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe
      "C:\Users\Admin\AppData\Local\Temp\toolspab2 (13).exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1208
  • C:\Users\Admin\AppData\Local\Temp\4569.exe
    C:\Users\Admin\AppData\Local\Temp\4569.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1128
  • C:\Users\Admin\AppData\Local\Temp\46D1.exe
    C:\Users\Admin\AppData\Local\Temp\46D1.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:1244
  • C:\Users\Admin\AppData\Local\Temp\9E15.exe
    C:\Users\Admin\AppData\Local\Temp\9E15.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:820
    • C:\Users\Admin\AppData\Local\Temp\9E15.exe
      C:\Users\Admin\AppData\Local\Temp\9E15.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:328
  • C:\Users\Admin\AppData\Local\Temp\A19F.exe
    C:\Users\Admin\AppData\Local\Temp\A19F.exe
    1⤵
    • Executes dropped EXE
    PID:412
  • C:\Users\Admin\AppData\Local\Temp\A44F.exe
    C:\Users\Admin\AppData\Local\Temp\A44F.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:344
  • C:\Users\Admin\AppData\Local\Temp\B080.exe
    C:\Users\Admin\AppData\Local\Temp\B080.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Checks SCSI registry key(s)
    • Suspicious behavior: MapViewOfSection
    PID:1164
  • C:\Users\Admin\AppData\Local\Temp\BE65.exe
    C:\Users\Admin\AppData\Local\Temp\BE65.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1136
  • C:\Users\Admin\AppData\Local\Temp\CB23.exe
    C:\Users\Admin\AppData\Local\Temp\CB23.exe
    1⤵
    • Executes dropped EXE
    PID:1712
  • C:\Users\Admin\AppData\Local\Temp\D62B.exe
    C:\Users\Admin\AppData\Local\Temp\D62B.exe
    1⤵
    • Executes dropped EXE
    PID:900
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:1076
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:1156
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:2000
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:1836
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:852

            Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/328-91-0x0000000000400000-0x000000000041E000-memory.dmp

              Filesize

              120KB

            • memory/328-110-0x0000000004DE0000-0x0000000004DE1000-memory.dmp

              Filesize

              4KB

            • memory/328-87-0x0000000000400000-0x000000000041E000-memory.dmp

              Filesize

              120KB

            • memory/344-103-0x0000000004793000-0x0000000004794000-memory.dmp

              Filesize

              4KB

            • memory/344-96-0x0000000000510000-0x000000000052B000-memory.dmp

              Filesize

              108KB

            • memory/344-109-0x0000000004794000-0x0000000004796000-memory.dmp

              Filesize

              8KB

            • memory/344-104-0x0000000000550000-0x0000000000569000-memory.dmp

              Filesize

              100KB

            • memory/344-99-0x0000000000400000-0x000000000046F000-memory.dmp

              Filesize

              444KB

            • memory/344-101-0x0000000004792000-0x0000000004793000-memory.dmp

              Filesize

              4KB

            • memory/344-100-0x0000000004791000-0x0000000004792000-memory.dmp

              Filesize

              4KB

            • memory/344-98-0x0000000000220000-0x000000000024F000-memory.dmp

              Filesize

              188KB

            • memory/412-94-0x00000000002F0000-0x0000000000381000-memory.dmp

              Filesize

              580KB

            • memory/412-102-0x0000000000400000-0x000000000049E000-memory.dmp

              Filesize

              632KB

            • memory/820-85-0x0000000004360000-0x0000000004361000-memory.dmp

              Filesize

              4KB

            • memory/820-78-0x0000000000930000-0x0000000000931000-memory.dmp

              Filesize

              4KB

            • memory/980-64-0x00000000001B0000-0x00000000001BC000-memory.dmp

              Filesize

              48KB

            • memory/1076-134-0x00000000000F0000-0x0000000000164000-memory.dmp

              Filesize

              464KB

            • memory/1076-125-0x000000006E481000-0x000000006E483000-memory.dmp

              Filesize

              8KB

            • memory/1076-135-0x0000000000080000-0x00000000000EB000-memory.dmp

              Filesize

              428KB

            • memory/1136-122-0x0000000004854000-0x0000000004856000-memory.dmp

              Filesize

              8KB

            • memory/1136-118-0x0000000004851000-0x0000000004852000-memory.dmp

              Filesize

              4KB

            • memory/1136-117-0x0000000000400000-0x000000000046F000-memory.dmp

              Filesize

              444KB

            • memory/1136-120-0x0000000004852000-0x0000000004853000-memory.dmp

              Filesize

              4KB

            • memory/1136-121-0x0000000004853000-0x0000000004854000-memory.dmp

              Filesize

              4KB

            • memory/1156-129-0x0000000000060000-0x000000000006C000-memory.dmp

              Filesize

              48KB

            • memory/1156-128-0x0000000000070000-0x0000000000077000-memory.dmp

              Filesize

              28KB

            • memory/1164-112-0x0000000000400000-0x0000000000457000-memory.dmp

              Filesize

              348KB

            • memory/1164-111-0x0000000000220000-0x0000000000229000-memory.dmp

              Filesize

              36KB

            • memory/1200-127-0x0000000002AB0000-0x0000000002AC6000-memory.dmp

              Filesize

              88KB

            • memory/1200-66-0x00000000029A0000-0x00000000029B7000-memory.dmp

              Filesize

              92KB

            • memory/1208-62-0x0000000075FF1000-0x0000000075FF3000-memory.dmp

              Filesize

              8KB

            • memory/1208-60-0x0000000000400000-0x000000000040C000-memory.dmp

              Filesize

              48KB

            • memory/1836-141-0x0000000000070000-0x0000000000079000-memory.dmp

              Filesize

              36KB

            • memory/1836-142-0x0000000000060000-0x000000000006F000-memory.dmp

              Filesize

              60KB

            • memory/2000-133-0x000000006E601000-0x000000006E603000-memory.dmp

              Filesize

              8KB

            • memory/2000-138-0x0000000000090000-0x0000000000097000-memory.dmp

              Filesize

              28KB

            • memory/2000-139-0x0000000000080000-0x000000000008B000-memory.dmp

              Filesize

              44KB