Resubmissions

12-07-2021 16:55

210712-cvz622xsbj 10

10-07-2021 13:25

210710-pdfh7kft96 10

09-07-2021 23:00

210709-hewxkm1xlj 10

09-07-2021 16:08

210709-5ql27kyjqa 10

09-07-2021 14:08

210709-pt977a4bhe 10

08-07-2021 22:09

210708-3ypfnj5j7x 10

08-07-2021 13:30

210708-4hsk7y9f2x 10

08-07-2021 12:14

210708-8t5f9z9egj 10

Analysis

  • max time kernel
    1801s
  • max time network
    1310s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    12-07-2021 16:55

General

  • Target

    toolspab2 (19).exe

  • Size

    315KB

  • MD5

    1d20e1f65938e837ef1b88f10f1bd6c3

  • SHA1

    703d7098dbfc476d2181b7fc041cc23e49c368f1

  • SHA256

    05cd7440851f13dd8f489bb3c06eba385d85d7d9a77a612049c04c541a88593d

  • SHA512

    f9d333abe1f721b8d45d7bc6b5f286af09a8d233bd1d41f0ad891840cf742364aeca2cb6ccd6543f56a8eaf32804f82f72f961d16d5ba663ad706d164915a196

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://999080321newfolder1002002131-service1002.space/

http://999080321newfolder1002002231-service1002.space/

http://999080321newfolder3100231-service1002.space/

http://999080321newfolder1002002431-service1002.space/

http://999080321newfolder1002002531-service1002.space/

http://999080321newfolder33417-012425999080321.space/

http://999080321test125831-service10020125999080321.space/

http://999080321test136831-service10020125999080321.space/

http://999080321test147831-service10020125999080321.space/

http://999080321test146831-service10020125999080321.space/

http://999080321test134831-service10020125999080321.space/

http://999080321est213531-service1002012425999080321.ru/

http://999080321yes1t3481-service10020125999080321.ru/

http://999080321test13561-service10020125999080321.su/

http://999080321test14781-service10020125999080321.info/

http://999080321test13461-service10020125999080321.net/

http://999080321test15671-service10020125999080321.tech/

http://999080321test12671-service10020125999080321.online/

http://999080321utest1341-service10020125999080321.ru/

http://999080321uest71-service100201dom25999080321.ru/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

1

C2

45.32.235.238:45555

Signatures

  • Raccoon

    Simple but powerful infostealer which was very active in 2019.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 12 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Delays execution with timeout.exe 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 49 IoCs
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\toolspab2 (19).exe
    "C:\Users\Admin\AppData\Local\Temp\toolspab2 (19).exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:908
    • C:\Users\Admin\AppData\Local\Temp\toolspab2 (19).exe
      "C:\Users\Admin\AppData\Local\Temp\toolspab2 (19).exe"
      2⤵
      • Loads dropped DLL
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:2656
  • C:\Users\Admin\AppData\Local\Temp\9A9B.exe
    C:\Users\Admin\AppData\Local\Temp\9A9B.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:2312
  • C:\Users\Admin\AppData\Local\Temp\9BF4.exe
    C:\Users\Admin\AppData\Local\Temp\9BF4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetWindowsHookEx
    PID:2804
  • C:\Users\Admin\AppData\Local\Temp\9EA4.exe
    C:\Users\Admin\AppData\Local\Temp\9EA4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1156
    • C:\Users\Admin\AppData\Local\Temp\9EA4.exe
      C:\Users\Admin\AppData\Local\Temp\9EA4.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1712
  • C:\Users\Admin\AppData\Local\Temp\A23F.exe
    C:\Users\Admin\AppData\Local\Temp\A23F.exe
    1⤵
    • Executes dropped EXE
    PID:2112
  • C:\Users\Admin\AppData\Local\Temp\A657.exe
    C:\Users\Admin\AppData\Local\Temp\A657.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Loads dropped DLL
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of WriteProcessMemory
    PID:1572
    • C:\Windows\SysWOW64\cmd.exe
      cmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\A657.exe"
      2⤵
        PID:2804
        • C:\Windows\SysWOW64\timeout.exe
          timeout /T 10 /NOBREAK
          3⤵
          • Delays execution with timeout.exe
          PID:2084
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
        PID:1064
      • C:\Windows\explorer.exe
        C:\Windows\explorer.exe
        1⤵
          PID:3724
        • C:\Windows\SysWOW64\explorer.exe
          C:\Windows\SysWOW64\explorer.exe
          1⤵
            PID:3368
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:3336
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:1140
              • C:\Windows\explorer.exe
                C:\Windows\explorer.exe
                1⤵
                  PID:496
                • C:\Windows\SysWOW64\explorer.exe
                  C:\Windows\SysWOW64\explorer.exe
                  1⤵
                    PID:1184
                  • C:\Windows\explorer.exe
                    C:\Windows\explorer.exe
                    1⤵
                      PID:1120
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:1436
                      • C:\Users\Admin\AppData\Roaming\vjjrguw
                        C:\Users\Admin\AppData\Roaming\vjjrguw
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:3724
                        • C:\Users\Admin\AppData\Roaming\vjjrguw
                          C:\Users\Admin\AppData\Roaming\vjjrguw
                          2⤵
                          • Executes dropped EXE
                          PID:640
                      • C:\Users\Admin\AppData\Roaming\vjjrguw
                        C:\Users\Admin\AppData\Roaming\vjjrguw
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:1548
                        • C:\Users\Admin\AppData\Roaming\vjjrguw
                          C:\Users\Admin\AppData\Roaming\vjjrguw
                          2⤵
                          • Executes dropped EXE
                          • Loads dropped DLL
                          • Checks SCSI registry key(s)
                          • Suspicious behavior: MapViewOfSection
                          PID:2760
                      • C:\Users\Admin\AppData\Roaming\vjjrguw
                        C:\Users\Admin\AppData\Roaming\vjjrguw
                        1⤵
                        • Executes dropped EXE
                        • Suspicious use of SetThreadContext
                        PID:1332
                        • C:\Users\Admin\AppData\Roaming\vjjrguw
                          C:\Users\Admin\AppData\Roaming\vjjrguw
                          2⤵
                          • Executes dropped EXE
                          PID:2188

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/496-177-0x00000000003C0000-0x00000000003CC000-memory.dmp

                        Filesize

                        48KB

                      • memory/496-176-0x00000000003D0000-0x00000000003D6000-memory.dmp

                        Filesize

                        24KB

                      • memory/908-118-0x00000000004B0000-0x00000000004BC000-memory.dmp

                        Filesize

                        48KB

                      • memory/1064-156-0x0000000002A70000-0x0000000002AE4000-memory.dmp

                        Filesize

                        464KB

                      • memory/1064-158-0x0000000002A00000-0x0000000002A6B000-memory.dmp

                        Filesize

                        428KB

                      • memory/1120-182-0x00000000010F0000-0x00000000010F5000-memory.dmp

                        Filesize

                        20KB

                      • memory/1120-183-0x00000000010E0000-0x00000000010E9000-memory.dmp

                        Filesize

                        36KB

                      • memory/1140-174-0x0000000002860000-0x0000000002869000-memory.dmp

                        Filesize

                        36KB

                      • memory/1140-173-0x0000000002870000-0x0000000002875000-memory.dmp

                        Filesize

                        20KB

                      • memory/1156-137-0x0000000004AF0000-0x0000000004B66000-memory.dmp

                        Filesize

                        472KB

                      • memory/1156-133-0x0000000000340000-0x0000000000341000-memory.dmp

                        Filesize

                        4KB

                      • memory/1156-135-0x0000000004B70000-0x0000000004B71000-memory.dmp

                        Filesize

                        4KB

                      • memory/1156-136-0x0000000004B10000-0x0000000004B11000-memory.dmp

                        Filesize

                        4KB

                      • memory/1184-180-0x0000000002860000-0x0000000002869000-memory.dmp

                        Filesize

                        36KB

                      • memory/1184-179-0x0000000002870000-0x0000000002874000-memory.dmp

                        Filesize

                        16KB

                      • memory/1436-186-0x00000000025F0000-0x00000000025F9000-memory.dmp

                        Filesize

                        36KB

                      • memory/1436-185-0x0000000002800000-0x0000000002805000-memory.dmp

                        Filesize

                        20KB

                      • memory/1548-207-0x0000000000460000-0x00000000005AA000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/1572-145-0x0000000077AB0000-0x0000000077C3E000-memory.dmp

                        Filesize

                        1.6MB

                      • memory/1572-144-0x0000000001050000-0x0000000001444000-memory.dmp

                        Filesize

                        4.0MB

                      • memory/1712-188-0x00000000074B0000-0x00000000074B1000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-190-0x0000000007220000-0x0000000007221000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-147-0x0000000000400000-0x000000000041E000-memory.dmp

                        Filesize

                        120KB

                      • memory/1712-153-0x0000000005D90000-0x0000000005D91000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-157-0x00000000057F0000-0x00000000057F1000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-191-0x0000000007EE0000-0x0000000007EE1000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-165-0x0000000005780000-0x0000000005D86000-memory.dmp

                        Filesize

                        6.0MB

                      • memory/1712-164-0x0000000005890000-0x0000000005891000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-171-0x0000000005B00000-0x0000000005B01000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-189-0x0000000006D30000-0x0000000006D31000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-160-0x0000000005850000-0x0000000005851000-memory.dmp

                        Filesize

                        4KB

                      • memory/1712-187-0x0000000006DB0000-0x0000000006DB1000-memory.dmp

                        Filesize

                        4KB

                      • memory/2112-155-0x0000000002C40000-0x0000000002D8A000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/2112-162-0x0000000000400000-0x0000000002C3C000-memory.dmp

                        Filesize

                        40.2MB

                      • memory/2644-119-0x0000000000C80000-0x0000000000C97000-memory.dmp

                        Filesize

                        92KB

                      • memory/2644-208-0x00000000029B0000-0x00000000029C7000-memory.dmp

                        Filesize

                        92KB

                      • memory/2656-115-0x0000000000400000-0x000000000040C000-memory.dmp

                        Filesize

                        48KB

                      • memory/3336-169-0x00000000003D0000-0x00000000003D9000-memory.dmp

                        Filesize

                        36KB

                      • memory/3336-170-0x00000000003C0000-0x00000000003CF000-memory.dmp

                        Filesize

                        60KB

                      • memory/3368-166-0x0000000002870000-0x0000000002877000-memory.dmp

                        Filesize

                        28KB

                      • memory/3368-167-0x0000000002860000-0x000000000286B000-memory.dmp

                        Filesize

                        44KB

                      • memory/3724-201-0x00000000004B0000-0x00000000005FA000-memory.dmp

                        Filesize

                        1.3MB

                      • memory/3724-161-0x0000000000FA0000-0x0000000000FAC000-memory.dmp

                        Filesize

                        48KB

                      • memory/3724-159-0x0000000000FB0000-0x0000000000FB7000-memory.dmp

                        Filesize

                        28KB