Analysis
- max time kernel
151s - max time network
184s - platform
windows7_x64 - resource
win7v20210408 - submitted
09/08/2021, 11:35
Static task
static1
Behavioral task
behavioral1
Sample
4a5b337f08d068654f968780d8236393.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4a5b337f08d068654f968780d8236393.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 4a5b337f08d068654f968780d8236393.exe
- Size 222KB
- Sample210809-wsytatake2
- SHA256 392e2fc8bcf20d142620a90de7cc2632e86771a38db9b2a67a8809935ef97752
- MD5 4a5b337f08d068654f968780d8236393
- SHA1 cf2565359731c096a299294d6c2f8d9791e65814
- SHA512 edaf2b8ece9dc7f8fe46644335719298727ad2a7ab72e2146ff04cb1f4a01cc3e49688601c91434e63375d96935872533b1ffc44edef2f7e938bdfab53ab5147
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Extracted
Family
-
redline
Botnet
-
SewPalpadin
C2
-
185.215.113.114:8887
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/1220-77-0x0000000004930000-0x000000000494B000-memory.dmp family_redline behavioral1/memory/1220-82-0x0000000004960000-0x0000000004979000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
suricata: ET MALWARE Potential Dridex.Maldoc Minimal Executable Request
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
pid Process 1188 EFCB.exe 1620 EFCB.exe 1220 F9BB.exe 1172 EFCB.exe 1812 EFCB.exe - Deletes itself 1 IoCs
pid Process 1244 Process not Found - Loads dropped DLL 4 IoCs
pid Process 1188 EFCB.exe 1620 EFCB.exe 1620 EFCB.exe 1172 EFCB.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 908 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\b8917737-91bf-48ac-b746-5c608e75d6ce\\EFCB.exe\" --AutoStart" EFCB.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 22 api.2ip.ua 23 api.2ip.ua 36 api.2ip.ua - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1188 set thread context of 1620 1188 EFCB.exe 30 PID 1172 set thread context of 1812 1172 EFCB.exe 36 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4a5b337f08d068654f968780d8236393.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4a5b337f08d068654f968780d8236393.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4a5b337f08d068654f968780d8236393.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 EFCB.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EFCB.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EFCB.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 EFCB.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e EFCB.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1840 4a5b337f08d068654f968780d8236393.exe 1840 4a5b337f08d068654f968780d8236393.exe 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1244 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1840 4a5b337f08d068654f968780d8236393.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1220 F9BB.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1244 Process not Found 1244 Process not Found 1244 Process not Found 1244 Process not Found - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1244 wrote to memory of 1188 1244 Process not Found 29 PID 1244 wrote to memory of 1188 1244 Process not Found 29 PID 1244 wrote to memory of 1188 1244 Process not Found 29 PID 1244 wrote to memory of 1188 1244 Process not Found 29 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1188 wrote to memory of 1620 1188 EFCB.exe 30 PID 1244 wrote to memory of 1220 1244 Process not Found 31 PID 1244 wrote to memory of 1220 1244 Process not Found 31 PID 1244 wrote to memory of 1220 1244 Process not Found 31 PID 1244 wrote to memory of 1220 1244 Process not Found 31 PID 1620 wrote to memory of 908 1620 EFCB.exe 34 PID 1620 wrote to memory of 908 1620 EFCB.exe 34 PID 1620 wrote to memory of 908 1620 EFCB.exe 34 PID 1620 wrote to memory of 908 1620 EFCB.exe 34 PID 1620 wrote to memory of 1172 1620 EFCB.exe 35 PID 1620 wrote to memory of 1172 1620 EFCB.exe 35 PID 1620 wrote to memory of 1172 1620 EFCB.exe 35 PID 1620 wrote to memory of 1172 1620 EFCB.exe 35 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36 PID 1172 wrote to memory of 1812 1172 EFCB.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\4a5b337f08d068654f968780d8236393.exe"C:\Users\Admin\AppData\Local\Temp\4a5b337f08d068654f968780d8236393.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1840
-
C:\Users\Admin\AppData\Local\Temp\EFCB.exeC:\Users\Admin\AppData\Local\Temp\EFCB.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\EFCB.exeC:\Users\Admin\AppData\Local\Temp\EFCB.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\b8917737-91bf-48ac-b746-5c608e75d6ce" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\EFCB.exe"C:\Users\Admin\AppData\Local\Temp\EFCB.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1172 -
C:\Users\Admin\AppData\Local\Temp\EFCB.exe"C:\Users\Admin\AppData\Local\Temp\EFCB.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1812
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\F9BB.exeC:\Users\Admin\AppData\Local\Temp\F9BB.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1220