Analysis
- max time kernel
150s - max time network
126s - platform
windows10_x64 - resource
win10v20210410 - submitted
10/08/2021, 13:47
Static task
static1
Behavioral task
behavioral1
Sample
e468fbed089419bc835f951f1763acb5.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
General
- Target e468fbed089419bc835f951f1763acb5.exe
- Size 362KB
- Sample210810-e6dknsgyyx
- SHA256 7c87f681db3f6b7f0337faae390896ef94e05390ad78a78f7ad20dc7e7808efd
- MD5 e468fbed089419bc835f951f1763acb5
- SHA1 bb012af6cb9c806af4541a8aa38a3d9e5a97fca0
- SHA512 4fc716eee52c914bc5116ff2e3a12de4d3236829f518d3e874fde577d3feabc9bc5fa78b5a1e30c7ac41dc0f62861279d93818ba171b21d2698c3dd5e70e40da
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Extracted
Family
-
vidar
Version
-
40
Botnet
-
828
C2
-
https://lenak513.tumblr.com/
Attributes
-
profile_id
828
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Vidar Stealer 2 IoCs
resource yara_rule behavioral2/memory/2772-120-0x0000000003350000-0x00000000033ED000-memory.dmp family_vidar behavioral2/memory/2772-121-0x0000000000400000-0x000000000334C000-memory.dmp family_vidar - Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
pid Process 2772 F10D.exe 2200 4D18.exe - Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 4D18.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 4D18.exe - Deletes itself 1 IoCs
pid Process 2504 Process not Found - Loads dropped DLL 2 IoCs
pid Process 2772 F10D.exe 2772 F10D.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
resource yara_rule behavioral2/files/0x00060000000155fd-134.dat themida behavioral2/files/0x00060000000155fd-135.dat themida behavioral2/memory/2200-137-0x0000000000A20000-0x0000000000A21000-memory.dmp themida - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 4D18.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2200 4D18.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e468fbed089419bc835f951f1763acb5.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e468fbed089419bc835f951f1763acb5.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI e468fbed089419bc835f951f1763acb5.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString F10D.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 F10D.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2508 timeout.exe - Kills process with taskkill 1 IoCs
pid Process 2712 taskkill.exe - Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance Process not Found Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance Process not Found -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 F10D.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 5c000000010000000400000000080000090000000100000054000000305206082b0601050507030206082b06010505070303060a2b0601040182370a030406082b0601050507030406082b0601050507030606082b0601050507030706082b0601050507030106082b0601050507030853000000010000004300000030413022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0301b060567810c010330123010060a2b0601040182373c0101030200c0620000000100000020000000d7a7a0fb5d7e2731d771e9484ebcdef71d5f0c3e0a2948782bc83ee0ea699ef40b000000010000001c0000005300650063007400690067006f002000280041004100410029000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e F10D.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3980 e468fbed089419bc835f951f1763acb5.exe 3980 e468fbed089419bc835f951f1763acb5.exe 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found 2504 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2504 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 3980 e468fbed089419bc835f951f1763acb5.exe - Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 2712 taskkill.exe Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeDebugPrivilege 2200 4D18.exe Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found Token: SeShutdownPrivilege 2504 Process not Found Token: SeCreatePagefilePrivilege 2504 Process not Found - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2772 2504 Process not Found 79 PID 2504 wrote to memory of 2772 2504 Process not Found 79 PID 2504 wrote to memory of 2772 2504 Process not Found 79 PID 2772 wrote to memory of 3412 2772 F10D.exe 80 PID 2772 wrote to memory of 3412 2772 F10D.exe 80 PID 2772 wrote to memory of 3412 2772 F10D.exe 80 PID 3412 wrote to memory of 2712 3412 cmd.exe 82 PID 3412 wrote to memory of 2712 3412 cmd.exe 82 PID 3412 wrote to memory of 2712 3412 cmd.exe 82 PID 3412 wrote to memory of 2508 3412 cmd.exe 84 PID 3412 wrote to memory of 2508 3412 cmd.exe 84 PID 3412 wrote to memory of 2508 3412 cmd.exe 84 PID 2504 wrote to memory of 2200 2504 Process not Found 86 PID 2504 wrote to memory of 2200 2504 Process not Found 86 PID 2504 wrote to memory of 2200 2504 Process not Found 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\e468fbed089419bc835f951f1763acb5.exe"C:\Users\Admin\AppData\Local\Temp\e468fbed089419bc835f951f1763acb5.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3980
-
C:\Users\Admin\AppData\Local\Temp\F10D.exeC:\Users\Admin\AppData\Local\Temp\F10D.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:2772 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c taskkill /im F10D.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\F10D.exe" & del C:\ProgramData\*.dll & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\taskkill.exetaskkill /im F10D.exe /f3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2712
-
-
C:\Windows\SysWOW64\timeout.exetimeout /t 63⤵
- Delays execution with timeout.exe
PID:2508
-
-
-
C:\Users\Admin\AppData\Local\Temp\4D18.exeC:\Users\Admin\AppData\Local\Temp\4D18.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:2200