Analysis
- max time kernel
132s - max time network
179s - platform
windows7_x64 - resource
win7v20210410 - submitted
14/08/2021, 14:44
Errors
General
- Target 72bb2c6a4acff1b558bb1682bf9e94a3.exe
- Size 310KB
- Sample210814-4wta83pdvx
- SHA256 328e682510e9c0e0c37a7c8d347ecb4e7791a03b44962675a3f5f23d85250e08
Malware Config
Extracted
-
smokeloader
-
2020
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
Extracted
-
redline
-
SewPalpadin
-
185.215.113.114:8887
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 4 IoCs
- Suspicious use of SendNotifyMessage 4 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\72bb2c6a4acff1b558bb1682bf9e94a3.exe"C:\Users\Admin\AppData\Local\Temp\72bb2c6a4acff1b558bb1682bf9e94a3.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8E7A.exeC:\Users\Admin\AppData\Local\Temp\8E7A.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\AB7C.exeC:\Users\Admin\AppData\Local\Temp\AB7C.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/672-72-0x0000000004CD3000-0x0000000004CD4000-memory.dmp
memory/672-70-0x0000000004CD1000-0x0000000004CD2000-memory.dmp
memory/672-71-0x0000000004CD2000-0x0000000004CD3000-memory.dmp
memory/672-80-0x0000000005DE0000-0x0000000005DE1000-memory.dmp
memory/672-67-0x0000000000400000-0x0000000000915000-memory.dmp
memory/672-66-0x0000000000220000-0x000000000024F000-memory.dmp
memory/672-68-0x0000000000A00000-0x0000000000A1B000-memory.dmp
memory/672-79-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
memory/672-73-0x0000000004CD4000-0x0000000004CD6000-memory.dmp
memory/672-69-0x0000000002590000-0x00000000025A9000-memory.dmp
memory/1132-78-0x0000000000400000-0x0000000000954000-memory.dmp
memory/1132-77-0x0000000000220000-0x000000000028B000-memory.dmp
memory/1292-63-0x00000000027A0000-0x00000000027B6000-memory.dmp
memory/1668-60-0x00000000767B1000-0x00000000767B3000-memory.dmp
memory/1668-62-0x0000000000400000-0x0000000000904000-memory.dmp
memory/1668-61-0x0000000000020000-0x0000000000029000-memory.dmp