Analysis
- max time kernel
151s - max time network
194s - platform
windows7_x64 - resource
win7v20210410 - submitted
18/08/2021, 14:25
Static task
static1
Behavioral task
behavioral1
Sample
3ab2727f7f5828d65aef29e052cab53d.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3ab2727f7f5828d65aef29e052cab53d.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 3ab2727f7f5828d65aef29e052cab53d.exe
- Size 263KB
- Sample210818-yfawdffdr6
- SHA256 bfbae0e392b899fc0d3731160c71e14559bcb1470c03e2b7b2997da3071a34cd
- MD5 3ab2727f7f5828d65aef29e052cab53d
- SHA1 1089e82ab50a867870c9d4c4880fc3ca64622287
- SHA512 258e837fa3042c2adab007ad8e6c42bea1e600ee937f93838424c6fce0692ab3365707c619f2c3ceabbc3734568171617ec5ef100fdbad97fe5d8c5360ef12ef
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Extracted
Family
-
redline
C2
-
185.215.113.29:8889
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/1884-75-0x00000000045C0000-0x00000000045DC000-memory.dmp family_redline behavioral1/memory/1884-76-0x00000000046F0000-0x000000000470A000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
pid Process 580 DAE4.exe 740 DAE4.exe 1884 E715.exe 1832 DAE4.exe 1140 DAE4.exe - Deletes itself 1 IoCs
pid Process 1220 Process not Found - Loads dropped DLL 4 IoCs
pid Process 580 DAE4.exe 740 DAE4.exe 740 DAE4.exe 1832 DAE4.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 2012 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\51c19c9f-3fa0-4e3e-ab0b-ba90515c5e2e\\DAE4.exe\" --AutoStart" DAE4.exe - Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 31 api.2ip.ua 18 api.2ip.ua 19 api.2ip.ua - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 580 set thread context of 740 580 DAE4.exe 30 PID 1832 set thread context of 1140 1832 DAE4.exe 37 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ab2727f7f5828d65aef29e052cab53d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ab2727f7f5828d65aef29e052cab53d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3ab2727f7f5828d65aef29e052cab53d.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 DAE4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DAE4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DAE4.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 DAE4.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d00f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e DAE4.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2040 3ab2727f7f5828d65aef29e052cab53d.exe 2040 3ab2727f7f5828d65aef29e052cab53d.exe 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1220 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 2040 3ab2727f7f5828d65aef29e052cab53d.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeShutdownPrivilege 1220 Process not Found Token: SeShutdownPrivilege 1220 Process not Found Token: SeDebugPrivilege 1884 E715.exe - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1220 Process not Found 1220 Process not Found 1220 Process not Found 1220 Process not Found - Suspicious use of WriteProcessMemory 38 IoCs
description pid Process procid_target PID 1220 wrote to memory of 580 1220 Process not Found 29 PID 1220 wrote to memory of 580 1220 Process not Found 29 PID 1220 wrote to memory of 580 1220 Process not Found 29 PID 1220 wrote to memory of 580 1220 Process not Found 29 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 580 wrote to memory of 740 580 DAE4.exe 30 PID 1220 wrote to memory of 1884 1220 Process not Found 31 PID 1220 wrote to memory of 1884 1220 Process not Found 31 PID 1220 wrote to memory of 1884 1220 Process not Found 31 PID 1220 wrote to memory of 1884 1220 Process not Found 31 PID 740 wrote to memory of 2012 740 DAE4.exe 35 PID 740 wrote to memory of 2012 740 DAE4.exe 35 PID 740 wrote to memory of 2012 740 DAE4.exe 35 PID 740 wrote to memory of 2012 740 DAE4.exe 35 PID 740 wrote to memory of 1832 740 DAE4.exe 36 PID 740 wrote to memory of 1832 740 DAE4.exe 36 PID 740 wrote to memory of 1832 740 DAE4.exe 36 PID 740 wrote to memory of 1832 740 DAE4.exe 36 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37 PID 1832 wrote to memory of 1140 1832 DAE4.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ab2727f7f5828d65aef29e052cab53d.exe"C:\Users\Admin\AppData\Local\Temp\3ab2727f7f5828d65aef29e052cab53d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2040
-
C:\Users\Admin\AppData\Local\Temp\DAE4.exeC:\Users\Admin\AppData\Local\Temp\DAE4.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:580 -
C:\Users\Admin\AppData\Local\Temp\DAE4.exeC:\Users\Admin\AppData\Local\Temp\DAE4.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:740 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\51c19c9f-3fa0-4e3e-ab0b-ba90515c5e2e" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:2012
-
-
C:\Users\Admin\AppData\Local\Temp\DAE4.exe"C:\Users\Admin\AppData\Local\Temp\DAE4.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\DAE4.exe"C:\Users\Admin\AppData\Local\Temp\DAE4.exe" --Admin IsNotAutoStart IsNotTask4⤵
- Executes dropped EXE
- Modifies system certificate store
PID:1140
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\E715.exeC:\Users\Admin\AppData\Local\Temp\E715.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1884