Analysis
- max time kernel
153s - max time network
154s - platform
windows7_x64 - resource
win7v20210410 - submitted
24/08/2021, 11:42
Static task
static1
Behavioral task
behavioral1
Sample
ed8f3190e30a52d989817d06142f9509.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ed8f3190e30a52d989817d06142f9509.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target ed8f3190e30a52d989817d06142f9509.exe
- Size 139KB
- Sample210824-3bd9m2c616
- SHA256 8f6aeab4ba06d05d419fa32d5d13df4c21636e926549ea58cb686e4b1b6c92ba
- MD5 ed8f3190e30a52d989817d06142f9509
- SHA1 5bc2e0fdeeb5a40bc29733f287b151569812901c
- SHA512 bac0bb60b9bf4e30a978063e5be79c7091eaaca027e79cec5e0fbfe94787b58e45595446b4b7b8f370429b5ea9a8fb6fcd9f3ef88c67ef542db102ec53b55524
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
smokeloader
Version
-
2020
C2
-
http://aucmoney.com/upload/
-
http://thegymmum.com/upload/
-
http://atvcampingtrips.com/upload/
-
http://kuapakualaman.com/upload/
-
http://renatazarazua.com/upload/
-
http://nasufmutlu.com/upload/
rc4.i32
rc4.i32
Extracted
Family
-
redline
C2
-
185.215.113.29:8678
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/808-77-0x0000000002D90000-0x0000000002DAD000-memory.dmp family_redline behavioral1/memory/808-78-0x00000000046C0000-0x00000000046DC000-memory.dmp family_redline - SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
pid Process 748 3BC8.exe 780 3BC8.exe 808 4847.exe 2036 3BC8.exe - Deletes itself 1 IoCs
pid Process 1200 Process not Found - Loads dropped DLL 3 IoCs
pid Process 748 3BC8.exe 780 3BC8.exe 780 3BC8.exe - Modifies file permissions 1 TTPs 1 IoCs
pid Process 1084 icacls.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\SysHelper = "\"C:\\Users\\Admin\\AppData\\Local\\d881f4d8-f7ae-42a0-8243-014b18da6261\\3BC8.exe\" --AutoStart" 3BC8.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 19 api.2ip.ua 20 api.2ip.ua - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 748 set thread context of 780 748 3BC8.exe 30 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ed8f3190e30a52d989817d06142f9509.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ed8f3190e30a52d989817d06142f9509.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ed8f3190e30a52d989817d06142f9509.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 3BC8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 3BC8.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa2030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e 3BC8.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1072 ed8f3190e30a52d989817d06142f9509.exe 1072 ed8f3190e30a52d989817d06142f9509.exe 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1200 Process not Found - Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 1072 ed8f3190e30a52d989817d06142f9509.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 1200 Process not Found Token: SeShutdownPrivilege 1200 Process not Found - Suspicious use of FindShellTrayWindow 4 IoCs
pid Process 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found - Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1200 Process not Found 1200 Process not Found 1200 Process not Found 1200 Process not Found - Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 1200 wrote to memory of 748 1200 Process not Found 29 PID 1200 wrote to memory of 748 1200 Process not Found 29 PID 1200 wrote to memory of 748 1200 Process not Found 29 PID 1200 wrote to memory of 748 1200 Process not Found 29 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 748 wrote to memory of 780 748 3BC8.exe 30 PID 1200 wrote to memory of 808 1200 Process not Found 31 PID 1200 wrote to memory of 808 1200 Process not Found 31 PID 1200 wrote to memory of 808 1200 Process not Found 31 PID 1200 wrote to memory of 808 1200 Process not Found 31 PID 780 wrote to memory of 1084 780 3BC8.exe 35 PID 780 wrote to memory of 1084 780 3BC8.exe 35 PID 780 wrote to memory of 1084 780 3BC8.exe 35 PID 780 wrote to memory of 1084 780 3BC8.exe 35 PID 780 wrote to memory of 2036 780 3BC8.exe 36 PID 780 wrote to memory of 2036 780 3BC8.exe 36 PID 780 wrote to memory of 2036 780 3BC8.exe 36 PID 780 wrote to memory of 2036 780 3BC8.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed8f3190e30a52d989817d06142f9509.exe"C:\Users\Admin\AppData\Local\Temp\ed8f3190e30a52d989817d06142f9509.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1072
-
C:\Users\Admin\AppData\Local\Temp\3BC8.exeC:\Users\Admin\AppData\Local\Temp\3BC8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Users\Admin\AppData\Local\Temp\3BC8.exeC:\Users\Admin\AppData\Local\Temp\3BC8.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:780 -
C:\Windows\SysWOW64\icacls.exeicacls "C:\Users\Admin\AppData\Local\d881f4d8-f7ae-42a0-8243-014b18da6261" /deny *S-1-1-0:(OI)(CI)(DE,DC)3⤵
- Modifies file permissions
PID:1084
-
-
C:\Users\Admin\AppData\Local\Temp\3BC8.exe"C:\Users\Admin\AppData\Local\Temp\3BC8.exe" --Admin IsNotAutoStart IsNotTask3⤵
- Executes dropped EXE
PID:2036
-
-
-
C:\Users\Admin\AppData\Local\Temp\4847.exeC:\Users\Admin\AppData\Local\Temp\4847.exe1⤵
- Executes dropped EXE
PID:808