Analysis
- max time kernel
151s - max time network
147s - platform
windows10_x64 - resource
win10-en - submitted
20/09/2021, 03:31
General
- Target a8f9a08868396c691207daaafe596569.exe
- Size 243KB
- Sample210920-d22qdsfdcq
- SHA256 90ce980b980b372a90c20b959ee2ad27dcea764ce2e858043a8e02aa307cf3b1
Malware Config
Extracted
-
smokeloader
-
2020
-
http://venerynnet1.top/
-
http://kevonahira2.top/
-
http://vegangelist3.top/
-
http://kingriffaele4.top/
-
http://arakeishant5.top/
Extracted
-
redline
-
New777
-
45.67.231.145:10991
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 5 IoCs
- Reads user/profile data of local email clients 2 TTPs
Email clients store some user data on disk where infostealers will often target it.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Delays execution with timeout.exe 1 IoCs
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 35 IoCs
- Suspicious use of FindShellTrayWindow 9 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"C:\Users\Admin\AppData\Local\Temp\a8f9a08868396c691207daaafe596569.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Users\Admin\AppData\Local\Temp\46C8.exeC:\Users\Admin\AppData\Local\Temp\46C8.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd.exe /C timeout /T 10 /NOBREAK > Nul & Del /f /q "C:\Users\Admin\AppData\Local\Temp\46C8.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /T 10 /NOBREAK3⤵
- Delays execution with timeout.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\49D6.exeC:\Users\Admin\AppData\Local\Temp\49D6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBzACAAMgAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\49D6.exeC:\Users\Admin\AppData\Local\Temp\49D6.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\53CA.exeC:\Users\Admin\AppData\Local\Temp\53CA.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/356-153-0x0000000000A00000-0x0000000000A90000-memory.dmp
memory/356-154-0x0000000000400000-0x0000000000493000-memory.dmp
memory/2064-182-0x0000000006F90000-0x0000000006F91000-memory.dmp
memory/2064-178-0x0000000004EC0000-0x0000000004EC1000-memory.dmp
memory/2064-177-0x0000000004E80000-0x0000000004E81000-memory.dmp
memory/2064-187-0x0000000006C40000-0x0000000006C41000-memory.dmp
memory/2064-176-0x0000000004F20000-0x0000000004F21000-memory.dmp
memory/2064-175-0x0000000004DF0000-0x0000000004DF1000-memory.dmp
memory/2064-174-0x0000000005400000-0x0000000005401000-memory.dmp
memory/2064-168-0x0000000000400000-0x0000000000422000-memory.dmp
memory/2064-180-0x0000000004DF0000-0x00000000053F6000-memory.dmp
memory/2064-181-0x0000000006890000-0x0000000006891000-memory.dmp
memory/2892-125-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/2892-135-0x0000000004A00000-0x0000000004EFE000-memory.dmp
memory/2892-167-0x0000000006E00000-0x0000000006E19000-memory.dmp
memory/2892-129-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
memory/2892-130-0x0000000004A60000-0x0000000004A61000-memory.dmp
memory/2892-127-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/2892-166-0x0000000004EA0000-0x0000000004ED4000-memory.dmp
memory/2964-118-0x0000000002480000-0x0000000002495000-memory.dmp
memory/3952-134-0x0000000005330000-0x0000000005331000-memory.dmp
memory/3952-144-0x0000000008420000-0x0000000008421000-memory.dmp
memory/3952-162-0x0000000009820000-0x0000000009821000-memory.dmp
memory/3952-148-0x0000000007BF0000-0x0000000007BF1000-memory.dmp
memory/3952-179-0x0000000007613000-0x0000000007614000-memory.dmp
memory/3952-150-0x0000000008B00000-0x0000000008B01000-memory.dmp
memory/3952-161-0x000000000A150000-0x000000000A151000-memory.dmp
memory/3952-143-0x0000000008380000-0x0000000008381000-memory.dmp
memory/3952-139-0x0000000007612000-0x0000000007613000-memory.dmp
memory/3952-138-0x0000000007610000-0x0000000007611000-memory.dmp
memory/3952-142-0x0000000007B00000-0x0000000007B01000-memory.dmp
memory/3952-141-0x0000000007A60000-0x0000000007A61000-memory.dmp
memory/3952-149-0x0000000008C60000-0x0000000008C61000-memory.dmp
memory/3952-137-0x0000000007C50000-0x0000000007C51000-memory.dmp
memory/3996-117-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4016-115-0x0000000000400000-0x0000000000408000-memory.dmp
memory/4020-128-0x0000000000B70000-0x0000000000C42000-memory.dmp
memory/4020-136-0x0000000000400000-0x0000000000563000-memory.dmp