Overview

overview

10

Static

static

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows7_x64

10

c8c2f5565b...24.exe

windows11_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

c8c2f5565b...24.exe

windows10_x64

10

Resubmissions

26-09-2021 14:45

210926-r4qb2aehcm 10

26-09-2021 14:41

210926-r2wq2afaa9 10

Analysis

  • max time kernel
    603s
  • max time network
    400s
  • platform
    windows10_x64
  • resource
    win10-ja-20210920
  • submitted
    26-09-2021 14:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe

  • Size

    139KB

  • MD5

    3e201fc20a90e669990e2994d2114b83

  • SHA1

    24bfc9636c793e7ceb309b08e319b2d925a080bd

  • SHA256

    c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24

  • SHA512

    4dae9203c1003ca32600d153d7a9f08fa3c50d7c665ee81d4d7608d8f47354e48493d4bb39af2a3259c7882ca0ba38f4db52033b0df3ddf4321cb7118b228591

Score
10/10
redlinesmokeloaderinstallszxcz0rm1onbuildbackdoordiscoveryinfostealerpersistencespywarestealertrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://naghenrietti1.top/

http://kimballiett2.top/

http://xadriettany3.top/

http://jebeccallis4.top/

http://nityanneron5.top/

http://umayaniela6.top/

http://lynettaram7.top/

http://sadineyalas8.top/

http://geenaldencia9.top/

http://aradysiusep10.top/
rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

installszxc

C2

138.124.186.2:27999

Extracted

Family

redline

Botnet

z0rm1onbuild

C2

45.156.21.209:56326

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Registers COM server for autorun 1 TTPs
    persistence
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Deletes itself 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Drops file in System32 directory 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 23 IoCs
  • Modifies registry class 47 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 43 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe
    "C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3320
    • C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe
      "C:\Users\Admin\AppData\Local\Temp\c8c2f5565b13fbb60b89d11b7e71a03666c3afb2246b87e633cac8023bec0b24.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1420
  • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe
    "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.170.0822.0002\FileSyncConfig.exe"
    1⤵
    • Modifies registry class
    PID:2464
  • C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe
    "C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False
    1⤵
    • Drops file in System32 directory
    • Modifies data under HKEY_USERS
    • Suspicious use of SetWindowsHookEx
    PID:1664
  • C:\Users\Admin\AppData\Roaming\wtwtwrf
    C:\Users\Admin\AppData\Roaming\wtwtwrf
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3188
    • C:\Users\Admin\AppData\Roaming\wtwtwrf
      C:\Users\Admin\AppData\Roaming\wtwtwrf
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:2688
  • C:\Users\Admin\AppData\Local\Temp\2DF3.exe
    C:\Users\Admin\AppData\Local\Temp\2DF3.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3792
    • C:\ProgramData\Stub.exe
      "C:\ProgramData\Stub.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:2800
  • C:\Users\Admin\AppData\Local\Temp\D669.exe
    C:\Users\Admin\AppData\Local\Temp\D669.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:2484

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1420-115-0x0000000000400000-0x0000000000409000-memory.dmp

    Filesize

    36KB

    Download

  • memory/2484-164-0x000000001D0E0000-0x000000001D0E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-160-0x0000000002710000-0x0000000002711000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-165-0x000000001C8D0000-0x000000001C8D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-167-0x000000001D720000-0x000000001D721000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-168-0x0000000000A42000-0x0000000000A44000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2484-163-0x000000001C9E0000-0x000000001C9E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-162-0x000000001C6E0000-0x000000001C6E1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-161-0x0000000000A40000-0x0000000000A42000-memory.dmp

    Filesize

    8KB

    Download

  • memory/2484-166-0x000000001C850000-0x000000001C851000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-159-0x00000000026B0000-0x00000000026B1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-158-0x000000001C2A0000-0x000000001C2A1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-157-0x0000000002660000-0x000000000267E000-memory.dmp

    Filesize

    120KB

    Download

  • memory/2484-156-0x00000000004F0000-0x00000000004F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-170-0x000000001C950000-0x000000001C951000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2484-169-0x0000000000A44000-0x0000000000A45000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-144-0x0000000007330000-0x0000000007331000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-148-0x0000000007500000-0x0000000007501000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-149-0x00000000077C0000-0x00000000077C1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-150-0x00000000075F0000-0x00000000075F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-151-0x0000000008560000-0x0000000008561000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-152-0x00000000085D0000-0x00000000085D1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-146-0x0000000007F60000-0x0000000007F61000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-145-0x0000000007A30000-0x0000000007A31000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-143-0x0000000006AA0000-0x0000000006AA1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-142-0x0000000005790000-0x0000000005791000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-141-0x0000000003380000-0x0000000003381000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-140-0x0000000005750000-0x0000000005751000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-147-0x0000000007610000-0x0000000007611000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-138-0x0000000005820000-0x0000000005821000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-137-0x0000000003200000-0x0000000003201000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-136-0x0000000005D20000-0x0000000005D21000-memory.dmp

    Filesize

    4KB

    Download

  • memory/2800-134-0x0000000000E50000-0x0000000000E51000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3052-139-0x0000000000D60000-0x0000000000D76000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3052-118-0x0000000000770000-0x0000000000786000-memory.dmp

    Filesize

    88KB

    Download

  • memory/3188-124-0x00000000004B0000-0x000000000055E000-memory.dmp

    Filesize

    696KB

    Download

  • memory/3320-117-0x00000000021C0000-0x00000000021C9000-memory.dmp

    Filesize

    36KB

    Download

  • memory/3792-130-0x0000000005000000-0x0000000005001000-memory.dmp

    Filesize

    4KB

    Download

  • memory/3792-128-0x0000000000730000-0x0000000000731000-memory.dmp

    Filesize

    4KB

    Download