Analysis

  • max time kernel
    153s
  • max time network
    103s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    10-10-2021 21:56

General

  • Target

    SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe

  • Size

    336KB

  • MD5

    435d4757bcfe29c1f1ea289a2566a3ed

  • SHA1

    105406f798f7b8a0b8532a64ad9061e5ae447cdc

  • SHA256

    56ae4932aafb8ed85c51038e2f003e829addf08a197890c8989bf0bdc51e7f49

  • SHA512

    8b91b78ad5893a0f2a0a0f4f2c99e061a659c5a534daa1e5d23c1f0af861d38cd05e6c9e0e50474106d8fb61e6e10a14025dd3f4d540ef1e67bd9a6edb1622bb

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://gmpeople.com/upload/

http://mile48.com/upload/

http://lecanardstsornin.com/upload/

http://m3600.com/upload/

http://camasirx.com/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

new

C2

45.9.20.107:46187

Extracted

Family

redline

Botnet

New1

C2

45.140.146.88:57313

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

    suricata: ET MALWARE Single char EXE direct download likely trojan (multiple families)

  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies system certificate store 2 TTPs 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.AIDetect.malware1.32537.18714.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1652
  • C:\Users\Admin\AppData\Local\Temp\EC90.exe
    C:\Users\Admin\AppData\Local\Temp\EC90.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:1852
  • C:\Users\Admin\AppData\Local\Temp\F5E4.exe
    C:\Users\Admin\AppData\Local\Temp\F5E4.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1960
    • C:\Users\Admin\AppData\Local\Temp\F5E4.exe
      "C:\Users\Admin\AppData\Local\Temp\F5E4.exe"
      2⤵
      • Executes dropped EXE
      • Modifies system certificate store
      PID:764

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\EC90.exe
    MD5

    cb62283bfe3b9bbc745172bc4c1b3a15

    SHA1

    9ac479f4453f6c447c2dbc61c59751548d799721

    SHA256

    626d2d7793e94e5492e0c16aa9a2f24e1785b5b280d5ae28efef2ede9220653a

    SHA512

    cd830492fa4bb096a67564ca455053243cf3666e014b7c61c99305da26e272ce3766f724610fb8107499de8351615318447a4cdccfedf30142fd6186100dab53

  • C:\Users\Admin\AppData\Local\Temp\F5E4.exe
    MD5

    acd58a65e9d362fc8eeac3c4c4e2be11

    SHA1

    956980abda3bfbad427a24d702c09222e13ab53b

    SHA256

    d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898

    SHA512

    4023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645

  • C:\Users\Admin\AppData\Local\Temp\F5E4.exe
    MD5

    acd58a65e9d362fc8eeac3c4c4e2be11

    SHA1

    956980abda3bfbad427a24d702c09222e13ab53b

    SHA256

    d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898

    SHA512

    4023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645

  • C:\Users\Admin\AppData\Local\Temp\F5E4.exe
    MD5

    acd58a65e9d362fc8eeac3c4c4e2be11

    SHA1

    956980abda3bfbad427a24d702c09222e13ab53b

    SHA256

    d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898

    SHA512

    4023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645

  • \Users\Admin\AppData\Local\Temp\F5E4.exe
    MD5

    acd58a65e9d362fc8eeac3c4c4e2be11

    SHA1

    956980abda3bfbad427a24d702c09222e13ab53b

    SHA256

    d45c78005f74a5b25a2c9631bb13b069433701d3e65b5d648ee1839252264898

    SHA512

    4023f10131faf541e593c667b86106ad710123ed90db68537a70318449ccc2282d08d01d5807e5671eaa921dd7f53a679d564bf738ca1d938235bdedfc30e645

  • memory/764-87-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/764-92-0x000000000041B23A-mapping.dmp
  • memory/764-91-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/764-90-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/764-89-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/764-88-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB

  • memory/1220-64-0x0000000002BE0000-0x0000000002BF5000-memory.dmp
    Filesize

    84KB

  • memory/1652-63-0x0000000000400000-0x00000000016C7000-memory.dmp
    Filesize

    18.8MB

  • memory/1652-62-0x0000000000220000-0x0000000000229000-memory.dmp
    Filesize

    36KB

  • memory/1652-60-0x000000000178B000-0x000000000179C000-memory.dmp
    Filesize

    68KB

  • memory/1652-61-0x00000000754F1000-0x00000000754F3000-memory.dmp
    Filesize

    8KB

  • memory/1852-77-0x0000000005910000-0x000000000592D000-memory.dmp
    Filesize

    116KB

  • memory/1852-75-0x0000000005AA1000-0x0000000005AA2000-memory.dmp
    Filesize

    4KB

  • memory/1852-79-0x0000000005AA3000-0x0000000005AA4000-memory.dmp
    Filesize

    4KB

  • memory/1852-65-0x0000000000000000-mapping.dmp
  • memory/1852-80-0x0000000005AA4000-0x0000000005AA6000-memory.dmp
    Filesize

    8KB

  • memory/1852-78-0x0000000005AA2000-0x0000000005AA3000-memory.dmp
    Filesize

    4KB

  • memory/1852-67-0x00000000002EB000-0x000000000030E000-memory.dmp
    Filesize

    140KB

  • memory/1852-68-0x00000000001C0000-0x00000000001F0000-memory.dmp
    Filesize

    192KB

  • memory/1852-74-0x0000000000400000-0x00000000016DA000-memory.dmp
    Filesize

    18.9MB

  • memory/1852-76-0x00000000032D0000-0x00000000032EF000-memory.dmp
    Filesize

    124KB

  • memory/1960-82-0x0000000001170000-0x0000000001191000-memory.dmp
    Filesize

    132KB

  • memory/1960-85-0x00000000011E0000-0x00000000011E1000-memory.dmp
    Filesize

    4KB

  • memory/1960-72-0x00000000013E0000-0x00000000013E1000-memory.dmp
    Filesize

    4KB

  • memory/1960-69-0x0000000000000000-mapping.dmp
  • memory/1960-84-0x00000000012D0000-0x00000000012DB000-memory.dmp
    Filesize

    44KB

  • memory/1960-83-0x0000000004C81000-0x0000000004C82000-memory.dmp
    Filesize

    4KB

  • memory/1960-81-0x0000000004C80000-0x0000000004C81000-memory.dmp
    Filesize

    4KB