Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
24-10-2021 03:07
Static task
static1
Behavioral task
behavioral1
Sample
toolspab2.exe
Resource
win7-en-20211014
General
-
Target
toolspab2.exe
-
Size
334KB
-
MD5
c33f5b894962328a5167e37c51edecc3
-
SHA1
c91eb850ab475ff69b6869f30eabcb0fee887e71
-
SHA256
f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
-
SHA512
0e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1196-87-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1196-88-0x0000000000418D06-mapping.dmp family_redline behavioral1/memory/1196-90-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
A2F3.exeA2F3.exeBD57.exeBD57.exeD387.exeBD57.exepid process 2008 A2F3.exe 1996 A2F3.exe 1768 BD57.exe 1556 BD57.exe 1632 D387.exe 1196 BD57.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
D387.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion D387.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion D387.exe -
Deletes itself 1 IoCs
Processes:
pid process 1412 -
Loads dropped DLL 3 IoCs
Processes:
A2F3.exeBD57.exepid process 2008 A2F3.exe 1768 BD57.exe 1768 BD57.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\D387.exe themida behavioral1/memory/1632-84-0x00000000001A0000-0x00000000001A1000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
D387.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA D387.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
D387.exepid process 1632 D387.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
toolspab2.exeA2F3.exeBD57.exedescription pid process target process PID 1116 set thread context of 520 1116 toolspab2.exe toolspab2.exe PID 2008 set thread context of 1996 2008 A2F3.exe A2F3.exe PID 1768 set thread context of 1196 1768 BD57.exe BD57.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspab2.exeA2F3.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A2F3.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A2F3.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A2F3.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspab2.exepid process 520 toolspab2.exe 520 toolspab2.exe 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 1412 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1412 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
toolspab2.exeA2F3.exepid process 520 toolspab2.exe 1996 A2F3.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
BD57.exeD387.exedescription pid process Token: SeShutdownPrivilege 1412 Token: SeShutdownPrivilege 1412 Token: SeShutdownPrivilege 1412 Token: SeDebugPrivilege 1196 BD57.exe Token: SeDebugPrivilege 1632 D387.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1412 1412 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1412 1412 -
Suspicious use of WriteProcessMemory 44 IoCs
Processes:
toolspab2.exeA2F3.exeBD57.exedescription pid process target process PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1116 wrote to memory of 520 1116 toolspab2.exe toolspab2.exe PID 1412 wrote to memory of 2008 1412 A2F3.exe PID 1412 wrote to memory of 2008 1412 A2F3.exe PID 1412 wrote to memory of 2008 1412 A2F3.exe PID 1412 wrote to memory of 2008 1412 A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 2008 wrote to memory of 1996 2008 A2F3.exe A2F3.exe PID 1412 wrote to memory of 1768 1412 BD57.exe PID 1412 wrote to memory of 1768 1412 BD57.exe PID 1412 wrote to memory of 1768 1412 BD57.exe PID 1412 wrote to memory of 1768 1412 BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1556 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1412 wrote to memory of 1632 1412 D387.exe PID 1412 wrote to memory of 1632 1412 D387.exe PID 1412 wrote to memory of 1632 1412 D387.exe PID 1412 wrote to memory of 1632 1412 D387.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe PID 1768 wrote to memory of 1196 1768 BD57.exe BD57.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A2F3.exeC:\Users\Admin\AppData\Local\Temp\A2F3.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A2F3.exeC:\Users\Admin\AppData\Local\Temp\A2F3.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeC:\Users\Admin\AppData\Local\Temp\BD57.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeC:\Users\Admin\AppData\Local\Temp\BD57.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeC:\Users\Admin\AppData\Local\Temp\BD57.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\D387.exeC:\Users\Admin\AppData\Local\Temp\D387.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\A2F3.exeMD5
c33f5b894962328a5167e37c51edecc3
SHA1c91eb850ab475ff69b6869f30eabcb0fee887e71
SHA256f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
SHA5120e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
-
C:\Users\Admin\AppData\Local\Temp\A2F3.exeMD5
c33f5b894962328a5167e37c51edecc3
SHA1c91eb850ab475ff69b6869f30eabcb0fee887e71
SHA256f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
SHA5120e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
-
C:\Users\Admin\AppData\Local\Temp\A2F3.exeMD5
c33f5b894962328a5167e37c51edecc3
SHA1c91eb850ab475ff69b6869f30eabcb0fee887e71
SHA256f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
SHA5120e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\BD57.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\D387.exeMD5
d0c332dd942a7b680063c4eca607f2c4
SHA1d57b7c95c258c968e7e2f5cd39bf52928cd587fd
SHA256756f3dc3ceb0db783e3f1cabd10ee6a3af4688147adde714cdea6f226e5f0024
SHA51270abbdaedfbc7ff4fb06ccd619ad812cb2731e7448d5055a414a609d048fc95067594e2ee74f35284d671b8d618d1914232e20d5cc7d862726a3138c4ec61019
-
\Users\Admin\AppData\Local\Temp\A2F3.exeMD5
c33f5b894962328a5167e37c51edecc3
SHA1c91eb850ab475ff69b6869f30eabcb0fee887e71
SHA256f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
SHA5120e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
-
\Users\Admin\AppData\Local\Temp\BD57.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
\Users\Admin\AppData\Local\Temp\BD57.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
memory/520-57-0x0000000000402E0C-mapping.dmp
-
memory/520-56-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/520-58-0x0000000075901000-0x0000000075903000-memory.dmpFilesize
8KB
-
memory/1116-55-0x0000000000918000-0x0000000000929000-memory.dmpFilesize
68KB
-
memory/1116-59-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/1196-92-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/1196-90-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1196-88-0x0000000000418D06-mapping.dmp
-
memory/1196-87-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1412-70-0x0000000003940000-0x0000000003956000-memory.dmpFilesize
88KB
-
memory/1412-60-0x0000000002990000-0x00000000029A6000-memory.dmpFilesize
88KB
-
memory/1632-79-0x0000000000000000-mapping.dmp
-
memory/1632-84-0x00000000001A0000-0x00000000001A1000-memory.dmpFilesize
4KB
-
memory/1632-86-0x0000000005430000-0x0000000005431000-memory.dmpFilesize
4KB
-
memory/1768-74-0x0000000000830000-0x0000000000831000-memory.dmpFilesize
4KB
-
memory/1768-71-0x0000000000000000-mapping.dmp
-
memory/1996-67-0x0000000000402E0C-mapping.dmp
-
memory/2008-61-0x0000000000000000-mapping.dmp
-
memory/2008-63-0x0000000000958000-0x0000000000969000-memory.dmpFilesize
68KB