Analysis
-
max time kernel
150s -
max time network
190s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-10-2021 04:31
Static task
static1
Behavioral task
behavioral1
Sample
toolspab2.exe
Resource
win7-en-20210920
General
-
Target
toolspab2.exe
-
Size
334KB
-
MD5
c33f5b894962328a5167e37c51edecc3
-
SHA1
c91eb850ab475ff69b6869f30eabcb0fee887e71
-
SHA256
f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
-
SHA512
0e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/992-83-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/992-84-0x0000000000418D06-mapping.dmp family_redline behavioral1/memory/992-86-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
F576.exeF576.exe10A5.exe25AC.exe10A5.exepid process 852 F576.exe 1588 F576.exe 1452 10A5.exe 1592 25AC.exe 992 10A5.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
25AC.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 25AC.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 25AC.exe -
Deletes itself 1 IoCs
Processes:
pid process 1364 -
Loads dropped DLL 2 IoCs
Processes:
F576.exe10A5.exepid process 852 F576.exe 1452 10A5.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\25AC.exe themida behavioral1/memory/1592-81-0x0000000001110000-0x0000000001111000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
25AC.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 25AC.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
25AC.exepid process 1592 25AC.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
toolspab2.exeF576.exe10A5.exedescription pid process target process PID 736 set thread context of 1444 736 toolspab2.exe toolspab2.exe PID 852 set thread context of 1588 852 F576.exe F576.exe PID 1452 set thread context of 992 1452 10A5.exe 10A5.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
toolspab2.exeF576.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F576.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F576.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI F576.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspab2.exepid process 1444 toolspab2.exe 1444 toolspab2.exe 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 1364 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1364 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
toolspab2.exeF576.exepid process 1444 toolspab2.exe 1588 F576.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
25AC.exe10A5.exedescription pid process Token: SeShutdownPrivilege 1364 Token: SeShutdownPrivilege 1364 Token: SeShutdownPrivilege 1364 Token: SeDebugPrivilege 1592 25AC.exe Token: SeDebugPrivilege 992 10A5.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1364 1364 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1364 1364 -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
toolspab2.exeF576.exe10A5.exedescription pid process target process PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 736 wrote to memory of 1444 736 toolspab2.exe toolspab2.exe PID 1364 wrote to memory of 852 1364 F576.exe PID 1364 wrote to memory of 852 1364 F576.exe PID 1364 wrote to memory of 852 1364 F576.exe PID 1364 wrote to memory of 852 1364 F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 852 wrote to memory of 1588 852 F576.exe F576.exe PID 1364 wrote to memory of 1452 1364 10A5.exe PID 1364 wrote to memory of 1452 1364 10A5.exe PID 1364 wrote to memory of 1452 1364 10A5.exe PID 1364 wrote to memory of 1452 1364 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1364 wrote to memory of 1592 1364 25AC.exe PID 1364 wrote to memory of 1592 1364 25AC.exe PID 1364 wrote to memory of 1592 1364 25AC.exe PID 1364 wrote to memory of 1592 1364 25AC.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe PID 1452 wrote to memory of 992 1452 10A5.exe 10A5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F576.exeC:\Users\Admin\AppData\Local\Temp\F576.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\F576.exeC:\Users\Admin\AppData\Local\Temp\F576.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\10A5.exeC:\Users\Admin\AppData\Local\Temp\10A5.exe1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\10A5.exeC:\Users\Admin\AppData\Local\Temp\10A5.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\25AC.exeC:\Users\Admin\AppData\Local\Temp\25AC.exe1⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\10A5.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\10A5.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\10A5.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\25AC.exeMD5
d0c332dd942a7b680063c4eca607f2c4
SHA1d57b7c95c258c968e7e2f5cd39bf52928cd587fd
SHA256756f3dc3ceb0db783e3f1cabd10ee6a3af4688147adde714cdea6f226e5f0024
SHA51270abbdaedfbc7ff4fb06ccd619ad812cb2731e7448d5055a414a609d048fc95067594e2ee74f35284d671b8d618d1914232e20d5cc7d862726a3138c4ec61019
-
C:\Users\Admin\AppData\Local\Temp\F576.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
C:\Users\Admin\AppData\Local\Temp\F576.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
C:\Users\Admin\AppData\Local\Temp\F576.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
\Users\Admin\AppData\Local\Temp\10A5.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
\Users\Admin\AppData\Local\Temp\F576.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
memory/736-54-0x0000000000948000-0x0000000000959000-memory.dmpFilesize
68KB
-
memory/736-58-0x0000000000020000-0x0000000000029000-memory.dmpFilesize
36KB
-
memory/852-62-0x0000000000A28000-0x0000000000A39000-memory.dmpFilesize
68KB
-
memory/852-60-0x0000000000000000-mapping.dmp
-
memory/992-83-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/992-89-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB
-
memory/992-86-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/992-84-0x0000000000418D06-mapping.dmp
-
memory/1364-69-0x0000000003F50000-0x0000000003F66000-memory.dmpFilesize
88KB
-
memory/1364-59-0x0000000001C60000-0x0000000001C76000-memory.dmpFilesize
88KB
-
memory/1444-57-0x0000000075FC1000-0x0000000075FC3000-memory.dmpFilesize
8KB
-
memory/1444-56-0x0000000000402E0C-mapping.dmp
-
memory/1444-55-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1452-70-0x0000000000000000-mapping.dmp
-
memory/1452-73-0x0000000000C20000-0x0000000000C21000-memory.dmpFilesize
4KB
-
memory/1588-66-0x0000000000402E0C-mapping.dmp
-
memory/1592-81-0x0000000001110000-0x0000000001111000-memory.dmpFilesize
4KB
-
memory/1592-76-0x0000000000000000-mapping.dmp
-
memory/1592-88-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB