Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10_x64 -
resource
win10-de-20211014 -
submitted
24-10-2021 04:37
Static task
static1
Behavioral task
behavioral1
Sample
toolspab2.exe
Resource
win10-de-20211014
General
-
Target
toolspab2.exe
-
Size
334KB
-
MD5
c33f5b894962328a5167e37c51edecc3
-
SHA1
c91eb850ab475ff69b6869f30eabcb0fee887e71
-
SHA256
f3f3e212e84f0c9c375aa5bc3d9de63c2ddc2b5704d784006067390abaae57b3
-
SHA512
0e331f7f16312edd361cd3e238d92a01952524af1ad8e348731b4fbdb47ef86224b606b3c6a4f67511dceb5a30e77d7357ee9457e16ef99f86283432b04d4937
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3896-133-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3896-134-0x0000000000418D06-mapping.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
80E4.exe80E4.exe5FAC.exe5FAC.exepid process 4016 80E4.exe 2996 80E4.exe 3612 5FAC.exe 3896 5FAC.exe -
Deletes itself 1 IoCs
Processes:
pid process 2540 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 4 IoCs
Processes:
OfficeC2RClient.exedescription ioc process File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\INetCache\counters2.dat OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-wal OfficeC2RClient.exe File opened for modification C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Office\OTele\officec2rclient.exe.db-shm OfficeC2RClient.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
toolspab2.exe80E4.exe5FAC.exedescription pid process target process PID 1028 set thread context of 1312 1028 toolspab2.exe toolspab2.exe PID 4016 set thread context of 2996 4016 80E4.exe 80E4.exe PID 3612 set thread context of 3896 3612 5FAC.exe 5FAC.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
80E4.exetoolspab2.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 80E4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 80E4.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI toolspab2.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 80E4.exe -
Modifies data under HKEY_USERS 22 IoCs
Processes:
OfficeC2RClient.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSTagIds0 = "5804129,17110992,7202269,17110988,7153487,39965824,17962391,17962392,3702920,3462423,3700754,3965062,4297094,7153421,18716193,7153435,7202265,20502174,6308191,18407617" OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor\ULSCategoriesSeverities = "1329 10,1329 50,941 10,1329 15,941 15,941 6,1329 100,1329 6" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\officeclicktorun\Overrides OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\ExternalFeatureOverrides\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\ConfigContextData OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "1" OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\TrustCenter\Experimentation OfficeC2RClient.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs\officeclicktorun\Expires = "int64_t|1635136743" OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\Ecs OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentConfigs\FirstSession\officeclicktorun OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe\ULSMonitor OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ExperimentEcs\all\Overrides OfficeC2RClient.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\LanguageResources\EnabledEditingLanguages\en-US = "2" OfficeC2RClient.exe Key deleted \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0\Common\ClientTelemetry\RulesMetadata\officec2rclient.exe OfficeC2RClient.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Office\16.0 OfficeC2RClient.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
toolspab2.exepid process 1312 toolspab2.exe 1312 toolspab2.exe 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 2540 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2540 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
toolspab2.exe80E4.exepid process 1312 toolspab2.exe 2996 80E4.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
Processes:
5FAC.exedescription pid process Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeDebugPrivilege 3896 5FAC.exe Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 Token: SeShutdownPrivilege 2540 Token: SeCreatePagefilePrivilege 2540 -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
OfficeC2RClient.exepid process 2948 OfficeC2RClient.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
toolspab2.exe80E4.exe5FAC.exedescription pid process target process PID 1028 wrote to memory of 1312 1028 toolspab2.exe toolspab2.exe PID 1028 wrote to memory of 1312 1028 toolspab2.exe toolspab2.exe PID 1028 wrote to memory of 1312 1028 toolspab2.exe toolspab2.exe PID 1028 wrote to memory of 1312 1028 toolspab2.exe toolspab2.exe PID 1028 wrote to memory of 1312 1028 toolspab2.exe toolspab2.exe PID 1028 wrote to memory of 1312 1028 toolspab2.exe toolspab2.exe PID 2540 wrote to memory of 4016 2540 80E4.exe PID 2540 wrote to memory of 4016 2540 80E4.exe PID 2540 wrote to memory of 4016 2540 80E4.exe PID 4016 wrote to memory of 2996 4016 80E4.exe 80E4.exe PID 4016 wrote to memory of 2996 4016 80E4.exe 80E4.exe PID 4016 wrote to memory of 2996 4016 80E4.exe 80E4.exe PID 4016 wrote to memory of 2996 4016 80E4.exe 80E4.exe PID 4016 wrote to memory of 2996 4016 80E4.exe 80E4.exe PID 4016 wrote to memory of 2996 4016 80E4.exe 80E4.exe PID 2540 wrote to memory of 3612 2540 5FAC.exe PID 2540 wrote to memory of 3612 2540 5FAC.exe PID 2540 wrote to memory of 3612 2540 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe PID 3612 wrote to memory of 3896 3612 5FAC.exe 5FAC.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"C:\Users\Admin\AppData\Local\Temp\toolspab2.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\80E4.exeC:\Users\Admin\AppData\Local\Temp\80E4.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\80E4.exeC:\Users\Admin\AppData\Local\Temp\80E4.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe"C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe" /frequentupdate SCHEDULEDTASK displaylevel=False1⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\5FAC.exeC:\Users\Admin\AppData\Local\Temp\5FAC.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\5FAC.exeC:\Users\Admin\AppData\Local\Temp\5FAC.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\5FAC.exe.logMD5
605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3
-
C:\Users\Admin\AppData\Local\Temp\5FAC.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\5FAC.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\5FAC.exeMD5
a9cf6b07b6ee36d4986bd67429634417
SHA15343ed7b750d6f4b4710380bbd14301936db982e
SHA25656ea2e765364d6f517e434e8238c96fb0fffef20c8714cf55d41ab98163e66e5
SHA5124e6a3cbfb3b80abc8f5e23c7142097a180154eec2fa0737378930bba26a14f7601bb8d2d748b2a188cc674656fdfff90d0d5843e23e8c3db8541f5a061fd8af7
-
C:\Users\Admin\AppData\Local\Temp\80E4.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
C:\Users\Admin\AppData\Local\Temp\80E4.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
C:\Users\Admin\AppData\Local\Temp\80E4.exeMD5
661a32c0d713d6ee0d478904c088b2d3
SHA124875cfbea7f8b45af94e3bb1ba8fb4541b9fa11
SHA256b6caee45c87c15b789975b63f5ee6edfb1be6c7ef8c5854c2decdfe501797fc0
SHA512a1809692b3a8eba590357735c4d5c5cf2716af4c52103662326f02951820846b513604eda0902399cb461d8879208ae9cc0a653a9712ccf9cc4e73221449ccbe
-
memory/1028-116-0x00000000001C0000-0x00000000001C9000-memory.dmpFilesize
36KB
-
memory/1028-115-0x0000000000B71000-0x0000000000B82000-memory.dmpFilesize
68KB
-
memory/1312-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/1312-118-0x0000000000402E0C-mapping.dmp
-
memory/2540-119-0x0000000000610000-0x0000000000626000-memory.dmpFilesize
88KB
-
memory/2540-127-0x0000000000720000-0x0000000000736000-memory.dmpFilesize
88KB
-
memory/2996-125-0x0000000000402E0C-mapping.dmp
-
memory/3612-128-0x0000000000000000-mapping.dmp
-
memory/3612-131-0x0000000000460000-0x0000000000461000-memory.dmpFilesize
4KB
-
memory/3612-136-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/3896-143-0x0000000004DB0000-0x0000000004DB1000-memory.dmpFilesize
4KB
-
memory/3896-145-0x0000000005A00000-0x0000000005A01000-memory.dmpFilesize
4KB
-
memory/3896-133-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3896-139-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/3896-140-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/3896-141-0x0000000004E40000-0x0000000004E41000-memory.dmpFilesize
4KB
-
memory/3896-142-0x0000000004D70000-0x0000000004D71000-memory.dmpFilesize
4KB
-
memory/3896-153-0x0000000007130000-0x0000000007131000-memory.dmpFilesize
4KB
-
memory/3896-144-0x0000000004C80000-0x0000000005286000-memory.dmpFilesize
6.0MB
-
memory/3896-134-0x0000000000418D06-mapping.dmp
-
memory/3896-146-0x0000000005AB0000-0x0000000005AB1000-memory.dmpFilesize
4KB
-
memory/3896-147-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/3896-148-0x0000000005DC0000-0x0000000005DC1000-memory.dmpFilesize
4KB
-
memory/3896-149-0x0000000006360000-0x0000000006361000-memory.dmpFilesize
4KB
-
memory/3896-150-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/3896-152-0x0000000006A30000-0x0000000006A31000-memory.dmpFilesize
4KB
-
memory/4016-123-0x0000000000AD1000-0x0000000000AE1000-memory.dmpFilesize
64KB
-
memory/4016-120-0x0000000000000000-mapping.dmp