Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
25-10-2021 03:29
Static task
static1
Behavioral task
behavioral1
Sample
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe
Resource
win10-en-20211014
General
-
Target
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe
-
Size
336KB
-
MD5
cf087f0c96950b797ba3213d2383acaa
-
SHA1
8c2b04a0c3868e16f0265bb6c3242e1c7a62c156
-
SHA256
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
-
SHA512
abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1460-141-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral1/memory/1460-142-0x000000000043713E-mapping.dmp family_redline behavioral1/memory/1828-161-0x0000000000418D2A-mapping.dmp family_redline behavioral1/memory/1828-160-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
Processes:
frrawjafrrawja8950.exe8950.exe673E.exe7A79.exe673E.exe7A79.exepid process 3988 frrawja 2980 frrawja 3160 8950.exe 64 8950.exe 708 673E.exe 2904 7A79.exe 1460 673E.exe 1828 7A79.exe -
Deletes itself 1 IoCs
Processes:
pid process 3004 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 5 IoCs
Processes:
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exefrrawja8950.exe673E.exe7A79.exedescription pid process target process PID 2708 set thread context of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 3988 set thread context of 2980 3988 frrawja frrawja PID 3160 set thread context of 64 3160 8950.exe 8950.exe PID 708 set thread context of 1460 708 673E.exe 673E.exe PID 2904 set thread context of 1828 2904 7A79.exe 7A79.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3040 1828 WerFault.exe 7A79.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exefrrawjadescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI frrawja Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI frrawja Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI frrawja Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exepid process 3136 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe 3136 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 3004 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3004 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exefrrawjapid process 3136 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe 2980 frrawja -
Suspicious use of AdjustPrivilegeToken 31 IoCs
Processes:
673E.exedescription pid process Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeDebugPrivilege 1460 673E.exe Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 Token: SeShutdownPrivilege 3004 Token: SeCreatePagefilePrivilege 3004 -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exefrrawja8950.exe673E.exe7A79.exedescription pid process target process PID 2708 wrote to memory of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 2708 wrote to memory of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 2708 wrote to memory of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 2708 wrote to memory of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 2708 wrote to memory of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 2708 wrote to memory of 3136 2708 ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe PID 3988 wrote to memory of 2980 3988 frrawja frrawja PID 3988 wrote to memory of 2980 3988 frrawja frrawja PID 3988 wrote to memory of 2980 3988 frrawja frrawja PID 3988 wrote to memory of 2980 3988 frrawja frrawja PID 3988 wrote to memory of 2980 3988 frrawja frrawja PID 3988 wrote to memory of 2980 3988 frrawja frrawja PID 3004 wrote to memory of 3160 3004 8950.exe PID 3004 wrote to memory of 3160 3004 8950.exe PID 3004 wrote to memory of 3160 3004 8950.exe PID 3160 wrote to memory of 64 3160 8950.exe 8950.exe PID 3160 wrote to memory of 64 3160 8950.exe 8950.exe PID 3160 wrote to memory of 64 3160 8950.exe 8950.exe PID 3160 wrote to memory of 64 3160 8950.exe 8950.exe PID 3160 wrote to memory of 64 3160 8950.exe 8950.exe PID 3160 wrote to memory of 64 3160 8950.exe 8950.exe PID 3004 wrote to memory of 708 3004 673E.exe PID 3004 wrote to memory of 708 3004 673E.exe PID 3004 wrote to memory of 708 3004 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 3004 wrote to memory of 2904 3004 7A79.exe PID 3004 wrote to memory of 2904 3004 7A79.exe PID 3004 wrote to memory of 2904 3004 7A79.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 708 wrote to memory of 1460 708 673E.exe 673E.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe PID 2904 wrote to memory of 1828 2904 7A79.exe 7A79.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe"C:\Users\Admin\AppData\Local\Temp\ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe"C:\Users\Admin\AppData\Local\Temp\ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Roaming\frrawjaC:\Users\Admin\AppData\Roaming\frrawja1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\frrawjaC:\Users\Admin\AppData\Roaming\frrawja2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\8950.exeC:\Users\Admin\AppData\Local\Temp\8950.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8950.exeC:\Users\Admin\AppData\Local\Temp\8950.exe2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\673E.exeC:\Users\Admin\AppData\Local\Temp\673E.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\673E.exeC:\Users\Admin\AppData\Local\Temp\673E.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\7A79.exeC:\Users\Admin\AppData\Local\Temp\7A79.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7A79.exeC:\Users\Admin\AppData\Local\Temp\7A79.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1828 -s 243⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\673E.exe.logMD5
605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3
-
C:\Users\Admin\AppData\Local\Temp\673E.exeMD5
4ae44e9cb5a3f3d5f40d52c71bdef439
SHA106d591028442b6e18e36f9495ee53d6be6d3a273
SHA256153b903cf8c24a57937304fafc9c77e1abfa650244f29a141c57d1ba391dc1e0
SHA512f42ab8cb503805282a03f6ecbb90d7db65fd057c3f4f9904fa814c488aeae6aa7105ca528c8a7b20d74ebceb4149c9f16c75f07a95db5f2bccbe3b5be2f1febf
-
C:\Users\Admin\AppData\Local\Temp\673E.exeMD5
4ae44e9cb5a3f3d5f40d52c71bdef439
SHA106d591028442b6e18e36f9495ee53d6be6d3a273
SHA256153b903cf8c24a57937304fafc9c77e1abfa650244f29a141c57d1ba391dc1e0
SHA512f42ab8cb503805282a03f6ecbb90d7db65fd057c3f4f9904fa814c488aeae6aa7105ca528c8a7b20d74ebceb4149c9f16c75f07a95db5f2bccbe3b5be2f1febf
-
C:\Users\Admin\AppData\Local\Temp\673E.exeMD5
4ae44e9cb5a3f3d5f40d52c71bdef439
SHA106d591028442b6e18e36f9495ee53d6be6d3a273
SHA256153b903cf8c24a57937304fafc9c77e1abfa650244f29a141c57d1ba391dc1e0
SHA512f42ab8cb503805282a03f6ecbb90d7db65fd057c3f4f9904fa814c488aeae6aa7105ca528c8a7b20d74ebceb4149c9f16c75f07a95db5f2bccbe3b5be2f1febf
-
C:\Users\Admin\AppData\Local\Temp\7A79.exeMD5
0cafd553a0f55d525a5ec0ec6c2c06bd
SHA1621e411916749c72cdc4d97f46b843bb758659c1
SHA2563acca9f2af679c0cba972e71c88871397132c5f389a5beffa7710204b0c81987
SHA512b56e4a59cc314ba533cb0c2d763482de28320f7f2c8eb73d9209745f61b4e22b041756d5c20775a0afab67f86eb68c1267b76b5da1baffbadc75b6ffeda3fdb9
-
C:\Users\Admin\AppData\Local\Temp\7A79.exeMD5
0cafd553a0f55d525a5ec0ec6c2c06bd
SHA1621e411916749c72cdc4d97f46b843bb758659c1
SHA2563acca9f2af679c0cba972e71c88871397132c5f389a5beffa7710204b0c81987
SHA512b56e4a59cc314ba533cb0c2d763482de28320f7f2c8eb73d9209745f61b4e22b041756d5c20775a0afab67f86eb68c1267b76b5da1baffbadc75b6ffeda3fdb9
-
C:\Users\Admin\AppData\Local\Temp\7A79.exeMD5
0cafd553a0f55d525a5ec0ec6c2c06bd
SHA1621e411916749c72cdc4d97f46b843bb758659c1
SHA2563acca9f2af679c0cba972e71c88871397132c5f389a5beffa7710204b0c81987
SHA512b56e4a59cc314ba533cb0c2d763482de28320f7f2c8eb73d9209745f61b4e22b041756d5c20775a0afab67f86eb68c1267b76b5da1baffbadc75b6ffeda3fdb9
-
C:\Users\Admin\AppData\Local\Temp\8950.exeMD5
cf087f0c96950b797ba3213d2383acaa
SHA18c2b04a0c3868e16f0265bb6c3242e1c7a62c156
SHA256ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
SHA512abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
-
C:\Users\Admin\AppData\Local\Temp\8950.exeMD5
cf087f0c96950b797ba3213d2383acaa
SHA18c2b04a0c3868e16f0265bb6c3242e1c7a62c156
SHA256ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
SHA512abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
-
C:\Users\Admin\AppData\Local\Temp\8950.exeMD5
cf087f0c96950b797ba3213d2383acaa
SHA18c2b04a0c3868e16f0265bb6c3242e1c7a62c156
SHA256ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
SHA512abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
-
C:\Users\Admin\AppData\Roaming\frrawjaMD5
cf087f0c96950b797ba3213d2383acaa
SHA18c2b04a0c3868e16f0265bb6c3242e1c7a62c156
SHA256ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
SHA512abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
-
C:\Users\Admin\AppData\Roaming\frrawjaMD5
cf087f0c96950b797ba3213d2383acaa
SHA18c2b04a0c3868e16f0265bb6c3242e1c7a62c156
SHA256ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
SHA512abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
-
C:\Users\Admin\AppData\Roaming\frrawjaMD5
cf087f0c96950b797ba3213d2383acaa
SHA18c2b04a0c3868e16f0265bb6c3242e1c7a62c156
SHA256ad35666e25c3db6923095b96f30dfa1768af186d4aa12f811f522e695198803c
SHA512abba920aa0cdd379a76ae2b5b828696ad80dda9a3d75d8c6ed50246c100049f31a6796b0ac586ff9094d7b567754c95e8341c57d029f12693c0de4e3436c7230
-
memory/64-131-0x0000000000402E0C-mapping.dmp
-
memory/708-137-0x0000000000CB0000-0x0000000000CB1000-memory.dmpFilesize
4KB
-
memory/708-134-0x0000000000000000-mapping.dmp
-
memory/1460-141-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1460-152-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/1460-169-0x0000000007900000-0x0000000007901000-memory.dmpFilesize
4KB
-
memory/1460-168-0x0000000007200000-0x0000000007201000-memory.dmpFilesize
4KB
-
memory/1460-167-0x0000000006700000-0x0000000006701000-memory.dmpFilesize
4KB
-
memory/1460-164-0x0000000005C40000-0x0000000005C41000-memory.dmpFilesize
4KB
-
memory/1460-159-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/1460-142-0x000000000043713E-mapping.dmp
-
memory/1460-158-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/1460-156-0x00000000058D0000-0x00000000058D1000-memory.dmpFilesize
4KB
-
memory/1460-155-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/1460-154-0x0000000005EE0000-0x0000000005EE1000-memory.dmpFilesize
4KB
-
memory/1460-150-0x0000000001610000-0x0000000001611000-memory.dmpFilesize
4KB
-
memory/1828-161-0x0000000000418D2A-mapping.dmp
-
memory/1828-160-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2708-116-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/2708-115-0x00000000012C1000-0x00000000012D2000-memory.dmpFilesize
68KB
-
memory/2904-151-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/2904-149-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/2904-145-0x0000000000EB0000-0x0000000000EB1000-memory.dmpFilesize
4KB
-
memory/2904-157-0x0000000005E50000-0x0000000005E51000-memory.dmpFilesize
4KB
-
memory/2904-139-0x0000000000000000-mapping.dmp
-
memory/2904-153-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB
-
memory/2980-124-0x0000000000402E0C-mapping.dmp
-
memory/3004-133-0x00000000008C0000-0x00000000008D6000-memory.dmpFilesize
88KB
-
memory/3004-119-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/3136-118-0x0000000000402E0C-mapping.dmp
-
memory/3136-117-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3160-126-0x0000000000000000-mapping.dmp
-
memory/3160-129-0x0000000001191000-0x00000000011A1000-memory.dmpFilesize
64KB