Analysis
-
max time kernel
150s -
max time network
164s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
25-10-2021 05:23
Static task
static1
Behavioral task
behavioral1
Sample
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe
Resource
win10-en-20210920
General
-
Target
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe
-
Size
262KB
-
MD5
3ba0b3a3b6d2a66d507acb1f10a24434
-
SHA1
644a4f467c21f8693f7f3c8788360ac3df0fa525
-
SHA256
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8
-
SHA512
dafa6f2a947598d690441bc418c06bc0c78b63787f189385c2e9b8d47ce4a3ccc7ae18c70c602c4582b15205ca8478ab88cdedcb344dc1ec3f5b0c22c3badc0d
Malware Config
Extracted
smokeloader
2020
http://xacokuo8.top/
http://hajezey1.top/
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/4088-133-0x0000000000400000-0x000000000043C000-memory.dmp family_redline behavioral1/memory/4088-134-0x000000000043713E-mapping.dmp family_redline behavioral1/memory/1436-155-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1436-156-0x0000000000418D2A-mapping.dmp family_redline behavioral1/memory/1436-166-0x0000000004EB0000-0x00000000054B6000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 6 IoCs
Processes:
A285.exeA285.exe69F.exe69F.exe199C.exe199C.exepid process 3260 A285.exe 1544 A285.exe 932 69F.exe 4088 69F.exe 2072 199C.exe 1436 199C.exe -
Deletes itself 1 IoCs
Processes:
pid process 3032 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 4 IoCs
Processes:
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exeA285.exe69F.exe199C.exedescription pid process target process PID 4056 set thread context of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 3260 set thread context of 1544 3260 A285.exe A285.exe PID 932 set thread context of 4088 932 69F.exe 69F.exe PID 2072 set thread context of 1436 2072 199C.exe 199C.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exeA285.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A285.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A285.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI A285.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exepid process 596 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 596 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exeA285.exepid process 596 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 1544 A285.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
Processes:
69F.exe199C.exedescription pid process Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeDebugPrivilege 4088 69F.exe Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeDebugPrivilege 1436 199C.exe Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 -
Suspicious use of WriteProcessMemory 37 IoCs
Processes:
3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exeA285.exe69F.exe199C.exedescription pid process target process PID 4056 wrote to memory of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 4056 wrote to memory of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 4056 wrote to memory of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 4056 wrote to memory of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 4056 wrote to memory of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 4056 wrote to memory of 596 4056 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe 3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe PID 3032 wrote to memory of 3260 3032 A285.exe PID 3032 wrote to memory of 3260 3032 A285.exe PID 3032 wrote to memory of 3260 3032 A285.exe PID 3260 wrote to memory of 1544 3260 A285.exe A285.exe PID 3260 wrote to memory of 1544 3260 A285.exe A285.exe PID 3260 wrote to memory of 1544 3260 A285.exe A285.exe PID 3260 wrote to memory of 1544 3260 A285.exe A285.exe PID 3260 wrote to memory of 1544 3260 A285.exe A285.exe PID 3260 wrote to memory of 1544 3260 A285.exe A285.exe PID 3032 wrote to memory of 932 3032 69F.exe PID 3032 wrote to memory of 932 3032 69F.exe PID 3032 wrote to memory of 932 3032 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 932 wrote to memory of 4088 932 69F.exe 69F.exe PID 3032 wrote to memory of 2072 3032 199C.exe PID 3032 wrote to memory of 2072 3032 199C.exe PID 3032 wrote to memory of 2072 3032 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe PID 2072 wrote to memory of 1436 2072 199C.exe 199C.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe"C:\Users\Admin\AppData\Local\Temp\3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe"C:\Users\Admin\AppData\Local\Temp\3d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\A285.exeC:\Users\Admin\AppData\Local\Temp\A285.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\A285.exeC:\Users\Admin\AppData\Local\Temp\A285.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\69F.exeC:\Users\Admin\AppData\Local\Temp\69F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\69F.exeC:\Users\Admin\AppData\Local\Temp\69F.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\199C.exeC:\Users\Admin\AppData\Local\Temp\199C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\199C.exeC:\Users\Admin\AppData\Local\Temp\199C.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\199C.exe.logMD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\69F.exe.logMD5
605f809fab8c19729d39d075f7ffdb53
SHA1c546f877c9bd53563174a90312a8337fdfc5fdd9
SHA2566904d540649e76c55f99530b81be17e099184bb4cad415aa9b9b39cc3677f556
SHA51282cc12c3186ae23884b8d5c104638c8206272c4389ade56b926dfc1d437b03888159b3c790b188b54d277a262e731927e703e680ea642e1417faee27443fd5b3
-
C:\Users\Admin\AppData\Local\Temp\199C.exeMD5
0cafd553a0f55d525a5ec0ec6c2c06bd
SHA1621e411916749c72cdc4d97f46b843bb758659c1
SHA2563acca9f2af679c0cba972e71c88871397132c5f389a5beffa7710204b0c81987
SHA512b56e4a59cc314ba533cb0c2d763482de28320f7f2c8eb73d9209745f61b4e22b041756d5c20775a0afab67f86eb68c1267b76b5da1baffbadc75b6ffeda3fdb9
-
C:\Users\Admin\AppData\Local\Temp\199C.exeMD5
0cafd553a0f55d525a5ec0ec6c2c06bd
SHA1621e411916749c72cdc4d97f46b843bb758659c1
SHA2563acca9f2af679c0cba972e71c88871397132c5f389a5beffa7710204b0c81987
SHA512b56e4a59cc314ba533cb0c2d763482de28320f7f2c8eb73d9209745f61b4e22b041756d5c20775a0afab67f86eb68c1267b76b5da1baffbadc75b6ffeda3fdb9
-
C:\Users\Admin\AppData\Local\Temp\199C.exeMD5
0cafd553a0f55d525a5ec0ec6c2c06bd
SHA1621e411916749c72cdc4d97f46b843bb758659c1
SHA2563acca9f2af679c0cba972e71c88871397132c5f389a5beffa7710204b0c81987
SHA512b56e4a59cc314ba533cb0c2d763482de28320f7f2c8eb73d9209745f61b4e22b041756d5c20775a0afab67f86eb68c1267b76b5da1baffbadc75b6ffeda3fdb9
-
C:\Users\Admin\AppData\Local\Temp\69F.exeMD5
4ae44e9cb5a3f3d5f40d52c71bdef439
SHA106d591028442b6e18e36f9495ee53d6be6d3a273
SHA256153b903cf8c24a57937304fafc9c77e1abfa650244f29a141c57d1ba391dc1e0
SHA512f42ab8cb503805282a03f6ecbb90d7db65fd057c3f4f9904fa814c488aeae6aa7105ca528c8a7b20d74ebceb4149c9f16c75f07a95db5f2bccbe3b5be2f1febf
-
C:\Users\Admin\AppData\Local\Temp\69F.exeMD5
4ae44e9cb5a3f3d5f40d52c71bdef439
SHA106d591028442b6e18e36f9495ee53d6be6d3a273
SHA256153b903cf8c24a57937304fafc9c77e1abfa650244f29a141c57d1ba391dc1e0
SHA512f42ab8cb503805282a03f6ecbb90d7db65fd057c3f4f9904fa814c488aeae6aa7105ca528c8a7b20d74ebceb4149c9f16c75f07a95db5f2bccbe3b5be2f1febf
-
C:\Users\Admin\AppData\Local\Temp\69F.exeMD5
4ae44e9cb5a3f3d5f40d52c71bdef439
SHA106d591028442b6e18e36f9495ee53d6be6d3a273
SHA256153b903cf8c24a57937304fafc9c77e1abfa650244f29a141c57d1ba391dc1e0
SHA512f42ab8cb503805282a03f6ecbb90d7db65fd057c3f4f9904fa814c488aeae6aa7105ca528c8a7b20d74ebceb4149c9f16c75f07a95db5f2bccbe3b5be2f1febf
-
C:\Users\Admin\AppData\Local\Temp\A285.exeMD5
3ba0b3a3b6d2a66d507acb1f10a24434
SHA1644a4f467c21f8693f7f3c8788360ac3df0fa525
SHA2563d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8
SHA512dafa6f2a947598d690441bc418c06bc0c78b63787f189385c2e9b8d47ce4a3ccc7ae18c70c602c4582b15205ca8478ab88cdedcb344dc1ec3f5b0c22c3badc0d
-
C:\Users\Admin\AppData\Local\Temp\A285.exeMD5
3ba0b3a3b6d2a66d507acb1f10a24434
SHA1644a4f467c21f8693f7f3c8788360ac3df0fa525
SHA2563d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8
SHA512dafa6f2a947598d690441bc418c06bc0c78b63787f189385c2e9b8d47ce4a3ccc7ae18c70c602c4582b15205ca8478ab88cdedcb344dc1ec3f5b0c22c3badc0d
-
C:\Users\Admin\AppData\Local\Temp\A285.exeMD5
3ba0b3a3b6d2a66d507acb1f10a24434
SHA1644a4f467c21f8693f7f3c8788360ac3df0fa525
SHA2563d054e3e93c3fccafea80b7e225da90d205282662800aec4624d0641631202b8
SHA512dafa6f2a947598d690441bc418c06bc0c78b63787f189385c2e9b8d47ce4a3ccc7ae18c70c602c4582b15205ca8478ab88cdedcb344dc1ec3f5b0c22c3badc0d
-
memory/596-116-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/596-117-0x0000000000402E0C-mapping.dmp
-
memory/932-128-0x0000000000000000-mapping.dmp
-
memory/932-131-0x00000000003D0000-0x00000000003D1000-memory.dmpFilesize
4KB
-
memory/1436-155-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1436-156-0x0000000000418D2A-mapping.dmp
-
memory/1436-166-0x0000000004EB0000-0x00000000054B6000-memory.dmpFilesize
6.0MB
-
memory/1544-125-0x0000000000402E0C-mapping.dmp
-
memory/2072-152-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/2072-151-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/2072-154-0x0000000005750000-0x0000000005751000-memory.dmpFilesize
4KB
-
memory/2072-146-0x0000000000000000-mapping.dmp
-
memory/2072-153-0x0000000005C60000-0x0000000005C61000-memory.dmpFilesize
4KB
-
memory/2072-149-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/3032-119-0x0000000000650000-0x0000000000666000-memory.dmpFilesize
88KB
-
memory/3032-127-0x0000000000710000-0x0000000000726000-memory.dmpFilesize
88KB
-
memory/3260-120-0x0000000000000000-mapping.dmp
-
memory/4056-118-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/4088-140-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/4088-134-0x000000000043713E-mapping.dmp
-
memory/4088-139-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB
-
memory/4088-141-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/4088-133-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/4088-145-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/4088-144-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/4088-143-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/4088-142-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/4088-169-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/4088-171-0x0000000006130000-0x0000000006131000-memory.dmpFilesize
4KB
-
memory/4088-172-0x0000000006D90000-0x0000000006D91000-memory.dmpFilesize
4KB
-
memory/4088-174-0x0000000007490000-0x0000000007491000-memory.dmpFilesize
4KB