Overview

overview

10

Static

static

786c8ca249...33.exe

windows7_x64

10

786c8ca249...33.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    152s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    06-11-2021 20:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    786c8ca249c33915331d1cddf270b433.exe

  • Size

    200KB

  • MD5

    786c8ca249c33915331d1cddf270b433

  • SHA1

    57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

  • SHA256

    fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

  • SHA512

    f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

Score
10/10
redlinesmokeloadertofseenewbackdoorevasioninfostealerpersistencesuricatatrojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://hefahei60.top/

http://pipevai40.top/

http://nusurtal4f.net/

http://netomishnetojuk.net/

http://escalivrouter.net/

http://nick22doom4.net/

http://wrioshtivsio.su/

http://nusotiso4.su/

http://rickkhtovkka.biz/

http://palisotoliso.net/
rc4.i32
rc4.i32
rc4.i32
rc4.i32

Extracted

Family

tofsee

C2

quadoil.ru

lakeflex.ru

Extracted

Family

redline

Botnet

new

C2

93.115.20.139:28978

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

    trojanbackdoorsmokeloader
  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

    trojantofsee
  • Windows security bypass 2 TTPs
    evasiontrojan
  • suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile

    suricata
  • Creates new service(s) 1 TTPs
    persistence
  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Sets service image path in registry 2 TTPs
    persistence
  • Deletes itself 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 9 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 8 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe
    "C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:948
    • C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe
      "C:\Users\Admin\AppData\Local\Temp\786c8ca249c33915331d1cddf270b433.exe"
      2⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      PID:1336
  • C:\Users\Admin\AppData\Local\Temp\E88B.exe
    C:\Users\Admin\AppData\Local\Temp\E88B.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1088
    • C:\Users\Admin\AppData\Local\Temp\E88B.exe
      C:\Users\Admin\AppData\Local\Temp\E88B.exe
      2⤵
      • Executes dropped EXE
      • Checks SCSI registry key(s)
      • Suspicious behavior: MapViewOfSection
      PID:1776
  • C:\Users\Admin\AppData\Local\Temp\2C0.exe
    C:\Users\Admin\AppData\Local\Temp\2C0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:2024
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\lrydkmrf\
      2⤵
        PID:1612
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\kqloxggb.exe" C:\Windows\SysWOW64\lrydkmrf\
        2⤵
          PID:1380
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create lrydkmrf binPath= "C:\Windows\SysWOW64\lrydkmrf\kqloxggb.exe /d\"C:\Users\Admin\AppData\Local\Temp\2C0.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
            PID:1196
          • C:\Windows\SysWOW64\sc.exe
            "C:\Windows\System32\sc.exe" description lrydkmrf "wifi internet conection"
            2⤵
              PID:1864
            • C:\Windows\SysWOW64\sc.exe
              "C:\Windows\System32\sc.exe" start lrydkmrf
              2⤵
                PID:1500
              • C:\Windows\SysWOW64\netsh.exe
                "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
                2⤵
                  PID:1928
              • C:\Windows\SysWOW64\lrydkmrf\kqloxggb.exe
                C:\Windows\SysWOW64\lrydkmrf\kqloxggb.exe /d"C:\Users\Admin\AppData\Local\Temp\2C0.exe"
                1⤵
                • Executes dropped EXE
                • Suspicious use of SetThreadContext
                • Suspicious use of WriteProcessMemory
                PID:1820
                • C:\Windows\SysWOW64\svchost.exe
                  svchost.exe
                  2⤵
                  • Drops file in System32 directory
                  • Modifies data under HKEY_USERS
                  PID:1188
              • C:\Users\Admin\AppData\Local\Temp\2696.exe
                C:\Users\Admin\AppData\Local\Temp\2696.exe
                1⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1192
              • C:\Users\Admin\AppData\Local\Temp\3E3B.exe
                C:\Users\Admin\AppData\Local\Temp\3E3B.exe
                1⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: MapViewOfSection
                PID:1448

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              New Service

              1
              T1050

              Modify Existing Service

              1
              T1031

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              New Service

              1
              T1050

              Defense Evasion

              Disabling Security Tools

              1
              T1089

              Modify Registry

              2
              T1112

              Credential Access

              Discovery

              System Information Discovery

              2
              T1082

              Query Registry

              1
              T1012

              Peripheral Device Discovery

              1
              T1120

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\2696.exe
                MD5

                004f56332aac2e8fca2e4f77691d6167

                SHA1

                f199337bcc743fe8c2b604e97e9e67e418125a9b

                SHA256

                9ab80fd9ceb29028bdb57a30f8275c8385a6657aef9576b2d73d738229e3f83e

                SHA512

                8d79115115a586e36ee9d441b95374151612829e9d0b2dfe43b2f53c064f574e4dc08fb3120d984c11fd65872ed18b470a72cdd71ffd557f31510674c27820e6

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\2696.exe
                MD5

                004f56332aac2e8fca2e4f77691d6167

                SHA1

                f199337bcc743fe8c2b604e97e9e67e418125a9b

                SHA256

                9ab80fd9ceb29028bdb57a30f8275c8385a6657aef9576b2d73d738229e3f83e

                SHA512

                8d79115115a586e36ee9d441b95374151612829e9d0b2dfe43b2f53c064f574e4dc08fb3120d984c11fd65872ed18b470a72cdd71ffd557f31510674c27820e6

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\2C0.exe
                MD5

                48db79b89beb4b17fabcbb7d8704873a

                SHA1

                fd47d711e03b703937341a5ede33810601900963

                SHA256

                d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

                SHA512

                2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\2C0.exe
                MD5

                48db79b89beb4b17fabcbb7d8704873a

                SHA1

                fd47d711e03b703937341a5ede33810601900963

                SHA256

                d8a4de298fd1ec4e0b885949fa5d0375ca800281956875179a14e40d1c245278

                SHA512

                2f76d3db69d906cfc4a154075ff92a4859c663dc8b24eac995d5822c4712744b0eb1092a3b0e3362687d999a4651c891460705aaa5bc2b2526afdda47bf7965b

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\3E3B.exe
                MD5

                36a3976a7678715fffe2300f0ae8a21a

                SHA1

                d941d30a3a600d9f2bdb4b8fed77addd7f15806d

                SHA256

                27098e89b511cd37b5aad597d2e3875d5f6ca232b6bc057cef67adc24243d33e

                SHA512

                7447d26f2bfca5084a4652745a6aadfb90a9068198f00f411a6eb48be12473fde8a458814eb43328c7964f0dad685eea0012be37144c9c2a2dc5613326fc446c

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\E88B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\E88B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\E88B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

                Download Submit
              • C:\Users\Admin\AppData\Local\Temp\kqloxggb.exe
                MD5

                7000970e7405c51ffcec465b4d58773a

                SHA1

                445900a4ac04800efdab6abc54f53f3febdebc3b

                SHA256

                52e4a019f4e630224754d563239e6a1c736bc43d1b8451ae4dae588aa435fcf9

                SHA512

                0cbe3cf9d34c7a84d923b7431db4f3e4fd9652430f235b5335930e13d8ee7e72395ae1e3b052820c40d4a69741ea36ee07edbfff16bd28c92a83b33d8a14a9e2

                Download Submit
              • C:\Windows\SysWOW64\lrydkmrf\kqloxggb.exe
                MD5

                7000970e7405c51ffcec465b4d58773a

                SHA1

                445900a4ac04800efdab6abc54f53f3febdebc3b

                SHA256

                52e4a019f4e630224754d563239e6a1c736bc43d1b8451ae4dae588aa435fcf9

                SHA512

                0cbe3cf9d34c7a84d923b7431db4f3e4fd9652430f235b5335930e13d8ee7e72395ae1e3b052820c40d4a69741ea36ee07edbfff16bd28c92a83b33d8a14a9e2

                Download Submit
              • \Users\Admin\AppData\Local\Temp\1105.tmp
                MD5

                d124f55b9393c976963407dff51ffa79

                SHA1

                2c7bbedd79791bfb866898c85b504186db610b5d

                SHA256

                ea1e16247c848c8c171c4cd1fa17bc5a018a1fcb0c0dac25009066b6667b8eef

                SHA512

                278fe3a4b1fbbe700e4f4483b610133e975e36e101455661d5197bd892a68839b9d555499040d200c92aefa9e3819380e395c0cd85d5fc845c6364d128a8cf06

                Download Submit
              • \Users\Admin\AppData\Local\Temp\E88B.exe
                MD5

                786c8ca249c33915331d1cddf270b433

                SHA1

                57ecd1b15e0fe0e6d1e90ad6390494094f03ca88

                SHA256

                fd903bd62af05814bc02cf44bfc3228bbd38244b2d02a4006398f7287f94b1c6

                SHA512

                f9e867eeeaae7733b9d6fbf2723062d69e23befbe46b05ad59a2c706c812019acff0f9e7a707cc64cceae55466a541e104821a2e40dd464407ffac4ea80e184d

                Download Submit
              • memory/948-59-0x00000000001D0000-0x00000000001D9000-memory.dmp
                Filesize

                36KB

                Download
              • memory/948-58-0x00000000001C0000-0x00000000001C8000-memory.dmp
                Filesize

                32KB

                Download
              • memory/1088-61-0x0000000000000000-mapping.dmp
                Download
              • memory/1188-87-0x0000000000080000-0x0000000000095000-memory.dmp
                Filesize

                84KB

                Download
              • memory/1188-88-0x0000000000089A6B-mapping.dmp
                Download
              • memory/1188-86-0x0000000000080000-0x0000000000095000-memory.dmp
                Filesize

                84KB

                Download
              • memory/1192-97-0x0000000000240000-0x0000000000241000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1192-92-0x0000000000000000-mapping.dmp
                Download
              • memory/1192-101-0x0000000000310000-0x000000000032B000-memory.dmp
                Filesize

                108KB

                Download
              • memory/1192-98-0x000000001AB80000-0x000000001AB82000-memory.dmp
                Filesize

                8KB

                Download
              • memory/1192-95-0x0000000000E50000-0x0000000000E51000-memory.dmp
                Filesize

                4KB

                Download
              • memory/1196-80-0x0000000000000000-mapping.dmp
                Download
              • memory/1268-107-0x0000000003960000-0x0000000003976000-memory.dmp
                Filesize

                88KB

                Download
              • memory/1268-60-0x00000000021A0000-0x00000000021B6000-memory.dmp
                Filesize

                88KB

                Download
              • memory/1268-69-0x0000000002B60000-0x0000000002B76000-memory.dmp
                Filesize

                88KB

                Download
              • memory/1336-56-0x0000000000402EFA-mapping.dmp
                Download
              • memory/1336-55-0x0000000000400000-0x0000000000409000-memory.dmp
                Filesize

                36KB

                Download
              • memory/1336-57-0x0000000075BA1000-0x0000000075BA3000-memory.dmp
                Filesize

                8KB

                Download
              • memory/1380-78-0x0000000000000000-mapping.dmp
                Download
              • memory/1448-99-0x0000000000000000-mapping.dmp
                Download
              • memory/1448-105-0x00000000001B0000-0x00000000001B9000-memory.dmp
                Filesize

                36KB

                Download
              • memory/1448-106-0x0000000000400000-0x00000000008F9000-memory.dmp
                Filesize

                5.0MB

                Download
              • memory/1448-102-0x000000000030D000-0x000000000031D000-memory.dmp
                Filesize

                64KB

                Download
              • memory/1500-82-0x0000000000000000-mapping.dmp
                Download
              • memory/1612-76-0x0000000000000000-mapping.dmp
                Download
              • memory/1776-66-0x0000000000402EFA-mapping.dmp
                Download
              • memory/1820-91-0x0000000000400000-0x0000000000441000-memory.dmp
                Filesize

                260KB

                Download
              • memory/1864-81-0x0000000000000000-mapping.dmp
                Download
              • memory/1928-84-0x0000000000000000-mapping.dmp
                Download
              • memory/2024-77-0x0000000000400000-0x0000000000441000-memory.dmp
                Filesize

                260KB

                Download
              • memory/2024-73-0x0000000000230000-0x0000000000243000-memory.dmp
                Filesize

                76KB

                Download
              • memory/2024-72-0x0000000000220000-0x000000000022D000-memory.dmp
                Filesize

                52KB

                Download
              • memory/2024-70-0x0000000000000000-mapping.dmp
                Download