Analysis
- max time kernel
151s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
07/12/2021, 04:37
General
- Target 2c191cdfeca70a70d60b8ba2bfbc71fb.exe
- Size 318KB
- Sample211207-e8t5kafhfl
- SHA256 3e2324a1984b7bbd91cd330f430920aac22d48750048e6573b707848bc72bffd
Malware Config
Extracted
-
smokeloader
-
2020
-
http://rcacademy.at/upload/
-
http://e-lanpengeonline.com/upload/
-
http://vjcmvz.cn/upload/
-
http://galala.ru/upload/
-
http://witra.ru/upload/
Extracted
-
redline
-
195.133.47.114:38627
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 5 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 7 IoCs
- Deletes itself 1 IoCs
- Drops startup file 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 51 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c191cdfeca70a70d60b8ba2bfbc71fb.exe"C:\Users\Admin\AppData\Local\Temp\2c191cdfeca70a70d60b8ba2bfbc71fb.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\AB8E.exeC:\Users\Admin\AppData\Local\Temp\AB8E.exe1⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"C:\Users\Admin\AppData\Roaming\Smart Clock\SmartClock.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: AddClipboardFormatListener
-
-
C:\Users\Admin\AppData\Local\Temp\EF3F.exeC:\Users\Admin\AppData\Local\Temp\EF3F.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1074.exeC:\Users\Admin\AppData\Local\Temp\1074.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3524.exeC:\Users\Admin\AppData\Local\Temp\3524.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\52EE.exeC:\Users\Admin\AppData\Local\Temp\52EE.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1436 -s 4202⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\658C.exeC:\Users\Admin\AppData\Local\Temp\658C.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1124-161-0x0000000005130000-0x0000000005736000-memory.dmp
memory/1124-173-0x0000000007420000-0x0000000007421000-memory.dmp
memory/1124-172-0x0000000006D20000-0x0000000006D21000-memory.dmp
memory/1124-154-0x0000000000980000-0x0000000000981000-memory.dmp
memory/1184-129-0x0000000000690000-0x00000000007DA000-memory.dmp
memory/1184-130-0x0000000000400000-0x0000000000541000-memory.dmp
memory/1184-128-0x0000000000791000-0x0000000000811000-memory.dmp
memory/1216-185-0x00000000720B0000-0x0000000072130000-memory.dmp
memory/1216-192-0x00000000012A0000-0x00000000012E5000-memory.dmp
memory/1216-177-0x0000000001230000-0x00000000012A0000-memory.dmp
memory/1216-179-0x0000000001190000-0x0000000001191000-memory.dmp
memory/1216-195-0x0000000070300000-0x000000007034B000-memory.dmp
memory/1216-193-0x00000000057A0000-0x00000000057A1000-memory.dmp
memory/1216-191-0x0000000074070000-0x00000000753B8000-memory.dmp
memory/1216-190-0x00000000762C0000-0x0000000076844000-memory.dmp
memory/1216-182-0x00000000756D0000-0x00000000757C1000-memory.dmp
memory/1216-181-0x00000000773B0000-0x0000000077572000-memory.dmp
memory/1216-183-0x0000000001230000-0x0000000001231000-memory.dmp
memory/1552-117-0x0000000000400000-0x00000000004D1000-memory.dmp
memory/1552-116-0x0000000000030000-0x0000000000039000-memory.dmp
memory/2160-137-0x0000000000CA0000-0x0000000000CE5000-memory.dmp
memory/2160-148-0x0000000074070000-0x00000000753B8000-memory.dmp
memory/2160-163-0x0000000005030000-0x0000000005031000-memory.dmp
memory/2160-164-0x0000000005BB0000-0x0000000005BB1000-memory.dmp
memory/2160-165-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/2160-166-0x0000000005D90000-0x0000000005D91000-memory.dmp
memory/2160-134-0x0000000000E70000-0x0000000000EDE000-memory.dmp
memory/2160-142-0x0000000005320000-0x0000000005321000-memory.dmp
memory/2160-135-0x0000000000430000-0x0000000000431000-memory.dmp
memory/2160-143-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/2160-136-0x00000000773B0000-0x0000000077572000-memory.dmp
memory/2160-141-0x00000000720B0000-0x0000000072130000-memory.dmp
memory/2160-138-0x00000000756D0000-0x00000000757C1000-memory.dmp
memory/2160-139-0x0000000000E70000-0x0000000000E71000-memory.dmp
memory/2160-150-0x0000000070300000-0x000000007034B000-memory.dmp
memory/2160-149-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/2160-162-0x0000000005E30000-0x0000000005E31000-memory.dmp
memory/2160-147-0x00000000762C0000-0x0000000076844000-memory.dmp
memory/2160-146-0x0000000004D00000-0x0000000004D01000-memory.dmp
memory/2160-145-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/2160-144-0x0000000004E20000-0x0000000004E21000-memory.dmp
memory/2312-126-0x00000000006D0000-0x0000000000761000-memory.dmp
memory/2312-122-0x00000000007A1000-0x0000000000821000-memory.dmp
memory/2312-127-0x0000000000400000-0x0000000000541000-memory.dmp
memory/3024-118-0x00000000007A0000-0x00000000007B6000-memory.dmp
memory/4056-209-0x0000000000FE0000-0x0000000001050000-memory.dmp
memory/4056-210-0x0000000000DA0000-0x0000000000DA1000-memory.dmp
memory/4056-211-0x00000000773B0000-0x0000000077572000-memory.dmp
memory/4056-213-0x00000000756D0000-0x00000000757C1000-memory.dmp
memory/4056-212-0x0000000001190000-0x00000000011D5000-memory.dmp
memory/4056-225-0x0000000002BB0000-0x0000000002BB1000-memory.dmp