Analysis
- max time kernel
151s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
08/12/2021, 13:35
General
- Target SecuriteInfo.com.Trojan.DownLoader44.12731.15797.24386.exe
- Size 240KB
- Sample211208-qvsv5aafbp
- SHA256 6bd0b5a4591a74e6d8997482bb18057b1b701a787aeb16f058d1a3113a6c3ca1
Malware Config
Extracted
-
smokeloader
-
2020
-
http://rcacademy.at/upload/
-
http://e-lanpengeonline.com/upload/
-
http://vjcmvz.cn/upload/
-
http://galala.ru/upload/
-
http://witra.ru/upload/
Extracted
-
redline
-
195.133.47.114:38627
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Deletes itself 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 29 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader44.12731.15797.24386.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.DownLoader44.12731.15797.24386.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DB8.exeC:\Users\Admin\AppData\Local\Temp\DB8.exe1⤵
- Executes dropped EXE
- Writes to the Master Boot Record (MBR)
-
C:\Users\Admin\AppData\Local\Temp\1460.exeC:\Users\Admin\AppData\Local\Temp\1460.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\17DB.exeC:\Users\Admin\AppData\Local\Temp\17DB.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\246F.exeC:\Users\Admin\AppData\Local\Temp\246F.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/312-153-0x0000000073DE0000-0x0000000075128000-memory.dmp
memory/312-148-0x0000000005220000-0x0000000005221000-memory.dmp
memory/312-128-0x0000000002740000-0x0000000002785000-memory.dmp
memory/312-129-0x0000000000D20000-0x0000000000D88000-memory.dmp
memory/312-130-0x0000000000B90000-0x0000000000B91000-memory.dmp
memory/312-131-0x00000000765D0000-0x0000000076792000-memory.dmp
memory/312-132-0x0000000075180000-0x0000000075271000-memory.dmp
memory/312-133-0x0000000000D20000-0x0000000000D21000-memory.dmp
memory/312-135-0x0000000071CC0000-0x0000000071D40000-memory.dmp
memory/312-184-0x0000000005550000-0x0000000005551000-memory.dmp
memory/312-155-0x000000006FF10000-0x000000006FF5B000-memory.dmp
memory/312-140-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/312-151-0x0000000076B10000-0x0000000077094000-memory.dmp
memory/312-143-0x0000000003080000-0x0000000003081000-memory.dmp
memory/312-145-0x00000000053A0000-0x00000000053A1000-memory.dmp
memory/312-147-0x0000000005390000-0x0000000005391000-memory.dmp
memory/896-164-0x0000000000920000-0x0000000000921000-memory.dmp
memory/896-179-0x0000000002170000-0x0000000002171000-memory.dmp
memory/896-178-0x000000006FF10000-0x000000006FF5B000-memory.dmp
memory/896-176-0x0000000073DE0000-0x0000000075128000-memory.dmp
memory/896-175-0x0000000076B10000-0x0000000077094000-memory.dmp
memory/896-169-0x0000000000830000-0x00000000008DE000-memory.dmp
memory/896-168-0x0000000071CC0000-0x0000000071D40000-memory.dmp
memory/896-159-0x0000000000920000-0x000000000098C000-memory.dmp
memory/896-160-0x0000000000120000-0x0000000000121000-memory.dmp
memory/896-162-0x0000000075180000-0x0000000075271000-memory.dmp
memory/896-161-0x00000000765D0000-0x0000000076792000-memory.dmp
memory/1920-121-0x0000000000CD0000-0x0000000000CE6000-memory.dmp
memory/2696-118-0x0000000002CA0000-0x0000000002CA8000-memory.dmp
memory/2696-120-0x0000000000400000-0x0000000002B75000-memory.dmp
memory/2696-119-0x0000000002CB0000-0x0000000002CB9000-memory.dmp
memory/2864-139-0x0000000000BE0000-0x0000000000BE1000-memory.dmp
memory/2864-182-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/2864-149-0x0000000005380000-0x0000000005986000-memory.dmp
memory/2864-190-0x0000000007570000-0x0000000007571000-memory.dmp
memory/2864-188-0x0000000006E70000-0x0000000006E71000-memory.dmp
memory/2864-185-0x00000000058A0000-0x00000000058A1000-memory.dmp
memory/2864-152-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/2864-180-0x00000000064A0000-0x00000000064A1000-memory.dmp
memory/2864-181-0x00000000057B0000-0x00000000057B1000-memory.dmp
memory/3968-171-0x0000000000400000-0x0000000002BC5000-memory.dmp
memory/3968-165-0x0000000002D20000-0x0000000002E6A000-memory.dmp
memory/3968-167-0x0000000004880000-0x00000000048EB000-memory.dmp
memory/3968-163-0x0000000000400000-0x0000000002BC5000-memory.dmp