Analysis

  • max time kernel
    153s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211104
  • submitted
    08-12-2021 14:02

General

  • Target

    a904ea3baeeffecf15272412e0db5657.exe

  • Size

    278KB

  • MD5

    a904ea3baeeffecf15272412e0db5657

  • SHA1

    22d418de7d1ca07392be9c5596d1c294854b2d99

  • SHA256

    e576d4e4fa5d355d71e9b882c8a1f05f0484e55c6c6df348a043f5df5ff4be22

  • SHA512

    c58439beae0faf7077fa97329275afae994ad2c2406c00b86560e3d5b471d046817a872afdd2a2a985e96210378862d5d2593f512e2cffbc5f1bec5bff8edc96

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

195.133.47.114:38627

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 6 IoCs
  • Deletes itself 1 IoCs
  • Loads dropped DLL 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 31 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a904ea3baeeffecf15272412e0db5657.exe
    "C:\Users\Admin\AppData\Local\Temp\a904ea3baeeffecf15272412e0db5657.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1408
  • C:\Users\Admin\AppData\Local\Temp\D2F8.exe
    C:\Users\Admin\AppData\Local\Temp\D2F8.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1548
  • C:\Users\Admin\AppData\Local\Temp\E6D7.exe
    C:\Users\Admin\AppData\Local\Temp\E6D7.exe
    1⤵
    • Executes dropped EXE
    PID:1100
  • C:\Users\Admin\AppData\Local\Temp\7D0.exe
    C:\Users\Admin\AppData\Local\Temp\7D0.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious use of AdjustPrivilegeToken
    PID:1164
  • C:\Users\Admin\AppData\Local\Temp\1FC3.exe
    C:\Users\Admin\AppData\Local\Temp\1FC3.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:1596
    • C:\Users\Admin\AppData\Local\Temp\1FC3.exe
      C:\Users\Admin\AppData\Local\Temp\1FC3.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:1908
      • C:\Users\Admin\AppData\Local\Temp\1FC3.exe
        C:\Users\Admin\AppData\Local\Temp\1FC3.exe
        3⤵
        • Executes dropped EXE
        PID:1528

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\1FC3.exe

    MD5

    7ade34e7d74c83cee4c8f288c90128d5

    SHA1

    13a4bf57f5777cdd9bfb0d9568392e39d3073ed0

    SHA256

    032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad

    SHA512

    d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69

  • C:\Users\Admin\AppData\Local\Temp\1FC3.exe

    MD5

    7ade34e7d74c83cee4c8f288c90128d5

    SHA1

    13a4bf57f5777cdd9bfb0d9568392e39d3073ed0

    SHA256

    032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad

    SHA512

    d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69

  • C:\Users\Admin\AppData\Local\Temp\1FC3.exe

    MD5

    7ade34e7d74c83cee4c8f288c90128d5

    SHA1

    13a4bf57f5777cdd9bfb0d9568392e39d3073ed0

    SHA256

    032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad

    SHA512

    d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69

  • C:\Users\Admin\AppData\Local\Temp\7D0.exe

    MD5

    f80418f12c03a56ac2e8d8b189c13750

    SHA1

    cd0b728375e4e178b50bca8ad65ce79aede30d37

    SHA256

    cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

    SHA512

    e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

  • C:\Users\Admin\AppData\Local\Temp\7D0.exe

    MD5

    f80418f12c03a56ac2e8d8b189c13750

    SHA1

    cd0b728375e4e178b50bca8ad65ce79aede30d37

    SHA256

    cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

    SHA512

    e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

  • C:\Users\Admin\AppData\Local\Temp\D2F8.exe

    MD5

    77ce7ab11225c5e723b7b1be0308e8c0

    SHA1

    709a8df1d49f28cf8c293694bbbbd0f07735829b

    SHA256

    d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

    SHA512

    f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

  • C:\Users\Admin\AppData\Local\Temp\D2F8.exe

    MD5

    77ce7ab11225c5e723b7b1be0308e8c0

    SHA1

    709a8df1d49f28cf8c293694bbbbd0f07735829b

    SHA256

    d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

    SHA512

    f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

  • C:\Users\Admin\AppData\Local\Temp\E6D7.exe

    MD5

    3ba1d635fed88d8af279be91b7007bae

    SHA1

    62a1d59c746cdb51e699114f410749384a70cf73

    SHA256

    3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

    SHA512

    83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

  • C:\Users\Admin\AppData\Local\Temp\E6D7.exe

    MD5

    3ba1d635fed88d8af279be91b7007bae

    SHA1

    62a1d59c746cdb51e699114f410749384a70cf73

    SHA256

    3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

    SHA512

    83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

  • \Users\Admin\AppData\Local\Temp\1FC3.exe

    MD5

    7ade34e7d74c83cee4c8f288c90128d5

    SHA1

    13a4bf57f5777cdd9bfb0d9568392e39d3073ed0

    SHA256

    032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad

    SHA512

    d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69

  • \Users\Admin\AppData\Local\Temp\1FC3.exe

    MD5

    7ade34e7d74c83cee4c8f288c90128d5

    SHA1

    13a4bf57f5777cdd9bfb0d9568392e39d3073ed0

    SHA256

    032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad

    SHA512

    d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69

  • \Users\Admin\AppData\Local\Temp\1FC3.exe

    MD5

    7ade34e7d74c83cee4c8f288c90128d5

    SHA1

    13a4bf57f5777cdd9bfb0d9568392e39d3073ed0

    SHA256

    032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad

    SHA512

    d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69

  • memory/1100-82-0x0000000000000000-mapping.dmp

  • memory/1100-87-0x00000000047C0000-0x00000000047C1000-memory.dmp

    Filesize

    4KB

  • memory/1100-85-0x0000000000330000-0x0000000000331000-memory.dmp

    Filesize

    4KB

  • memory/1164-110-0x00000000001D0000-0x0000000000215000-memory.dmp

    Filesize

    276KB

  • memory/1164-96-0x0000000000100000-0x0000000000101000-memory.dmp

    Filesize

    4KB

  • memory/1164-126-0x000000006CC50000-0x000000006CC67000-memory.dmp

    Filesize

    92KB

  • memory/1164-107-0x0000000075C50000-0x000000007689A000-memory.dmp

    Filesize

    12.3MB

  • memory/1164-106-0x0000000073CF0000-0x0000000073D70000-memory.dmp

    Filesize

    512KB

  • memory/1164-105-0x00000000768A0000-0x000000007692F000-memory.dmp

    Filesize

    572KB

  • memory/1164-122-0x000000006DE00000-0x000000006DF90000-memory.dmp

    Filesize

    1.6MB

  • memory/1164-103-0x00000000009E0000-0x00000000009E1000-memory.dmp

    Filesize

    4KB

  • memory/1164-102-0x0000000075200000-0x000000007535C000-memory.dmp

    Filesize

    1.4MB

  • memory/1164-99-0x00000000754E0000-0x0000000075527000-memory.dmp

    Filesize

    284KB

  • memory/1164-100-0x0000000076A70000-0x0000000076AC7000-memory.dmp

    Filesize

    348KB

  • memory/1164-98-0x0000000075660000-0x000000007570C000-memory.dmp

    Filesize

    688KB

  • memory/1164-108-0x00000000734B0000-0x00000000734C7000-memory.dmp

    Filesize

    92KB

  • memory/1164-111-0x0000000002550000-0x0000000002551000-memory.dmp

    Filesize

    4KB

  • memory/1164-90-0x0000000000000000-mapping.dmp

  • memory/1164-95-0x00000000009E0000-0x0000000000A4C000-memory.dmp

    Filesize

    432KB

  • memory/1164-109-0x0000000076C10000-0x0000000076C45000-memory.dmp

    Filesize

    212KB

  • memory/1164-94-0x0000000074920000-0x000000007496A000-memory.dmp

    Filesize

    296KB

  • memory/1208-59-0x0000000002210000-0x0000000002226000-memory.dmp

    Filesize

    88KB

  • memory/1408-55-0x00000000005CB000-0x00000000005D4000-memory.dmp

    Filesize

    36KB

  • memory/1408-57-0x0000000000220000-0x0000000000229000-memory.dmp

    Filesize

    36KB

  • memory/1408-58-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

  • memory/1408-56-0x0000000075C51000-0x0000000075C53000-memory.dmp

    Filesize

    8KB

  • memory/1528-119-0x000000013F670000-0x000000013F679000-memory.dmp

    Filesize

    36KB

  • memory/1528-120-0x000000013F670000-0x000000013F679000-memory.dmp

    Filesize

    36KB

  • memory/1528-121-0x000000013F670000-0x000000013F679000-memory.dmp

    Filesize

    36KB

  • memory/1528-123-0x000000013F670000-0x000000013F679000-memory.dmp

    Filesize

    36KB

  • memory/1528-124-0x000000013F670000-0x000000013F679000-memory.dmp

    Filesize

    36KB

  • memory/1548-88-0x000000006DE00000-0x000000006DF90000-memory.dmp

    Filesize

    1.6MB

  • memory/1548-73-0x0000000075200000-0x000000007535C000-memory.dmp

    Filesize

    1.4MB

  • memory/1548-66-0x0000000000190000-0x0000000000191000-memory.dmp

    Filesize

    4KB

  • memory/1548-89-0x000000006CC50000-0x000000006CC67000-memory.dmp

    Filesize

    92KB

  • memory/1548-64-0x0000000074920000-0x000000007496A000-memory.dmp

    Filesize

    296KB

  • memory/1548-76-0x00000000768A0000-0x000000007692F000-memory.dmp

    Filesize

    572KB

  • memory/1548-60-0x0000000000000000-mapping.dmp

  • memory/1548-74-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

    Filesize

    4KB

  • memory/1548-68-0x0000000075660000-0x000000007570C000-memory.dmp

    Filesize

    688KB

  • memory/1548-69-0x00000000754E0000-0x0000000075527000-memory.dmp

    Filesize

    284KB

  • memory/1548-79-0x0000000002770000-0x0000000002771000-memory.dmp

    Filesize

    4KB

  • memory/1548-70-0x0000000076A70000-0x0000000076AC7000-memory.dmp

    Filesize

    348KB

  • memory/1548-71-0x0000000000380000-0x00000000003C5000-memory.dmp

    Filesize

    276KB

  • memory/1548-65-0x0000000000BB0000-0x0000000000C18000-memory.dmp

    Filesize

    416KB

  • memory/1548-81-0x0000000076C10000-0x0000000076C45000-memory.dmp

    Filesize

    212KB

  • memory/1548-80-0x00000000734B0000-0x00000000734C7000-memory.dmp

    Filesize

    92KB

  • memory/1548-78-0x0000000075C50000-0x000000007689A000-memory.dmp

    Filesize

    12.3MB

  • memory/1596-113-0x0000000000000000-mapping.dmp

  • memory/1908-116-0x0000000000000000-mapping.dmp