Analysis
-
max time kernel
153s -
max time network
146s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
08-12-2021 14:02
Static task
static1
Behavioral task
behavioral1
Sample
a904ea3baeeffecf15272412e0db5657.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a904ea3baeeffecf15272412e0db5657.exe
Resource
win10-en-20211104
General
-
Target
a904ea3baeeffecf15272412e0db5657.exe
-
Size
278KB
-
MD5
a904ea3baeeffecf15272412e0db5657
-
SHA1
22d418de7d1ca07392be9c5596d1c294854b2d99
-
SHA256
e576d4e4fa5d355d71e9b882c8a1f05f0484e55c6c6df348a043f5df5ff4be22
-
SHA512
c58439beae0faf7077fa97329275afae994ad2c2406c00b86560e3d5b471d046817a872afdd2a2a985e96210378862d5d2593f512e2cffbc5f1bec5bff8edc96
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Extracted
icedid
3439131404
grendafolz.com
Extracted
systembc
185.209.30.180:4001
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/4488-125-0x0000000000920000-0x0000000000988000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\9920.exe family_redline C:\Users\Admin\AppData\Local\Temp\9920.exe family_redline behavioral2/memory/1812-168-0x00000000010B0000-0x000000000111C000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 8 IoCs
Processes:
8604.exe9920.exeBAA3.exeD214.exeD214.exeD214.exe22E.exe22E.exepid process 4488 8604.exe 436 9920.exe 1812 BAA3.exe 2652 D214.exe 2664 D214.exe 2888 D214.exe 1344 22E.exe 2192 22E.exe -
Deletes itself 1 IoCs
Processes:
pid process 396 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
8604.exeBAA3.exepid process 4488 8604.exe 1812 BAA3.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
D214.exedescription pid process target process PID 2664 set thread context of 2888 2664 D214.exe D214.exe -
Drops file in Windows directory 2 IoCs
Processes:
22E.exedescription ioc process File created C:\Windows\Tasks\wow64.job 22E.exe File opened for modification C:\Windows\Tasks\wow64.job 22E.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
a904ea3baeeffecf15272412e0db5657.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a904ea3baeeffecf15272412e0db5657.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a904ea3baeeffecf15272412e0db5657.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI a904ea3baeeffecf15272412e0db5657.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a904ea3baeeffecf15272412e0db5657.exepid process 3708 a904ea3baeeffecf15272412e0db5657.exe 3708 a904ea3baeeffecf15272412e0db5657.exe 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 396 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 396 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
a904ea3baeeffecf15272412e0db5657.exepid process 3708 a904ea3baeeffecf15272412e0db5657.exe -
Suspicious use of AdjustPrivilegeToken 37 IoCs
Processes:
8604.exeBAA3.exe9920.exedescription pid process Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeDebugPrivilege 4488 8604.exe Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeDebugPrivilege 1812 BAA3.exe Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeDebugPrivilege 436 9920.exe Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 Token: SeShutdownPrivilege 396 Token: SeCreatePagefilePrivilege 396 -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
D214.exeD214.exedescription pid process target process PID 396 wrote to memory of 4488 396 8604.exe PID 396 wrote to memory of 4488 396 8604.exe PID 396 wrote to memory of 4488 396 8604.exe PID 396 wrote to memory of 436 396 9920.exe PID 396 wrote to memory of 436 396 9920.exe PID 396 wrote to memory of 436 396 9920.exe PID 396 wrote to memory of 1812 396 BAA3.exe PID 396 wrote to memory of 1812 396 BAA3.exe PID 396 wrote to memory of 1812 396 BAA3.exe PID 396 wrote to memory of 2652 396 D214.exe PID 396 wrote to memory of 2652 396 D214.exe PID 2652 wrote to memory of 2664 2652 D214.exe D214.exe PID 2652 wrote to memory of 2664 2652 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 2664 wrote to memory of 2888 2664 D214.exe D214.exe PID 396 wrote to memory of 1344 396 22E.exe PID 396 wrote to memory of 1344 396 22E.exe PID 396 wrote to memory of 1344 396 22E.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a904ea3baeeffecf15272412e0db5657.exe"C:\Users\Admin\AppData\Local\Temp\a904ea3baeeffecf15272412e0db5657.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3708
-
C:\Users\Admin\AppData\Local\Temp\8604.exeC:\Users\Admin\AppData\Local\Temp\8604.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:4488
-
C:\Users\Admin\AppData\Local\Temp\9920.exeC:\Users\Admin\AppData\Local\Temp\9920.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:436
-
C:\Users\Admin\AppData\Local\Temp\BAA3.exeC:\Users\Admin\AppData\Local\Temp\BAA3.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
PID:1812
-
C:\Users\Admin\AppData\Local\Temp\D214.exeC:\Users\Admin\AppData\Local\Temp\D214.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Users\Admin\AppData\Local\Temp\D214.exeC:\Users\Admin\AppData\Local\Temp\D214.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\D214.exeC:\Users\Admin\AppData\Local\Temp\D214.exe3⤵
- Executes dropped EXE
PID:2888
-
C:\Users\Admin\AppData\Local\Temp\22E.exeC:\Users\Admin\AppData\Local\Temp\22E.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:1344
-
C:\Users\Admin\AppData\Local\Temp\22E.exeC:\Users\Admin\AppData\Local\Temp\22E.exe start1⤵
- Executes dropped EXE
PID:2192
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\22E.exeMD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
C:\Users\Admin\AppData\Local\Temp\22E.exeMD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
C:\Users\Admin\AppData\Local\Temp\22E.exeMD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
C:\Users\Admin\AppData\Local\Temp\8604.exeMD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
C:\Users\Admin\AppData\Local\Temp\8604.exeMD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
C:\Users\Admin\AppData\Local\Temp\9920.exeMD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
C:\Users\Admin\AppData\Local\Temp\9920.exeMD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
C:\Users\Admin\AppData\Local\Temp\BAA3.exeMD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
C:\Users\Admin\AppData\Local\Temp\BAA3.exeMD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
C:\Users\Admin\AppData\Local\Temp\D214.exeMD5
7ade34e7d74c83cee4c8f288c90128d5
SHA113a4bf57f5777cdd9bfb0d9568392e39d3073ed0
SHA256032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad
SHA512d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69
-
C:\Users\Admin\AppData\Local\Temp\D214.exeMD5
7ade34e7d74c83cee4c8f288c90128d5
SHA113a4bf57f5777cdd9bfb0d9568392e39d3073ed0
SHA256032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad
SHA512d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69
-
C:\Users\Admin\AppData\Local\Temp\D214.exeMD5
7ade34e7d74c83cee4c8f288c90128d5
SHA113a4bf57f5777cdd9bfb0d9568392e39d3073ed0
SHA256032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad
SHA512d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69
-
C:\Users\Admin\AppData\Local\Temp\D214.exeMD5
7ade34e7d74c83cee4c8f288c90128d5
SHA113a4bf57f5777cdd9bfb0d9568392e39d3073ed0
SHA256032bf53a2f8d5b6b4512505a44e67c7c1e80f3f8b063cc78d13f2c78c5fb9bad
SHA512d65732c04d81bb5e947d9ff43bf40dc911659919bd662d24795ddddfcabe91135c71d7fcea2e1980f063827a9b8e51d9f16a0e8e0d3c46dc52df4a58f75b4c69
-
memory/396-121-0x00000000003C0000-0x00000000003D6000-memory.dmpFilesize
88KB
-
memory/436-145-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/436-142-0x0000000000000000-mapping.dmp
-
memory/436-151-0x0000000004B90000-0x0000000005196000-memory.dmpFilesize
6.0MB
-
memory/1344-203-0x0000000000000000-mapping.dmp
-
memory/1344-207-0x0000000002DC0000-0x0000000002DC5000-memory.dmpFilesize
20KB
-
memory/1344-206-0x0000000002DB0000-0x0000000002DB6000-memory.dmpFilesize
24KB
-
memory/1344-209-0x0000000000400000-0x0000000002B74000-memory.dmpFilesize
39.5MB
-
memory/1812-182-0x0000000075310000-0x0000000076658000-memory.dmpFilesize
19.3MB
-
memory/1812-181-0x0000000074730000-0x0000000074CB4000-memory.dmpFilesize
5.5MB
-
memory/1812-170-0x0000000076C40000-0x0000000076E02000-memory.dmpFilesize
1.8MB
-
memory/1812-172-0x0000000076660000-0x0000000076751000-memory.dmpFilesize
964KB
-
memory/1812-169-0x0000000000F00000-0x0000000000F01000-memory.dmpFilesize
4KB
-
memory/1812-168-0x00000000010B0000-0x000000000111C000-memory.dmpFilesize
432KB
-
memory/1812-165-0x0000000000000000-mapping.dmp
-
memory/1812-176-0x0000000071A80000-0x0000000071B00000-memory.dmpFilesize
512KB
-
memory/1812-186-0x0000000070FE0000-0x000000007102B000-memory.dmpFilesize
300KB
-
memory/1812-174-0x00000000010B0000-0x00000000010B1000-memory.dmpFilesize
4KB
-
memory/1812-184-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/1812-183-0x00000000011F0000-0x0000000001235000-memory.dmpFilesize
276KB
-
memory/2192-210-0x0000000000400000-0x0000000002B74000-memory.dmpFilesize
39.5MB
-
memory/2652-187-0x0000000000000000-mapping.dmp
-
memory/2664-190-0x0000000000000000-mapping.dmp
-
memory/2888-199-0x00007FF6139F0000-0x00007FF6139F9000-memory.dmpFilesize
36KB
-
memory/2888-193-0x00007FF6139F1364-mapping.dmp
-
memory/2888-192-0x00007FF6139F0000-0x00007FF6139F9000-memory.dmpFilesize
36KB
-
memory/3708-119-0x00000000005B0000-0x00000000005B9000-memory.dmpFilesize
36KB
-
memory/3708-120-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/3708-118-0x0000000000739000-0x0000000000742000-memory.dmpFilesize
36KB
-
memory/4488-135-0x00000000058A0000-0x00000000058A1000-memory.dmpFilesize
4KB
-
memory/4488-159-0x0000000007940000-0x0000000007941000-memory.dmpFilesize
4KB
-
memory/4488-158-0x0000000007240000-0x0000000007241000-memory.dmpFilesize
4KB
-
memory/4488-157-0x00000000069B0000-0x00000000069B1000-memory.dmpFilesize
4KB
-
memory/4488-156-0x0000000006B70000-0x0000000006B71000-memory.dmpFilesize
4KB
-
memory/4488-155-0x00000000065D0000-0x00000000065D1000-memory.dmpFilesize
4KB
-
memory/4488-154-0x00000000064B0000-0x00000000064B1000-memory.dmpFilesize
4KB
-
memory/4488-153-0x0000000005A30000-0x0000000005A31000-memory.dmpFilesize
4KB
-
memory/4488-141-0x0000000070FE0000-0x000000007102B000-memory.dmpFilesize
300KB
-
memory/4488-140-0x0000000005730000-0x0000000005731000-memory.dmpFilesize
4KB
-
memory/4488-138-0x0000000075310000-0x0000000076658000-memory.dmpFilesize
19.3MB
-
memory/4488-139-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/4488-137-0x0000000074730000-0x0000000074CB4000-memory.dmpFilesize
5.5MB
-
memory/4488-136-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/4488-134-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB
-
memory/4488-133-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/4488-132-0x0000000001170000-0x00000000011B5000-memory.dmpFilesize
276KB
-
memory/4488-131-0x0000000071A80000-0x0000000071B00000-memory.dmpFilesize
512KB
-
memory/4488-129-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/4488-128-0x0000000076660000-0x0000000076751000-memory.dmpFilesize
964KB
-
memory/4488-127-0x0000000076C40000-0x0000000076E02000-memory.dmpFilesize
1.8MB
-
memory/4488-126-0x0000000001100000-0x0000000001101000-memory.dmpFilesize
4KB
-
memory/4488-125-0x0000000000920000-0x0000000000988000-memory.dmpFilesize
416KB
-
memory/4488-122-0x0000000000000000-mapping.dmp