Analysis
-
max time kernel
151s -
max time network
132s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
08-12-2021 19:57
General
-
Target
df81e2c130757a997d2c984781735d6351b05c41c4fd34970a8e7a0a969b009d.exe
-
Size
233KB
-
MD5
aa8b2397e9c6c50444997ac7562c694e
-
SHA1
84416fa7ed22759705e4d7871fe3d39620d9b374
-
SHA256
df81e2c130757a997d2c984781735d6351b05c41c4fd34970a8e7a0a969b009d
-
SHA512
bbed151c57637428c57e00185bcb1ee0180d990f723ab17962e928844e099e584a7c96d8c7f82a94a663a0416c512be29e2cb6d444d8800b6c3242485d363735
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Extracted
systembc
185.209.30.180:4001
Extracted
redline
1488
80.66.87.52:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 7 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 7 IoCs
-
Deletes itself 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 2 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 45 IoCs
-
Suspicious use of WriteProcessMemory 23 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\df81e2c130757a997d2c984781735d6351b05c41c4fd34970a8e7a0a969b009d.exe"C:\Users\Admin\AppData\Local\Temp\df81e2c130757a997d2c984781735d6351b05c41c4fd34970a8e7a0a969b009d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7972.exeC:\Users\Admin\AppData\Local\Temp\7972.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\8654.exeC:\Users\Admin\AppData\Local\Temp\8654.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Knots.exe"C:\Users\Admin\AppData\Local\Temp\Knots.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Knots.exeC:\Users\Admin\AppData\Local\Temp\Knots.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\9817.exeC:\Users\Admin\AppData\Local\Temp\9817.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\B507.exeC:\Users\Admin\AppData\Local\Temp\B507.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\B507.exeC:\Users\Admin\AppData\Local\Temp\B507.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
41fbed686f5700fc29aaccf83e8ba7fd
SHA15271bc29538f11e42a3b600c8dc727186e912456
SHA256df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437
SHA512234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034
-
MD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
MD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
MD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
MD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
MD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
MD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
MD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
MD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
MD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
MD5
e1c9ff41a69e7b381d498c56243e3f19
SHA1b09e041a9d71ab8bc5965ffb3dd14d74ea932bce
SHA2561482d5afef2f604625b850fbe609699c64a342d1880e9d27ef62a77817b75cdc
SHA512a005c87491bb48d96af386e8ed9cf3604a2fa708ea03219404587d69470e4516e8e71f7306e107c98b9baea83de29490cf81cdd216e752fce9b4019cf069885e
-
MD5
e1c9ff41a69e7b381d498c56243e3f19
SHA1b09e041a9d71ab8bc5965ffb3dd14d74ea932bce
SHA2561482d5afef2f604625b850fbe609699c64a342d1880e9d27ef62a77817b75cdc
SHA512a005c87491bb48d96af386e8ed9cf3604a2fa708ea03219404587d69470e4516e8e71f7306e107c98b9baea83de29490cf81cdd216e752fce9b4019cf069885e
-
MD5
e1c9ff41a69e7b381d498c56243e3f19
SHA1b09e041a9d71ab8bc5965ffb3dd14d74ea932bce
SHA2561482d5afef2f604625b850fbe609699c64a342d1880e9d27ef62a77817b75cdc
SHA512a005c87491bb48d96af386e8ed9cf3604a2fa708ea03219404587d69470e4516e8e71f7306e107c98b9baea83de29490cf81cdd216e752fce9b4019cf069885e
-
Filesize
6.0MB
-
-
Filesize
128KB
-
Filesize
39.5MB
-
Filesize
20KB
-
-
Filesize
24KB
-
Filesize
88KB
-
Filesize
1.3MB
-
Filesize
39.5MB
-
Filesize
32KB
-
Filesize
4.2MB
-
Filesize
36KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
964KB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
1.8MB
-
-
Filesize
276KB
-
Filesize
4KB
-
Filesize
512KB
-
Filesize
5.5MB
-
Filesize
19.3MB
-
Filesize
300KB
-
Filesize
4KB
-
Filesize
300KB
-
Filesize
512KB
-
-
Filesize
416KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
1.8MB
-
Filesize
4KB
-
Filesize
276KB
-
Filesize
19.3MB
-
Filesize
964KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
5.5MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB