Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
09-12-2021 03:39
Static task
static1
Behavioral task
behavioral1
Sample
30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe
Resource
win10-en-20211208
General
-
Target
30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe
-
Size
341KB
-
MD5
c731bf2eebc9d440935ddfb3ca749086
-
SHA1
b464c06b70bfb5731731bcf738fbd9d915a2ac19
-
SHA256
30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145
-
SHA512
30db1cb3544b699fe8891adb98af69ceeaccdae5d0110b7e6981866903223d371dae03729cdf1bd8b691aa54a8ea780e06a5f0a5e266f1b14ba9946cc950ffd4
Malware Config
Extracted
smokeloader
2020
http://rcacademy.at/upload/
http://e-lanpengeonline.com/upload/
http://vjcmvz.cn/upload/
http://galala.ru/upload/
http://witra.ru/upload/
Extracted
redline
195.133.47.114:38627
Extracted
systembc
185.209.30.180:4001
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\6F03.exe family_redline C:\Users\Admin\AppData\Local\Temp\6F03.exe family_redline behavioral1/memory/4456-137-0x0000000000970000-0x00000000009DC000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
5F04.exe6F03.exe8BE2.exeB1EA.exeB1EA.exepid process 4308 5F04.exe 4280 6F03.exe 4456 8BE2.exe 4508 B1EA.exe 592 B1EA.exe -
Deletes itself 1 IoCs
Processes:
pid process 3032 -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
8BE2.exepid process 4456 8BE2.exe -
Drops file in Windows directory 2 IoCs
Processes:
B1EA.exedescription ioc process File created C:\Windows\Tasks\wow64.job B1EA.exe File opened for modification C:\Windows\Tasks\wow64.job B1EA.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exepid process 3460 30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe 3460 30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 3032 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3032 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exepid process 3460 30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe -
Suspicious use of AdjustPrivilegeToken 18 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 Token: SeShutdownPrivilege 3032 Token: SeCreatePagefilePrivilege 3032 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
description pid process target process PID 3032 wrote to memory of 4308 3032 5F04.exe PID 3032 wrote to memory of 4308 3032 5F04.exe PID 3032 wrote to memory of 4308 3032 5F04.exe PID 3032 wrote to memory of 4280 3032 6F03.exe PID 3032 wrote to memory of 4280 3032 6F03.exe PID 3032 wrote to memory of 4280 3032 6F03.exe PID 3032 wrote to memory of 4456 3032 8BE2.exe PID 3032 wrote to memory of 4456 3032 8BE2.exe PID 3032 wrote to memory of 4456 3032 8BE2.exe PID 3032 wrote to memory of 4508 3032 B1EA.exe PID 3032 wrote to memory of 4508 3032 B1EA.exe PID 3032 wrote to memory of 4508 3032 B1EA.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe"C:\Users\Admin\AppData\Local\Temp\30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3460
-
C:\Users\Admin\AppData\Local\Temp\5F04.exeC:\Users\Admin\AppData\Local\Temp\5F04.exe1⤵
- Executes dropped EXE
PID:4308
-
C:\Users\Admin\AppData\Local\Temp\6F03.exeC:\Users\Admin\AppData\Local\Temp\6F03.exe1⤵
- Executes dropped EXE
PID:4280
-
C:\Users\Admin\AppData\Local\Temp\8BE2.exeC:\Users\Admin\AppData\Local\Temp\8BE2.exe1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
PID:4456
-
C:\Users\Admin\AppData\Local\Temp\B1EA.exeC:\Users\Admin\AppData\Local\Temp\B1EA.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
PID:4508
-
C:\Users\Admin\AppData\Local\Temp\B1EA.exeC:\Users\Admin\AppData\Local\Temp\B1EA.exe start1⤵
- Executes dropped EXE
PID:592
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
MD5
77ce7ab11225c5e723b7b1be0308e8c0
SHA1709a8df1d49f28cf8c293694bbbbd0f07735829b
SHA256d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496
SHA512f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b
-
MD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
MD5
3ba1d635fed88d8af279be91b7007bae
SHA162a1d59c746cdb51e699114f410749384a70cf73
SHA2563151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a
SHA51283254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb
-
MD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
MD5
f80418f12c03a56ac2e8d8b189c13750
SHA1cd0b728375e4e178b50bca8ad65ce79aede30d37
SHA256cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716
SHA512e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196
-
MD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
MD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e
-
MD5
fd4e0205ce36f99ff343a78ec3e251bc
SHA1b633df31339acb69f708a41fd227298420fd4036
SHA256617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075
SHA512f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e