Analysis

  • max time kernel
    151s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    09-12-2021 03:39

General

  • Target

    30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe

  • Size

    341KB

  • MD5

    c731bf2eebc9d440935ddfb3ca749086

  • SHA1

    b464c06b70bfb5731731bcf738fbd9d915a2ac19

  • SHA256

    30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145

  • SHA512

    30db1cb3544b699fe8891adb98af69ceeaccdae5d0110b7e6981866903223d371dae03729cdf1bd8b691aa54a8ea780e06a5f0a5e266f1b14ba9946cc950ffd4

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://rcacademy.at/upload/

http://e-lanpengeonline.com/upload/

http://vjcmvz.cn/upload/

http://galala.ru/upload/

http://witra.ru/upload/

rc4.i32
rc4.i32

Extracted

Family

redline

C2

195.133.47.114:38627

Extracted

Family

systembc

C2

185.209.30.180:4001

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • SystemBC

    SystemBC is a proxy and remote administration tool first seen in 2019.

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe
    "C:\Users\Admin\AppData\Local\Temp\30494b5207c38659e9589728923aee53b7b1d9a46b7d0865c3d260ba28827145.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3460
  • C:\Users\Admin\AppData\Local\Temp\5F04.exe
    C:\Users\Admin\AppData\Local\Temp\5F04.exe
    1⤵
    • Executes dropped EXE
    PID:4308
  • C:\Users\Admin\AppData\Local\Temp\6F03.exe
    C:\Users\Admin\AppData\Local\Temp\6F03.exe
    1⤵
    • Executes dropped EXE
    PID:4280
  • C:\Users\Admin\AppData\Local\Temp\8BE2.exe
    C:\Users\Admin\AppData\Local\Temp\8BE2.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    PID:4456
  • C:\Users\Admin\AppData\Local\Temp\B1EA.exe
    C:\Users\Admin\AppData\Local\Temp\B1EA.exe
    1⤵
    • Executes dropped EXE
    • Drops file in Windows directory
    PID:4508
  • C:\Users\Admin\AppData\Local\Temp\B1EA.exe
    C:\Users\Admin\AppData\Local\Temp\B1EA.exe start
    1⤵
    • Executes dropped EXE
    PID:592

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\5F04.exe

    MD5

    77ce7ab11225c5e723b7b1be0308e8c0

    SHA1

    709a8df1d49f28cf8c293694bbbbd0f07735829b

    SHA256

    d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

    SHA512

    f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

  • C:\Users\Admin\AppData\Local\Temp\5F04.exe

    MD5

    77ce7ab11225c5e723b7b1be0308e8c0

    SHA1

    709a8df1d49f28cf8c293694bbbbd0f07735829b

    SHA256

    d407b5c7d9568448f1e7387924fe4dded9e016632879c386c307ef5dcf63f496

    SHA512

    f73582206397db625bdefbbaf8abdc1a820ae8054eb2ef2a3ed18c8e00e8365c7ad81013b33990e4304619b3834a1b8b15c782905204add158fca686e2c25c3b

  • C:\Users\Admin\AppData\Local\Temp\6F03.exe

    MD5

    3ba1d635fed88d8af279be91b7007bae

    SHA1

    62a1d59c746cdb51e699114f410749384a70cf73

    SHA256

    3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

    SHA512

    83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

  • C:\Users\Admin\AppData\Local\Temp\6F03.exe

    MD5

    3ba1d635fed88d8af279be91b7007bae

    SHA1

    62a1d59c746cdb51e699114f410749384a70cf73

    SHA256

    3151b115c3370d5360286bfe3a053d0d543f0e5d21faa68fee167224e68d115a

    SHA512

    83254fb484bd40740e5e0483dcc7fd8ce612033b00238494fdcdc5a5dcb3503195e0e2694edd5d848c07e2ddc61cafdb7d331afc4792ccd788837ebbce18bfeb

  • C:\Users\Admin\AppData\Local\Temp\8BE2.exe

    MD5

    f80418f12c03a56ac2e8d8b189c13750

    SHA1

    cd0b728375e4e178b50bca8ad65ce79aede30d37

    SHA256

    cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

    SHA512

    e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

  • C:\Users\Admin\AppData\Local\Temp\8BE2.exe

    MD5

    f80418f12c03a56ac2e8d8b189c13750

    SHA1

    cd0b728375e4e178b50bca8ad65ce79aede30d37

    SHA256

    cbc5d7db8e27b2369a1d83c2d8615c1dbb6263e8b80c4b12a86493c9df093716

    SHA512

    e3fb85cc08a94193528ecc760b58904df47aa302419267c5b3386468e1d7fdece63fee05d8d95a083637b70a24035d3123c94463111ba372b39fcc69787aa196

  • C:\Users\Admin\AppData\Local\Temp\B1EA.exe

    MD5

    fd4e0205ce36f99ff343a78ec3e251bc

    SHA1

    b633df31339acb69f708a41fd227298420fd4036

    SHA256

    617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

    SHA512

    f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

  • C:\Users\Admin\AppData\Local\Temp\B1EA.exe

    MD5

    fd4e0205ce36f99ff343a78ec3e251bc

    SHA1

    b633df31339acb69f708a41fd227298420fd4036

    SHA256

    617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

    SHA512

    f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

  • C:\Users\Admin\AppData\Local\Temp\B1EA.exe

    MD5

    fd4e0205ce36f99ff343a78ec3e251bc

    SHA1

    b633df31339acb69f708a41fd227298420fd4036

    SHA256

    617f9d822418a44cac50b28755f2d075fac1c2de21995820912f07f4b4ee8075

    SHA512

    f413a054603bc0bc86d1657e3960c4b691e7900be36e9470a408264cb63ad0eb9d7cea7b83dbfdf7f727ea5c359d7d6ab5b565ab60976735d67f00c5a082f50e

  • memory/592-163-0x0000000000400000-0x0000000002B74000-memory.dmp

    Filesize

    39.5MB

  • memory/592-162-0x0000000002B80000-0x0000000002CCA000-memory.dmp

    Filesize

    1.3MB

  • memory/592-161-0x0000000002B80000-0x0000000002CCA000-memory.dmp

    Filesize

    1.3MB

  • memory/3032-118-0x00000000012F0000-0x0000000001306000-memory.dmp

    Filesize

    88KB

  • memory/3460-116-0x0000000000030000-0x0000000000039000-memory.dmp

    Filesize

    36KB

  • memory/3460-117-0x0000000000400000-0x00000000004D6000-memory.dmp

    Filesize

    856KB

  • memory/3460-115-0x0000000000861000-0x0000000000871000-memory.dmp

    Filesize

    64KB

  • memory/4280-131-0x0000000004C70000-0x0000000004C71000-memory.dmp

    Filesize

    4KB

  • memory/4280-133-0x0000000004CB0000-0x0000000004CB1000-memory.dmp

    Filesize

    4KB

  • memory/4280-132-0x0000000004B40000-0x0000000005146000-memory.dmp

    Filesize

    6.0MB

  • memory/4280-123-0x0000000000000000-mapping.dmp

  • memory/4280-126-0x00000000002B0000-0x00000000002B1000-memory.dmp

    Filesize

    4KB

  • memory/4280-128-0x0000000005150000-0x0000000005151000-memory.dmp

    Filesize

    4KB

  • memory/4280-129-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

    Filesize

    4KB

  • memory/4280-130-0x0000000004D20000-0x0000000004D21000-memory.dmp

    Filesize

    4KB

  • memory/4308-122-0x0000000003150000-0x0000000003195000-memory.dmp

    Filesize

    276KB

  • memory/4308-119-0x0000000000000000-mapping.dmp

  • memory/4456-150-0x00000000762B0000-0x0000000076834000-memory.dmp

    Filesize

    5.5MB

  • memory/4456-141-0x0000000000970000-0x0000000000971000-memory.dmp

    Filesize

    4KB

  • memory/4456-149-0x00000000023E0000-0x00000000023E1000-memory.dmp

    Filesize

    4KB

  • memory/4456-143-0x0000000071D20000-0x0000000071DA0000-memory.dmp

    Filesize

    512KB

  • memory/4456-151-0x0000000074BD0000-0x0000000075F18000-memory.dmp

    Filesize

    19.3MB

  • memory/4456-153-0x000000006FF70000-0x000000006FFBB000-memory.dmp

    Filesize

    300KB

  • memory/4456-134-0x0000000000000000-mapping.dmp

  • memory/4456-148-0x00000000005B0000-0x00000000005F5000-memory.dmp

    Filesize

    276KB

  • memory/4456-140-0x0000000074430000-0x0000000074521000-memory.dmp

    Filesize

    964KB

  • memory/4456-137-0x0000000000970000-0x00000000009DC000-memory.dmp

    Filesize

    432KB

  • memory/4456-138-0x0000000000120000-0x0000000000121000-memory.dmp

    Filesize

    4KB

  • memory/4456-139-0x0000000076E20000-0x0000000076FE2000-memory.dmp

    Filesize

    1.8MB

  • memory/4508-159-0x0000000000400000-0x0000000002B74000-memory.dmp

    Filesize

    39.5MB

  • memory/4508-157-0x0000000002CA0000-0x0000000002DEA000-memory.dmp

    Filesize

    1.3MB

  • memory/4508-158-0x0000000002CA0000-0x0000000002DEA000-memory.dmp

    Filesize

    1.3MB

  • memory/4508-154-0x0000000000000000-mapping.dmp