Analysis
- max time kernel
150s - max time network
118s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
16/12/2021, 08:11
General
- Target b06691c16c38df919e814bb555fbd34e.exe
- Size 153KB
- Sample211216-j3aaescbhm
- SHA256 ca612bb8fd70332cd79b0dcf033e1432bfc27a7f1c11928dc0668c59dd67f230
Malware Config
Extracted
-
smokeloader
-
2020
-
http://rcacademy.at/upload/
-
http://e-lanpengeonline.com/upload/
-
http://vjcmvz.cn/upload/
-
http://galala.ru/upload/
-
http://witra.ru/upload/
Extracted
-
redline
-
ww
-
45.9.20.168:46257
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Deletes itself 1 IoCs
- Loads dropped DLL 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of FindShellTrayWindow 2 IoCs
- Suspicious use of SendNotifyMessage 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b06691c16c38df919e814bb555fbd34e.exe"C:\Users\Admin\AppData\Local\Temp\b06691c16c38df919e814bb555fbd34e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\EF00.exeC:\Users\Admin\AppData\Local\Temp\EF00.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\6172.exeC:\Users\Admin\AppData\Local\Temp\6172.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -ep bypass & 'C:\Users\Admin\AppData\Local\Temp\\ready.ps1'2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe"C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\dajgyu3_.cmdline"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exeC:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RESA14F.tmp" "c:\Users\Admin\AppData\Local\Temp\CSCA14E.tmp"4⤵
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1416-59-0x00000000025A0000-0x00000000025B6000-memory.dmp
memory/1524-69-0x00000000021A3000-0x00000000021A4000-memory.dmp
memory/1524-64-0x00000000001B0000-0x00000000001E9000-memory.dmp
memory/1524-66-0x00000000021A1000-0x00000000021A2000-memory.dmp
memory/1524-67-0x0000000002100000-0x000000000212D000-memory.dmp
memory/1524-68-0x00000000021A2000-0x00000000021A3000-memory.dmp
memory/1524-65-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/1524-63-0x0000000001F90000-0x0000000001FBE000-memory.dmp
memory/1524-62-0x00000000002CB000-0x00000000002F7000-memory.dmp
memory/1524-70-0x00000000021A4000-0x00000000021A6000-memory.dmp
memory/1704-84-0x0000000002510000-0x0000000002512000-memory.dmp
memory/1704-85-0x0000000002512000-0x0000000002514000-memory.dmp
memory/1704-86-0x0000000002514000-0x0000000002517000-memory.dmp
memory/1704-83-0x000007FEEB640000-0x000007FEEC19D000-memory.dmp
memory/1704-87-0x000000001B710000-0x000000001BA0F000-memory.dmp
memory/1704-82-0x000007FEFBE21000-0x000007FEFBE23000-memory.dmp
memory/1704-92-0x000000000251B000-0x000000000253A000-memory.dmp
memory/1704-100-0x000000000253D000-0x000000000253E000-memory.dmp
memory/1728-77-0x00000000410D2000-0x00000000410D4000-memory.dmp
memory/1728-80-0x00000000410D7000-0x00000000410D8000-memory.dmp
memory/1728-79-0x00000000410D6000-0x00000000410D7000-memory.dmp
memory/1728-78-0x00000000410D4000-0x00000000410D6000-memory.dmp
memory/1728-75-0x0000000041420000-0x00000000416EF000-memory.dmp
memory/1804-93-0x0000000000850000-0x0000000000852000-memory.dmp
memory/1904-55-0x0000000076731000-0x0000000076733000-memory.dmp
memory/1904-58-0x0000000000400000-0x0000000000818000-memory.dmp
memory/1904-57-0x0000000000030000-0x0000000000039000-memory.dmp
memory/1904-56-0x0000000000020000-0x0000000000028000-memory.dmp