Analysis
- max time kernel
150s - max time network
138s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
18/12/2021, 06:30
General
- Target 951d4903cedd287e8b24fe5dfca3d99d.exe
- Size 299KB
- Sample211218-g9ht2afcgn
- SHA256 b1f977415cb0ada91f4a2ba455d315b7a2ca9e7d1a191348fa95edede644a49b
Malware Config
Extracted
-
smokeloader
-
2020
-
http://rcacademy.at/upload/
-
http://e-lanpengeonline.com/upload/
-
http://vjcmvz.cn/upload/
-
http://galala.ru/upload/
-
http://witra.ru/upload/
Extracted
-
redline
-
1
-
86.107.197.138:38133
Extracted
-
redline
-
170
-
45.9.20.240:46257
Signatures
- Guloader,Cloudeye
A shellcode based downloader first seen in 2020.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Checks QEMU agent file 2 TTPs 1 IoCs
Checks presence of QEMU agent, possibly to detect virtualization.
- Deletes itself 1 IoCs
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 25 IoCs
- Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\951d4903cedd287e8b24fe5dfca3d99d.exe"C:\Users\Admin\AppData\Local\Temp\951d4903cedd287e8b24fe5dfca3d99d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\4811.exeC:\Users\Admin\AppData\Local\Temp\4811.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4811.exeC:\Users\Admin\AppData\Local\Temp\4811.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\BDCF.exeC:\Users\Admin\AppData\Local\Temp\BDCF.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\149A.exeC:\Users\Admin\AppData\Local\Temp\149A.exe1⤵
- Executes dropped EXE
- Checks QEMU agent file
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\149A.exeC:\Users\Admin\AppData\Local\Temp\149A.exe2⤵
- Loads dropped DLL
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/800-158-0x0000000004C33000-0x0000000004C34000-memory.dmp
memory/800-165-0x0000000004C34000-0x0000000004C36000-memory.dmp
memory/800-155-0x0000000004C30000-0x0000000004C31000-memory.dmp
memory/800-154-0x00000000023D0000-0x00000000023FE000-memory.dmp
memory/800-152-0x0000000001FC0000-0x0000000001FF9000-memory.dmp
memory/800-153-0x0000000000400000-0x00000000004E8000-memory.dmp
memory/800-159-0x0000000002620000-0x000000000264D000-memory.dmp
memory/800-157-0x0000000004C32000-0x0000000004C33000-memory.dmp
memory/800-164-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/2484-184-0x0000000076FD0000-0x000000007715E000-memory.dmp
memory/2484-176-0x0000000003EC0000-0x0000000003FC0000-memory.dmp
memory/2484-177-0x00007FFAB37D0000-0x00007FFAB39AB000-memory.dmp
memory/2484-178-0x0000000076FD0000-0x000000007715E000-memory.dmp
memory/3020-118-0x0000000000F10000-0x0000000000F26000-memory.dmp
memory/3756-117-0x0000000000400000-0x00000000004CC000-memory.dmp
memory/3756-116-0x00000000001E0000-0x00000000001E9000-memory.dmp
memory/3756-115-0x0000000000686000-0x0000000000696000-memory.dmp
memory/3804-185-0x0000000000560000-0x0000000000660000-memory.dmp
memory/3804-183-0x0000000000401000-0x00000000004FD000-memory.dmp
memory/3804-181-0x0000000000400000-0x0000000000553000-memory.dmp
memory/4336-147-0x0000000007A90000-0x0000000007A91000-memory.dmp
memory/4336-146-0x0000000007390000-0x0000000007391000-memory.dmp
memory/4336-143-0x0000000006720000-0x0000000006721000-memory.dmp
memory/4336-141-0x0000000005B90000-0x0000000005B91000-memory.dmp
memory/4336-140-0x0000000005750000-0x0000000005D56000-memory.dmp
memory/4336-139-0x0000000005860000-0x0000000005861000-memory.dmp
memory/4336-138-0x0000000005820000-0x0000000005821000-memory.dmp
memory/4336-137-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/4336-136-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/4336-135-0x0000000005D60000-0x0000000005D61000-memory.dmp
memory/4336-129-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4468-128-0x0000000005360000-0x0000000005361000-memory.dmp
memory/4468-127-0x0000000000CD0000-0x0000000000CD1000-memory.dmp
memory/4468-126-0x0000000004B80000-0x0000000004B81000-memory.dmp
memory/4468-125-0x0000000004A90000-0x0000000004A91000-memory.dmp
memory/4468-124-0x0000000004AC0000-0x0000000004AC1000-memory.dmp
memory/4468-122-0x0000000000240000-0x0000000000241000-memory.dmp