Analysis

  • max time kernel
    146s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    25/12/2021, 19:11

General

  • Target

    819C9D8C88FC1FFBFEAE1797646F7B90F930FEF4DAE51.exe

  • Size

    6.2MB

  • MD5

    034469917307c8de1a984ac9fb025166

  • SHA1

    a5ad1cb9bdbe68d25d4809e86abc1f8717e5582e

  • SHA256

    819c9d8c88fc1ffbfeae1797646f7b90f930fef4dae513fe8e43fad3bf475bf0

  • SHA512

    f965845a9ee4eb187dd909bc1210e4239b8748f41976ef0dfa9523dedf58c673985cb202ea79402446fe50247cd683a95cfc8c48c1720fe887469bf6195ebaf4

Malware Config

Extracted

Family

socelars

C2

http://www.iyiqian.com/

http://www.hbgents.top/

http://www.rsnzhy.com/

http://www.znsjis.top/

Extracted

Family

redline

Botnet

matthew2009

C2

213.166.69.181:64650

Extracted

Family

redline

Botnet

ANI

C2

45.142.215.47:27643

Extracted

Family

vidar

Version

41

Botnet

706

C2

https://mas.to/@killern0

Attributes
  • profile_id

    706

Extracted

Family

smokeloader

Version

2020

C2

http://govsurplusstore.com/upload/

http://best-forsale.com/upload/

http://chmxnautoparts.com/upload/

http://kwazone.com/upload/

rc4.i32
rc4.i32

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 14 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Socelars

    Socelars is an infostealer targeting browser cookies and credit card credentials.

  • Socelars Payload 3 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Vidar Stealer 2 IoCs
  • ASPack v2.12-2.42 6 IoCs

    Detects executables packed with ASPack v2.12-2.42

  • Executes dropped EXE 20 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Loads dropped DLL 64 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Themida packer 3 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 3 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Looks up geolocation information via web service

    Uses a legitimate geolocation service to find the infected system's geolocation info.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 3 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 4 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 41 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\819C9D8C88FC1FFBFEAE1797646F7B90F930FEF4DAE51.exe
    "C:\Users\Admin\AppData\Local\Temp\819C9D8C88FC1FFBFEAE1797646F7B90F930FEF4DAE51.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
      "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:524
      • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\setup_install.exe
        "C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\setup_install.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious use of WriteProcessMemory
        PID:1488
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
          4⤵
            PID:1992
            • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
              powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"
              5⤵
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:1604
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu13a7cef837ebe31b.exe
            4⤵
            • Loads dropped DLL
            PID:2004
            • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu13a7cef837ebe31b.exe
              Thu13a7cef837ebe31b.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1732
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu1333d0a5c4.exe
            4⤵
            • Loads dropped DLL
            • Suspicious use of WriteProcessMemory
            PID:1332
            • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu1333d0a5c4.exe
              Thu1333d0a5c4.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:1648
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu132d3beffccd.exe
            4⤵
            • Loads dropped DLL
            PID:1736
            • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu132d3beffccd.exe
              Thu132d3beffccd.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of SetThreadContext
              PID:1984
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu132d3beffccd.exe
                C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu132d3beffccd.exe
                6⤵
                • Executes dropped EXE
                PID:2072
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c Thu139a4667a4bcc.exe
            4⤵
            • Loads dropped DLL
            PID:980
            • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu139a4667a4bcc.exe
              Thu139a4667a4bcc.exe
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Modifies system certificate store
              • Suspicious use of AdjustPrivilegeToken
              PID:1656
              • C:\Windows\SysWOW64\cmd.exe
                cmd.exe /c taskkill /f /im chrome.exe
                6⤵
                  PID:2284
                  • C:\Windows\SysWOW64\taskkill.exe
                    taskkill /f /im chrome.exe
                    7⤵
                    • Kills process with taskkill
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2332
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1656 -s 1440
                  6⤵
                  • Program crash
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2460
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu131b8cfbf6991de.exe /mixone
              4⤵
              • Loads dropped DLL
              PID:1720
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu131b8cfbf6991de.exe
                Thu131b8cfbf6991de.exe /mixone
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious behavior: GetForegroundWindowSpam
                PID:856
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu137fba5c145.exe
              4⤵
              • Loads dropped DLL
              PID:1068
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu137fba5c145.exe
                Thu137fba5c145.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Suspicious use of SetThreadContext
                PID:1568
                • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu137fba5c145.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu137fba5c145.exe
                  6⤵
                  • Executes dropped EXE
                  PID:2080
                • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu137fba5c145.exe
                  C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu137fba5c145.exe
                  6⤵
                  • Executes dropped EXE
                  PID:2196
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu13c4f61c88e.exe
              4⤵
              • Loads dropped DLL
              PID:1748
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu13c4f61c88e.exe
                Thu13c4f61c88e.exe
                5⤵
                • Executes dropped EXE
                PID:788
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu13057255b6f0.exe
              4⤵
              • Loads dropped DLL
              PID:1480
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu13057255b6f0.exe
                Thu13057255b6f0.exe
                5⤵
                • Executes dropped EXE
                • Checks BIOS information in registry
                • Loads dropped DLL
                • Checks whether UAC is enabled
                • Suspicious use of NtSetInformationThreadHideFromDebugger
                • Suspicious behavior: EnumeratesProcesses
                PID:1164
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu13b4c97dc09be.exe
              4⤵
              • Loads dropped DLL
              PID:760
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu13b4c97dc09be.exe
                Thu13b4c97dc09be.exe
                5⤵
                • Executes dropped EXE
                PID:1136
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu1331399915bc.exe
              4⤵
              • Loads dropped DLL
              PID:432
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu1331399915bc.exe
                Thu1331399915bc.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                PID:1800
                • C:\Windows\SysWOW64\WerFault.exe
                  C:\Windows\SysWOW64\WerFault.exe -u -p 1800 -s 1368
                  6⤵
                  • Program crash
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious behavior: GetForegroundWindowSpam
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2712
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu131d30b4ff3be.exe
              4⤵
              • Loads dropped DLL
              PID:1996
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu131d30b4ff3be.exe
                Thu131d30b4ff3be.exe
                5⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Checks SCSI registry key(s)
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious behavior: MapViewOfSection
                PID:672
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu13e038722ba1359cc.exe
              4⤵
              • Loads dropped DLL
              PID:1744
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu13e038722ba1359cc.exe
                Thu13e038722ba1359cc.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:1752
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu1357848a7d8b.exe
              4⤵
              • Loads dropped DLL
              PID:1932
              • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu1357848a7d8b.exe
                Thu1357848a7d8b.exe
                5⤵
                • Executes dropped EXE
                • Suspicious use of AdjustPrivilegeToken
                PID:900
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1488 -s 472
              4⤵
              • Loads dropped DLL
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:1168
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c Thu135c06033a9903.exe
              4⤵
              • Loads dropped DLL
              PID:1696
      • C:\Users\Admin\AppData\Local\Temp\is-S2MR3.tmp\Thu135c06033a9903.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-S2MR3.tmp\Thu135c06033a9903.tmp" /SL5="$A0154,506086,422400,C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu135c06033a9903.exe"
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1484
      • C:\Users\Admin\AppData\Local\Temp\7zSC021EBD5\Thu135c06033a9903.exe
        Thu135c06033a9903.exe
        1⤵
        • Executes dropped EXE
        • Loads dropped DLL
        PID:1496

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • memory/672-256-0x0000000000400000-0x00000000004A4000-memory.dmp

              Filesize

              656KB

            • memory/672-252-0x0000000000240000-0x0000000000249000-memory.dmp

              Filesize

              36KB

            • memory/672-195-0x0000000000630000-0x0000000000639000-memory.dmp

              Filesize

              36KB

            • memory/856-210-0x00000000004D0000-0x0000000000518000-memory.dmp

              Filesize

              288KB

            • memory/856-211-0x0000000000400000-0x00000000004C4000-memory.dmp

              Filesize

              784KB

            • memory/856-54-0x0000000075891000-0x0000000075893000-memory.dmp

              Filesize

              8KB

            • memory/856-192-0x00000000002A0000-0x00000000002C9000-memory.dmp

              Filesize

              164KB

            • memory/900-224-0x0000000000180000-0x0000000000186000-memory.dmp

              Filesize

              24KB

            • memory/900-221-0x00000000000B0000-0x00000000000E2000-memory.dmp

              Filesize

              200KB

            • memory/900-234-0x000000001A7C0000-0x000000001A7C2000-memory.dmp

              Filesize

              8KB

            • memory/900-220-0x00000000000B0000-0x00000000000E2000-memory.dmp

              Filesize

              200KB

            • memory/1164-217-0x0000000000B20000-0x0000000001182000-memory.dmp

              Filesize

              6.4MB

            • memory/1164-216-0x0000000000B20000-0x0000000001182000-memory.dmp

              Filesize

              6.4MB

            • memory/1164-240-0x00000000057B0000-0x00000000057B1000-memory.dmp

              Filesize

              4KB

            • memory/1168-235-0x0000000000570000-0x0000000000571000-memory.dmp

              Filesize

              4KB

            • memory/1416-262-0x0000000003A00000-0x0000000003A15000-memory.dmp

              Filesize

              84KB

            • memory/1484-219-0x00000000006C0000-0x00000000006C1000-memory.dmp

              Filesize

              4KB

            • memory/1488-86-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/1488-114-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/1488-122-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/1488-83-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/1488-89-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/1488-88-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/1488-119-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/1488-142-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/1488-84-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/1488-99-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/1488-136-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/1488-87-0x000000006FE40000-0x000000006FFC6000-memory.dmp

              Filesize

              1.5MB

            • memory/1488-90-0x000000006B280000-0x000000006B2A6000-memory.dmp

              Filesize

              152KB

            • memory/1488-107-0x0000000064940000-0x0000000064959000-memory.dmp

              Filesize

              100KB

            • memory/1488-85-0x000000006B440000-0x000000006B4CF000-memory.dmp

              Filesize

              572KB

            • memory/1496-184-0x0000000000400000-0x000000000046D000-memory.dmp

              Filesize

              436KB

            • memory/1568-213-0x0000000000860000-0x0000000000861000-memory.dmp

              Filesize

              4KB

            • memory/1568-200-0x0000000000A00000-0x0000000000A76000-memory.dmp

              Filesize

              472KB

            • memory/1568-202-0x0000000000A00000-0x0000000000A76000-memory.dmp

              Filesize

              472KB

            • memory/1604-222-0x0000000002160000-0x0000000002DAA000-memory.dmp

              Filesize

              12.3MB

            • memory/1604-207-0x0000000002160000-0x0000000002DAA000-memory.dmp

              Filesize

              12.3MB

            • memory/1604-218-0x0000000002160000-0x0000000002DAA000-memory.dmp

              Filesize

              12.3MB

            • memory/1732-263-0x0000000004100000-0x000000000424E000-memory.dmp

              Filesize

              1.3MB

            • memory/1752-223-0x000000001B1B0000-0x000000001B1B2000-memory.dmp

              Filesize

              8KB

            • memory/1752-209-0x00000000001F0000-0x00000000001F8000-memory.dmp

              Filesize

              32KB

            • memory/1752-208-0x00000000001F0000-0x00000000001F8000-memory.dmp

              Filesize

              32KB

            • memory/1800-251-0x0000000001F80000-0x0000000002054000-memory.dmp

              Filesize

              848KB

            • memory/1800-206-0x0000000000300000-0x000000000037B000-memory.dmp

              Filesize

              492KB

            • memory/1800-255-0x0000000000400000-0x0000000000517000-memory.dmp

              Filesize

              1.1MB

            • memory/1984-201-0x0000000000310000-0x0000000000384000-memory.dmp

              Filesize

              464KB

            • memory/1984-212-0x00000000003C0000-0x00000000003C1000-memory.dmp

              Filesize

              4KB

            • memory/1984-203-0x0000000000310000-0x0000000000384000-memory.dmp

              Filesize

              464KB

            • memory/2072-233-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2072-227-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2072-225-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2072-226-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2072-241-0x0000000004CC0000-0x0000000004CC1000-memory.dmp

              Filesize

              4KB

            • memory/2072-228-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2072-229-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2072-232-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2196-250-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2196-243-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2196-253-0x0000000004BF0000-0x0000000004BF1000-memory.dmp

              Filesize

              4KB

            • memory/2196-246-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2196-245-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2196-249-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2196-244-0x0000000000400000-0x0000000000422000-memory.dmp

              Filesize

              136KB

            • memory/2460-258-0x0000000000370000-0x0000000000371000-memory.dmp

              Filesize

              4KB

            • memory/2712-261-0x0000000000A00000-0x0000000000B17000-memory.dmp

              Filesize

              1.1MB