Analysis

  • max time kernel
    150s
  • max time network
    78s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    21-05-2022 18:00

General

  • Target

    99ac8830cf0cfa346258985fd46425e15b542ce66d2f458aa3446c400e837732.exe

  • Size

    304KB

  • MD5

    803b74841a7277e9f8c4d1db8dbf9de9

  • SHA1

    f2b68c8f82aab5bf9133331e313256e14e8bdc6d

  • SHA256

    99ac8830cf0cfa346258985fd46425e15b542ce66d2f458aa3446c400e837732

  • SHA512

    ed3794322b32f9767ef18d5a7040a792c10e987eca60456ecd808453461cf035ec047e205af2fc2434c3989998c7cc5192bea27fbdd9b04d19f60edf2c885663

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

1

C2

45.10.43.167:26696

Attributes
  • auth_value

    3a70a3e2f548aaf61e05be9e4cadc7c1

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Executes dropped EXE 6 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Deletes itself 1 IoCs
  • Loads dropped DLL 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 5 IoCs
  • Suspicious use of AdjustPrivilegeToken 27 IoCs
  • Suspicious use of WriteProcessMemory 27 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs
  • outlook_office_path 1 IoCs
  • outlook_win_path 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\99ac8830cf0cfa346258985fd46425e15b542ce66d2f458aa3446c400e837732.exe
    "C:\Users\Admin\AppData\Local\Temp\99ac8830cf0cfa346258985fd46425e15b542ce66d2f458aa3446c400e837732.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:3876
  • C:\Users\Admin\AppData\Local\Temp\2E53.exe
    C:\Users\Admin\AppData\Local\Temp\2E53.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3500
      • C:\Windows\system32\mode.com
        mode 65,10
        3⤵
          PID:1304
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e file.zip -p283462270827100258722140325330 -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3308
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_3.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3668
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_2.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:3304
        • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
          7z.exe e extracted/file_1.zip -oextracted
          3⤵
          • Executes dropped EXE
          • Loads dropped DLL
          • Suspicious use of AdjustPrivilegeToken
          PID:1932
        • C:\Windows\system32\attrib.exe
          attrib +H "benbenben.exe"
          3⤵
          • Views/modifies file attributes
          PID:1620
        • C:\Users\Admin\AppData\Local\Temp\main\benbenben.exe
          "benbenben.exe"
          3⤵
          • Executes dropped EXE
          • Checks BIOS information in registry
          • Checks whether UAC is enabled
          • Suspicious use of AdjustPrivilegeToken
          PID:1364
    • C:\Windows\SysWOW64\explorer.exe
      C:\Windows\SysWOW64\explorer.exe
      1⤵
      • Accesses Microsoft Outlook profiles
      • outlook_office_path
      • outlook_win_path
      PID:4064
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:2752

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Persistence

      Hidden Files and Directories

      1
      T1158

      Defense Evasion

      Virtualization/Sandbox Evasion

      1
      T1497

      Hidden Files and Directories

      1
      T1158

      Credential Access

      Credentials in Files

      2
      T1081

      Discovery

      Query Registry

      4
      T1012

      Virtualization/Sandbox Evasion

      1
      T1497

      System Information Discovery

      4
      T1082

      Peripheral Device Discovery

      1
      T1120

      Collection

      Data from Local System

      2
      T1005

      Email Collection

      1
      T1114

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Temp\2E53.exe
        Filesize

        3.9MB

        MD5

        4f8a7c030aa8784e5f9726de742be5b5

        SHA1

        b458828a0383defa2b1c79dc043d7e7e8cc712c4

        SHA256

        b8885e1a627026d5ebbce5dfc321358a1d339e0b30c887ab39e4b9e972f90952

        SHA512

        0c74b22a46d6362fc8e5a9d919c8d32f6a2e21e9c3bdbfb0be679407a753f8995cc929956c7bd0351e6f4b8e224ea7fa4ebdc9b8d07c324608ffa2e20b4b8d69

      • C:\Users\Admin\AppData\Local\Temp\2E53.exe
        Filesize

        3.9MB

        MD5

        4f8a7c030aa8784e5f9726de742be5b5

        SHA1

        b458828a0383defa2b1c79dc043d7e7e8cc712c4

        SHA256

        b8885e1a627026d5ebbce5dfc321358a1d339e0b30c887ab39e4b9e972f90952

        SHA512

        0c74b22a46d6362fc8e5a9d919c8d32f6a2e21e9c3bdbfb0be679407a753f8995cc929956c7bd0351e6f4b8e224ea7fa4ebdc9b8d07c324608ffa2e20b4b8d69

      • C:\Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
        Filesize

        458KB

        MD5

        619f7135621b50fd1900ff24aade1524

        SHA1

        6c7ea8bbd435163ae3945cbef30ef6b9872a4591

        SHA256

        344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

        SHA512

        2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

      • C:\Users\Admin\AppData\Local\Temp\main\benbenben.exe
        Filesize

        1.5MB

        MD5

        4c76c4bb8969621583baa58bf9c625f4

        SHA1

        46fcb2f437241d330144ae3b9ec2980f9b12c209

        SHA256

        e78a454a7fcf939c27d8beec97b8b77f851df342e2682143c9d2dc66fcab4340

        SHA512

        5c52696822d339b0c9f53de3db0fabdf8c7158b6d00b42c59f78694b282243cf6f92066203c60cfcbf363b3684eba3ff10bdcd851557c05a46bfa38d0c856e0c

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT
        Filesize

        2.0MB

        MD5

        8f6c27385ab490689ddcc61866824ce8

        SHA1

        5b1874737e5cd1b1c52b7b8e10714d2c6e87d96d

        SHA256

        d47d174fa9feac7cd178bd9a62d0f9183651c043f6f3c8d15bb7197fc1fc042f

        SHA512

        046371e4c93c89ea54fceacd9b5f69e842f84debc00e668509d4b853e53621395cb4ac713093ff81368f9ad717f4621565a906a999d8dbfa3c0fad0278909c1f

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\benbenben.exe
        Filesize

        1.5MB

        MD5

        4c76c4bb8969621583baa58bf9c625f4

        SHA1

        46fcb2f437241d330144ae3b9ec2980f9b12c209

        SHA256

        e78a454a7fcf939c27d8beec97b8b77f851df342e2682143c9d2dc66fcab4340

        SHA512

        5c52696822d339b0c9f53de3db0fabdf8c7158b6d00b42c59f78694b282243cf6f92066203c60cfcbf363b3684eba3ff10bdcd851557c05a46bfa38d0c856e0c

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip
        Filesize

        1.5MB

        MD5

        a73635e84d7ab318619454487514f446

        SHA1

        b492af29c93240c3479e69907f1ed74dec625ba6

        SHA256

        ed19a2d5f65d95969d697f205d3fa91688c6daac6274ac7e4847789c9b3a4061

        SHA512

        e8a0b92b3da67a60db0a9c65d7eb0bcd88d97ab1e72510eb602c1e0385b776c7834d08ff8618b805f805e457b21265884d71bdf9fafe6ca3da583ccd162b9f06

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip
        Filesize

        1.5MB

        MD5

        620139174d311818701c05cbc8968c59

        SHA1

        7a427bf6653da862963e42c4f4a5a1ebd08ec061

        SHA256

        df5e8ab12f09d0dc41e2a7c7e5043d6477a7dc6d9a4bbae0943bbbbcfbdc6b2a

        SHA512

        21ebcfde72f38cc7d5feafe9168cb37e8b62c6fbf6a8c046fcba9cc9b6f079f5d4cc7dbf2b9d42e48fc4ff2909439a8cbff22c872b8453a944d0ad552792c37e

      • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_3.zip
        Filesize

        3.0MB

        MD5

        1a18731f1f1b9e3746a31b9bf7d6b901

        SHA1

        48cd2531251dff411b084dbb88c7fe6a73c437f8

        SHA256

        149b8af8eb2eba7d584bbc72083fd26b0cbc678f75739fce532bd80cc6548cd7

        SHA512

        4d298d564e4791f9404edafacd4d8ff2b70fb93152ca4e33a48fdd07f25c5d3b0bf616b4fe1cceb0a911093fb0ca47052a3529f115825729641b3dec1c82fafa

      • C:\Users\Admin\AppData\Local\Temp\main\file.bin
        Filesize

        3.0MB

        MD5

        03bd09b1b43203b5847bd65a390c7fe9

        SHA1

        15599a412e9d6934eaf35da04488a997ce88638f

        SHA256

        11317bad4a6346566fec9f2cefcf1d0e97a074be1f85d2f25bebf4bbc532bd9a

        SHA512

        058a97e75feb690afc35939017017b6d86725ab901c0a52473e6bb201ac38bbc20e052762f49567ba7f6cd4ea23c0dc94f42aaaae7b80644438f3e4ab0ed3118

      • C:\Users\Admin\AppData\Local\Temp\main\main.bat
        Filesize

        476B

        MD5

        21b6341d2b4fc3c54bca293b71545d0c

        SHA1

        ba66216cd3552de6b3ad254f65ccb834188347b0

        SHA256

        432347ce4e632e70cc0cb988ed72c43a17b81f8955a3905e43a93708029a0daf

        SHA512

        04842ab2240d782fe7f3336f4776576f67f3a30ae522713b2bfb8e5c86ca30a2706f2c73ede5647495b8cde06ad36b6499bf8bd9c8908e794fdbdb8bd0d534d1

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • \Users\Admin\AppData\Local\Temp\main\7z.dll
        Filesize

        1.6MB

        MD5

        72491c7b87a7c2dd350b727444f13bb4

        SHA1

        1e9338d56db7ded386878eab7bb44b8934ab1bc7

        SHA256

        34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

        SHA512

        583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

      • memory/432-120-0x0000000000000000-mapping.dmp
      • memory/1304-127-0x0000000000000000-mapping.dmp
      • memory/1364-162-0x00000000063F0000-0x0000000006456000-memory.dmp
        Filesize

        408KB

      • memory/1364-153-0x00000000059F0000-0x0000000005FF6000-memory.dmp
        Filesize

        6.0MB

      • memory/1364-157-0x0000000005540000-0x000000000558B000-memory.dmp
        Filesize

        300KB

      • memory/1364-156-0x0000000005500000-0x000000000553E000-memory.dmp
        Filesize

        248KB

      • memory/1364-161-0x0000000006200000-0x000000000621E000-memory.dmp
        Filesize

        120KB

      • memory/1364-164-0x0000000008E30000-0x000000000935C000-memory.dmp
        Filesize

        5.2MB

      • memory/1364-160-0x0000000006500000-0x00000000069FE000-memory.dmp
        Filesize

        5.0MB

      • memory/1364-165-0x00000000070C0000-0x0000000007110000-memory.dmp
        Filesize

        320KB

      • memory/1364-159-0x0000000005950000-0x00000000059E2000-memory.dmp
        Filesize

        584KB

      • memory/1364-155-0x00000000055B0000-0x00000000056BA000-memory.dmp
        Filesize

        1.0MB

      • memory/1364-148-0x0000000000000000-mapping.dmp
      • memory/1364-158-0x0000000005830000-0x00000000058A6000-memory.dmp
        Filesize

        472KB

      • memory/1364-152-0x0000000001340000-0x0000000001862000-memory.dmp
        Filesize

        5.1MB

      • memory/1364-163-0x00000000071A0000-0x0000000007362000-memory.dmp
        Filesize

        1.8MB

      • memory/1364-154-0x0000000005480000-0x0000000005492000-memory.dmp
        Filesize

        72KB

      • memory/1620-147-0x0000000000000000-mapping.dmp
      • memory/1932-141-0x0000000000000000-mapping.dmp
      • memory/2752-124-0x0000000000000000-mapping.dmp
      • memory/3064-119-0x0000000001110000-0x0000000001126000-memory.dmp
        Filesize

        88KB

      • memory/3304-137-0x0000000000000000-mapping.dmp
      • memory/3308-129-0x0000000000000000-mapping.dmp
      • memory/3500-125-0x0000000000000000-mapping.dmp
      • memory/3668-133-0x0000000000000000-mapping.dmp
      • memory/3876-118-0x0000000000400000-0x000000000048D000-memory.dmp
        Filesize

        564KB

      • memory/3876-117-0x00000000005B0000-0x00000000006FA000-memory.dmp
        Filesize

        1.3MB

      • memory/4064-123-0x0000000000000000-mapping.dmp