redline | ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57

Analysis

max time kernel
150s
max time network
103s
platform
windows10_x64
resource
win10-20220414-en
submitted
25-05-2022 07:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
Size

276KB
MD5

7d71c8b28985dfcb90bef0ad353d1adb
SHA1

3d50a46bb1b223f424ae94d35c8128c8ea110709
SHA256

ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57
SHA512

04cbbec1f671b9aec21ddee81b422d877d88e6a1b8ef5f34a99f6d60956dcd430defb982526caf153b8e91d3fdc3edaf923311f8ac7f129aac70e6883ff83122

Score

10^/10

redline smokeloader 4 backdoor collection infostealer spyware trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

rc4.i32

Extracted

Family

redline

Botnet

45.10.43.167:26696

Attributes

auth_value
907b4009a916888062785688f81bc6b3

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/3992-335-0x000000000041AD9E-mapping.dmp	family_redline
behavioral1/memory/3992-368-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 1 IoCs

Processes:

4045.exe

pid process

4244 4045.exe
Deletes itself 1 IoCs

Processes:

pid process

2836

pid	process
4244	4045.exe

pid	process
2836

Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs

collection

Email Collection

T1114

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Office\15.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe
Key opened	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

4045.exe

description pid process target process

PID 4244 set thread context of 3992 4244 4045.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

description	pid	process	target process
PID 4244 set thread context of 3992	4244	4045.exe	InstallUtil.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

3976 timeout.exe

pid	process
3976	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe

pid	process
2504	ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
2504	ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836
2836

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2836
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe

pid process

2504 ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
2836
2836
2836
2836

pid	process
2836

Suspicious use of AdjustPrivilegeToken 10 IoCs

Processes:

4045.exeInstallUtil.exe

description	pid	process
Token: SeShutdownPrivilege	2836
Token: SeCreatePagefilePrivilege	2836
Token: SeDebugPrivilege	4244	4045.exe
Token: SeDebugPrivilege	3992	InstallUtil.exe
Token: SeShutdownPrivilege	2836
Token: SeCreatePagefilePrivilege	2836
Token: SeShutdownPrivilege	2836
Token: SeCreatePagefilePrivilege	2836
Token: SeShutdownPrivilege	2836
Token: SeCreatePagefilePrivilege	2836

Suspicious use of WriteProcessMemory 24 IoCs

Processes:

4045.execmd.exe

description	pid	process	target process
PID 2836 wrote to memory of 4244	2836		4045.exe
PID 2836 wrote to memory of 4244	2836		4045.exe
PID 2836 wrote to memory of 4244	2836		4045.exe
PID 2836 wrote to memory of 2160	2836		explorer.exe
PID 2836 wrote to memory of 2160	2836		explorer.exe
PID 2836 wrote to memory of 2160	2836		explorer.exe
PID 2836 wrote to memory of 2160	2836		explorer.exe
PID 2836 wrote to memory of 4944	2836		explorer.exe
PID 2836 wrote to memory of 4944	2836		explorer.exe
PID 2836 wrote to memory of 4944	2836		explorer.exe
PID 4244 wrote to memory of 4724	4244	4045.exe	cmd.exe
PID 4244 wrote to memory of 4724	4244	4045.exe	cmd.exe
PID 4244 wrote to memory of 4724	4244	4045.exe	cmd.exe
PID 4724 wrote to memory of 3976	4724	cmd.exe	timeout.exe
PID 4724 wrote to memory of 3976	4724	cmd.exe	timeout.exe
PID 4724 wrote to memory of 3976	4724	cmd.exe	timeout.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe
PID 4244 wrote to memory of 3992	4244	4045.exe	InstallUtil.exe

outlook_office_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Office\16.0\Outlook\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

outlook_win_path 1 IoCs

Processes:

explorer.exe

description	ioc	process
Key opened	\REGISTRY\USER\S-1-5-21-1804997378-2045782378-3882459628-1000\Software\Microsoft\Windows NT\CurrentVersion\Windows Messaging Subsystem\Profiles\Outlook\9375CFF0413111d3B88A00104B2A6676	explorer.exe

C:\Users\Admin\AppData\Local\Temp\ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe
"C:\Users\Admin\AppData\Local\Temp\ac835e36c30f67f3f5eb04810ec4742bb186c425faf04588d85a4daa9d115d57.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2504

C:\Users\Admin\AppData\Local\Temp\4045.exe
C:\Users\Admin\AppData\Local\Temp\4045.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4244

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 10
2⤵
- Suspicious use of WriteProcessMemory
PID:4724

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:3976

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
- Accesses Microsoft Outlook profiles
- outlook_office_path
- outlook_win_path
PID:2160

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:4944

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

T1081

Discovery

System Information Discovery

T1082

Query Registry

T1012

Peripheral Device Discovery

T1120

Lateral Movement

Collection

Email Collection

T1114

Data from Local System

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4045.exe
Filesize
342KB

MD5
5081f141de74d785dacfe8254097d29f

SHA1
bd8f230e9c79d66718871c0b2a770988e021aa21

SHA256
dac6ad2b96313e9fed6a84abc829204b40effc0f89fc602889377b589c28fe4a

SHA512
09d507af2faece517c5bdc69ab37d468a9cc9dc177e3737d4e31beffcb38037827c1d3f95a7de5321c914a85e69e1b4fb1c9f5d93ef08457bef57109cca0b6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\4045.exe
Filesize
342KB

MD5
5081f141de74d785dacfe8254097d29f

SHA1
bd8f230e9c79d66718871c0b2a770988e021aa21

SHA256
dac6ad2b96313e9fed6a84abc829204b40effc0f89fc602889377b589c28fe4a

SHA512
09d507af2faece517c5bdc69ab37d468a9cc9dc177e3737d4e31beffcb38037827c1d3f95a7de5321c914a85e69e1b4fb1c9f5d93ef08457bef57109cca0b6dc

Download Submit
memory/2160-189-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-184-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-173-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-185-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-187-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-175-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-177-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-188-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-186-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-171-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-183-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-182-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-181-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-179-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-162-0x0000000000000000-mapping.dmp

Download
memory/2160-169-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2160-165-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-147-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-151-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-134-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-135-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-136-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-138-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-137-0x0000000000741000-0x0000000000751000-memory.dmp

Filesize
64KB

Download
memory/2504-139-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-141-0x0000000000490000-0x000000000053E000-memory.dmp

Filesize
696KB

Download
memory/2504-140-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-143-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/2504-144-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-142-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-145-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-146-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-132-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-148-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-149-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-150-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-128-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-152-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-153-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-129-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-118-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-119-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-133-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-120-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-131-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-121-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-122-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-123-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-124-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-125-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-126-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-130-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2504-127-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/2836-154-0x0000000001230000-0x0000000001246000-memory.dmp

Filesize
88KB

Download
memory/3976-300-0x0000000000000000-mapping.dmp

Download
memory/3992-413-0x0000000006140000-0x0000000006190000-memory.dmp

Filesize
320KB

Download
memory/3992-335-0x000000000041AD9E-mapping.dmp

Download
memory/3992-368-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/3992-389-0x0000000005330000-0x0000000005936000-memory.dmp

Filesize
6.0MB

Download
memory/3992-390-0x0000000004D90000-0x0000000004DA2000-memory.dmp

Filesize
72KB

Download
memory/3992-391-0x0000000004EC0000-0x0000000004FCA000-memory.dmp

Filesize
1.0MB

Download
memory/3992-394-0x0000000004DF0000-0x0000000004E2E000-memory.dmp

Filesize
248KB

Download
memory/3992-396-0x0000000004E30000-0x0000000004E7B000-memory.dmp

Filesize
300KB

Download
memory/3992-408-0x0000000005CC0000-0x0000000005D36000-memory.dmp

Filesize
472KB

Download
memory/3992-412-0x0000000005F80000-0x0000000005F9E000-memory.dmp

Filesize
120KB

Download
memory/3992-414-0x0000000006B50000-0x0000000006D12000-memory.dmp

Filesize
1.8MB

Download
memory/3992-415-0x0000000007250000-0x000000000777C000-memory.dmp

Filesize
5.2MB

Download
memory/4244-160-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-174-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-180-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-155-0x0000000000000000-mapping.dmp

Download
memory/4244-229-0x0000000000870000-0x00000000008CC000-memory.dmp

Filesize
368KB

Download
memory/4244-247-0x0000000002C00000-0x0000000002C52000-memory.dmp

Filesize
328KB

Download
memory/4244-276-0x0000000005190000-0x00000000051E4000-memory.dmp

Filesize
336KB

Download
memory/4244-277-0x0000000005300000-0x000000000534C000-memory.dmp

Filesize
304KB

Download
memory/4244-157-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-176-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-324-0x0000000005270000-0x00000000052D6000-memory.dmp

Filesize
408KB

Download
memory/4244-332-0x0000000027020000-0x00000000270B2000-memory.dmp

Filesize
584KB

Download
memory/4244-333-0x00000000275C0000-0x0000000027ABE000-memory.dmp

Filesize
5.0MB

Download
memory/4244-178-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-163-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-170-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-172-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-168-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-166-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-164-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-161-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-159-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4244-158-0x0000000077310000-0x000000007749E000-memory.dmp

Filesize
1.6MB

Download
memory/4724-294-0x0000000000000000-mapping.dmp

Download
memory/4944-191-0x0000000000000000-mapping.dmp

Download