redline | fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a

General

Target

fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
Size

277KB
MD5

f621d1c2ce52b6cf1c9690879175f4b0
SHA1

e8c26bd0727b1b8d2441e149932bfb6502c8b243
SHA256

fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a
SHA512

c2c2cf1082aa9cd65f818c580c88a9930fecc8c93ec8fc9f13f59eee05cc7bc8a4a6bb9e6c45c1c18d0e538b2a064909b2fb3e0b727f84a00263abecd459d989

Score

10^/10

redline smokeloader 4 backdoor infostealer spyware trojan

Malware Config

Extracted

Family

smokeloader

Version

2020

C2

http://monsutiur4.com/

http://nusurionuy5ff.at/

http://moroitomo4.net/

http://susuerulianita1.net/

http://cucumbetuturel4.com/

http://nunuslushau.com/

http://linislominyt11.at/

http://luxulixionus.net/

http://lilisjjoer44.com/

http://nikogminut88.at/

http://limo00ruling.org/

http://mini55tunul.com/

http://samnutu11nuli.com/

http://nikogkojam.org/

rc4.i32

Extracted

Family

redline

Botnet

4

C2

45.10.43.167:26696

Attributes

auth_value
907b4009a916888062785688f81bc6b3

Signatures

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4616-147-0x0000000000400000-0x0000000000420000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Executes dropped EXE 1 IoCs

Processes:

88E7.exe

pid process

116 88E7.exe
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.

Query Registry
T1012

System Information Discovery
T1082

Processes:

88E7.exe

description ioc process

Key value queried \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation 88E7.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

88E7.exe

description pid process target process

PID 116 set thread context of 4616 116 88E7.exe InstallUtil.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082
Program crash 1 IoCs

Processes:

WerFault.exe

pid pid_target process target process

3128 4316 WerFault.exe explorer.exe

pid	process
116	88E7.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\Control Panel\International\Geo\Nation	88E7.exe

description	pid	process	target process
PID 116 set thread context of 4616	116	88E7.exe	InstallUtil.exe

pid	pid_target	process	target process
3128	4316	WerFault.exe	explorer.exe

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe

description	ioc	process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe

Delays execution with timeout.exe 1 IoCs
evasion

Processes:

timeout.exe

pid process

1700 timeout.exe

pid	process
1700	timeout.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe

pid	process
3428	fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
3428	fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812
2812

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

2812
Suspicious behavior: MapViewOfSection 5 IoCs

Processes:

fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe

pid process

3428 fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
2812
2812
2812
2812

pid	process
2812

Suspicious use of AdjustPrivilegeToken 12 IoCs

Processes:

88E7.exeInstallUtil.exe

description	pid	process
Token: SeShutdownPrivilege	2812
Token: SeCreatePagefilePrivilege	2812
Token: SeShutdownPrivilege	2812
Token: SeCreatePagefilePrivilege	2812
Token: SeDebugPrivilege	116	88E7.exe
Token: SeDebugPrivilege	4616	InstallUtil.exe
Token: SeShutdownPrivilege	2812
Token: SeCreatePagefilePrivilege	2812
Token: SeShutdownPrivilege	2812
Token: SeCreatePagefilePrivilege	2812
Token: SeShutdownPrivilege	2812
Token: SeCreatePagefilePrivilege	2812

Suspicious use of WriteProcessMemory 27 IoCs

Processes:

88E7.execmd.exe

description	pid	process	target process
PID 2812 wrote to memory of 116	2812		88E7.exe
PID 2812 wrote to memory of 116	2812		88E7.exe
PID 2812 wrote to memory of 116	2812		88E7.exe
PID 2812 wrote to memory of 4316	2812		explorer.exe
PID 2812 wrote to memory of 4316	2812		explorer.exe
PID 2812 wrote to memory of 4316	2812		explorer.exe
PID 2812 wrote to memory of 4316	2812		explorer.exe
PID 2812 wrote to memory of 3796	2812		explorer.exe
PID 2812 wrote to memory of 3796	2812		explorer.exe
PID 2812 wrote to memory of 3796	2812		explorer.exe
PID 116 wrote to memory of 3724	116	88E7.exe	cmd.exe
PID 116 wrote to memory of 3724	116	88E7.exe	cmd.exe
PID 116 wrote to memory of 3724	116	88E7.exe	cmd.exe
PID 3724 wrote to memory of 1700	3724	cmd.exe	timeout.exe
PID 3724 wrote to memory of 1700	3724	cmd.exe	timeout.exe
PID 3724 wrote to memory of 1700	3724	cmd.exe	timeout.exe
PID 116 wrote to memory of 4344	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4344	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4344	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe
PID 116 wrote to memory of 4616	116	88E7.exe	InstallUtil.exe

C:\Users\Admin\AppData\Local\Temp\fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe
"C:\Users\Admin\AppData\Local\Temp\fa1cc1b57c6c91515e935c781413376ce550b65eefb22036fc40b70eab60585a.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:3428

C:\Users\Admin\AppData\Local\Temp\88E7.exe
C:\Users\Admin\AppData\Local\Temp\88E7.exe
1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:116

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\System32\cmd.exe" /c timeout 10
2⤵
- Suspicious use of WriteProcessMemory
PID:3724

C:\Windows\SysWOW64\timeout.exe
timeout 10
3⤵
- Delays execution with timeout.exe
PID:1700

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
PID:4344

C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:4616

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4316

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -u -p 4316 -s 880
2⤵
- Program crash
PID:3128

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 4316 -ip 4316
1⤵
PID:1044

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:3796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

2

T1012

System Information Discovery

3

T1082

Peripheral Device Discovery

1

T1120

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\88E7.exe
Filesize
342KB

MD5
5081f141de74d785dacfe8254097d29f

SHA1
bd8f230e9c79d66718871c0b2a770988e021aa21

SHA256
dac6ad2b96313e9fed6a84abc829204b40effc0f89fc602889377b589c28fe4a

SHA512
09d507af2faece517c5bdc69ab37d468a9cc9dc177e3737d4e31beffcb38037827c1d3f95a7de5321c914a85e69e1b4fb1c9f5d93ef08457bef57109cca0b6dc

Download Submit
C:\Users\Admin\AppData\Local\Temp\88E7.exe
Filesize
342KB

MD5
5081f141de74d785dacfe8254097d29f

SHA1
bd8f230e9c79d66718871c0b2a770988e021aa21

SHA256
dac6ad2b96313e9fed6a84abc829204b40effc0f89fc602889377b589c28fe4a

SHA512
09d507af2faece517c5bdc69ab37d468a9cc9dc177e3737d4e31beffcb38037827c1d3f95a7de5321c914a85e69e1b4fb1c9f5d93ef08457bef57109cca0b6dc

Download Submit
memory/116-142-0x00000000057F0000-0x0000000005856000-memory.dmp

Filesize
408KB

Download
memory/116-144-0x000000002A0E0000-0x000000002A684000-memory.dmp

Filesize
5.6MB

Download
memory/116-134-0x0000000000000000-mapping.dmp

Download
memory/116-143-0x0000000029A90000-0x0000000029B22000-memory.dmp

Filesize
584KB

Download
memory/116-137-0x0000000000D30000-0x0000000000D8C000-memory.dmp

Filesize
368KB

Download
memory/1700-141-0x0000000000000000-mapping.dmp

Download
memory/2812-133-0x0000000000CF0000-0x0000000000D06000-memory.dmp

Filesize
88KB

Download
memory/3428-130-0x0000000000832000-0x0000000000842000-memory.dmp

Filesize
64KB

Download
memory/3428-132-0x0000000000400000-0x000000000048A000-memory.dmp

Filesize
552KB

Download
memory/3428-131-0x00000000001F0000-0x00000000001F9000-memory.dmp

Filesize
36KB

Download
memory/3724-140-0x0000000000000000-mapping.dmp

Download
memory/3796-139-0x0000000000000000-mapping.dmp

Download
memory/4316-138-0x0000000000000000-mapping.dmp

Download
memory/4344-145-0x0000000000000000-mapping.dmp

Download
memory/4616-146-0x0000000000000000-mapping.dmp

Download
memory/4616-147-0x0000000000400000-0x0000000000420000-memory.dmp

Filesize
128KB

Download
memory/4616-148-0x0000000005300000-0x0000000005918000-memory.dmp

Filesize
6.1MB

Download
memory/4616-149-0x0000000004DA0000-0x0000000004DB2000-memory.dmp

Filesize
72KB

Download
memory/4616-150-0x0000000004ED0000-0x0000000004FDA000-memory.dmp

Filesize
1.0MB

Download
memory/4616-151-0x0000000004E30000-0x0000000004E6C000-memory.dmp

Filesize
240KB

Download
memory/4616-152-0x0000000005CA0000-0x0000000005D16000-memory.dmp

Filesize
472KB

Download
memory/4616-153-0x0000000005FA0000-0x0000000005FBE000-memory.dmp

Filesize
120KB

Download
memory/4616-154-0x0000000006190000-0x00000000061E0000-memory.dmp

Filesize
320KB

Download
memory/4616-155-0x0000000007660000-0x0000000007822000-memory.dmp

Filesize
1.8MB

Download
memory/4616-156-0x0000000007D60000-0x000000000828C000-memory.dmp

Filesize
5.2MB

Download

Analysis

Sharing

General

Malware Config

Extracted

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads