redline | 2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6

General

Target

2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
Size

273KB
MD5

7743757c264cb5f69b6d44e78420298b
SHA1

26abfaeffce65842da7c60191d104f185b437193
SHA256

2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6
SHA512

2db9ee5f2d93398926a7f7ba8a3884679913a88d6793fe4e669b5260f44176b31794e48a76766997ca9b910a5561cf28bf3d6f7008719d0e2cc9012b15e63871
SSDEEP

6144:z8jLVJSj0p4zi0iD320ARRW5migavwVfl:z8jLVkj0p4+bHARRW57i

Score

10^/10

redline smokeloader logsdiller cloud (sup: @mr_golds)backdoor infostealer spyware trojan

Malware Config

Extracted

Family

redline

Botnet

LogsDiller Cloud (Sup: @mr_golds)

C2

77.73.134.27:8163

Attributes

auth_value
56c6f7b9024c076f0a96931453da7e56

Signatures

Detects Smokeloader packer 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/4588-133-0x00000000005E0000-0x00000000005E9000-memory.dmp	family_smokeloader
behavioral1/memory/4580-177-0x0000000000390000-0x0000000000397000-memory.dmp	family_smokeloader

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine payload 2 IoCs

Processes:

resource	yara_rule
behavioral1/memory/102316-154-0x0000000000400000-0x0000000000428000-memory.dmp	family_redline
behavioral1/memory/102368-163-0x0000000000A70000-0x0000000000A92000-memory.dmp	family_redline

SmokeLoader
Modular backdoor trojan in use since 2014.
trojan backdoor smokeloader
Downloads MZ/PE file
Executes dropped EXE 2 IoCs

Processes:

sjthuug4C3B.exe

pid process

1940 sjthuug
868 4C3B.exe
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
spyware

Data from Local System
T1005

Credentials in Files
T1081
Suspicious use of SetThreadContext 1 IoCs

Processes:

4C3B.exe

description pid process target process

PID 868 set thread context of 102316 868 4C3B.exe AppLaunch.exe

pid	process
1940	sjthuug
868	4C3B.exe

description	pid	process	target process
PID 868 set thread context of 102316	868	4C3B.exe	AppLaunch.exe

Checks SCSI registry key(s) 3 TTPs 6 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

Processes:

2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exesjthuug

description	ioc	process
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sjthuug
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sjthuug
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sjthuug
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

Processes:

2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe

pid	process
4588	2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
4588	2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

Processes:

pid process

1076

pid	process
1076

Suspicious behavior: MapViewOfSection 20 IoCs

Processes:

2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exesjthuug

pid	process
4588	2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1076
1940	sjthuug

Suspicious use of AdjustPrivilegeToken 11 IoCs

Processes:

AppLaunch.exe

description	pid	process
Token: SeShutdownPrivilege	1076
Token: SeCreatePagefilePrivilege	1076
Token: SeShutdownPrivilege	1076
Token: SeCreatePagefilePrivilege	1076
Token: SeShutdownPrivilege	1076
Token: SeCreatePagefilePrivilege	1076
Token: SeShutdownPrivilege	1076
Token: SeCreatePagefilePrivilege	1076
Token: SeDebugPrivilege	102316	AppLaunch.exe
Token: SeShutdownPrivilege	1076
Token: SeCreatePagefilePrivilege	1076

Suspicious use of WriteProcessMemory 41 IoCs

Processes:

4C3B.exe

description	pid	process	target process
PID 1076 wrote to memory of 868	1076		4C3B.exe
PID 1076 wrote to memory of 868	1076		4C3B.exe
PID 1076 wrote to memory of 868	1076		4C3B.exe
PID 1076 wrote to memory of 4580	1076		explorer.exe
PID 1076 wrote to memory of 4580	1076		explorer.exe
PID 1076 wrote to memory of 4580	1076		explorer.exe
PID 1076 wrote to memory of 4580	1076		explorer.exe
PID 1076 wrote to memory of 24096	1076		explorer.exe
PID 1076 wrote to memory of 24096	1076		explorer.exe
PID 1076 wrote to memory of 24096	1076		explorer.exe
PID 1076 wrote to memory of 55552	1076		explorer.exe
PID 1076 wrote to memory of 55552	1076		explorer.exe
PID 1076 wrote to memory of 55552	1076		explorer.exe
PID 1076 wrote to memory of 55552	1076		explorer.exe
PID 1076 wrote to memory of 83012	1076		explorer.exe
PID 1076 wrote to memory of 83012	1076		explorer.exe
PID 1076 wrote to memory of 83012	1076		explorer.exe
PID 868 wrote to memory of 102316	868	4C3B.exe	AppLaunch.exe
PID 868 wrote to memory of 102316	868	4C3B.exe	AppLaunch.exe
PID 868 wrote to memory of 102316	868	4C3B.exe	AppLaunch.exe
PID 868 wrote to memory of 102316	868	4C3B.exe	AppLaunch.exe
PID 868 wrote to memory of 102316	868	4C3B.exe	AppLaunch.exe
PID 1076 wrote to memory of 102368	1076		explorer.exe
PID 1076 wrote to memory of 102368	1076		explorer.exe
PID 1076 wrote to memory of 102368	1076		explorer.exe
PID 1076 wrote to memory of 102368	1076		explorer.exe
PID 1076 wrote to memory of 102336	1076		explorer.exe
PID 1076 wrote to memory of 102336	1076		explorer.exe
PID 1076 wrote to memory of 102336	1076		explorer.exe
PID 1076 wrote to memory of 102336	1076		explorer.exe
PID 1076 wrote to memory of 1572	1076		explorer.exe
PID 1076 wrote to memory of 1572	1076		explorer.exe
PID 1076 wrote to memory of 1572	1076		explorer.exe
PID 1076 wrote to memory of 1572	1076		explorer.exe
PID 1076 wrote to memory of 2816	1076		explorer.exe
PID 1076 wrote to memory of 2816	1076		explorer.exe
PID 1076 wrote to memory of 2816	1076		explorer.exe
PID 1076 wrote to memory of 3656	1076		explorer.exe
PID 1076 wrote to memory of 3656	1076		explorer.exe
PID 1076 wrote to memory of 3656	1076		explorer.exe
PID 1076 wrote to memory of 3656	1076		explorer.exe

C:\Users\Admin\AppData\Local\Temp\2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe
"C:\Users\Admin\AppData\Local\Temp\2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6.exe"
1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4588

C:\Users\Admin\AppData\Roaming\sjthuug
C:\Users\Admin\AppData\Roaming\sjthuug
1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:1940

C:\Users\Admin\AppData\Local\Temp\4C3B.exe
C:\Users\Admin\AppData\Local\Temp\4C3B.exe
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:868

C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
2⤵
- Suspicious use of AdjustPrivilegeToken
PID:102316

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:4580

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:24096

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:55552

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:83012

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:102368

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:102336

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:1572

C:\Windows\explorer.exe
C:\Windows\explorer.exe
1⤵
PID:2816

C:\Windows\SysWOW64\explorer.exe
C:\Windows\SysWOW64\explorer.exe
1⤵
PID:3656

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Peripheral Device Discovery

1

T1120

System Information Discovery

1

T1082

Lateral Movement

Collection

Data from Local System

1

T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\4C3B.exe
Filesize
2.6MB

MD5
0b9978d5b7c98f448f01a37add0d1cab

SHA1
7faccb84b6e5f026ae2c9a57c85f44ae17ae8cfa

SHA256
dc2879d1ea852d721808045d04e9c98dca28623ace248eb2efdd84701255cd68

SHA512
e24b09ee83b9a4a36ca5594f1c12e9015b7f9eeb103de1a6bbe82ad5d453282fe834d5d5190886df7e8814bccd8dca7ec4009965717b6b57716f0907d8298b7e

Download Submit
C:\Users\Admin\AppData\Local\Temp\4C3B.exe
Filesize
2.6MB

MD5
0b9978d5b7c98f448f01a37add0d1cab

SHA1
7faccb84b6e5f026ae2c9a57c85f44ae17ae8cfa

SHA256
dc2879d1ea852d721808045d04e9c98dca28623ace248eb2efdd84701255cd68

SHA512
e24b09ee83b9a4a36ca5594f1c12e9015b7f9eeb103de1a6bbe82ad5d453282fe834d5d5190886df7e8814bccd8dca7ec4009965717b6b57716f0907d8298b7e

Download Submit
C:\Users\Admin\AppData\Roaming\sjthuug
Filesize
273KB

MD5
7743757c264cb5f69b6d44e78420298b

SHA1
26abfaeffce65842da7c60191d104f185b437193

SHA256
2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6

SHA512
2db9ee5f2d93398926a7f7ba8a3884679913a88d6793fe4e669b5260f44176b31794e48a76766997ca9b910a5561cf28bf3d6f7008719d0e2cc9012b15e63871

Download Submit
C:\Users\Admin\AppData\Roaming\sjthuug
Filesize
273KB

MD5
7743757c264cb5f69b6d44e78420298b

SHA1
26abfaeffce65842da7c60191d104f185b437193

SHA256
2ab82bd451838c0923cd04892c5567f9e60d6f72e3bc5286c2374e4cd7d712f6

SHA512
2db9ee5f2d93398926a7f7ba8a3884679913a88d6793fe4e669b5260f44176b31794e48a76766997ca9b910a5561cf28bf3d6f7008719d0e2cc9012b15e63871

Download Submit
memory/868-138-0x0000000000000000-mapping.dmp

Download
memory/1572-168-0x0000000000000000-mapping.dmp

Download
memory/1572-192-0x0000000000C30000-0x0000000000C36000-memory.dmp

Filesize
24KB

Download
memory/1572-170-0x0000000000C20000-0x0000000000C2B000-memory.dmp

Filesize
44KB

Download
memory/1572-169-0x0000000000C30000-0x0000000000C36000-memory.dmp

Filesize
24KB

Download
memory/1940-178-0x000000000063D000-0x000000000064D000-memory.dmp

Filesize
64KB

Download
memory/1940-179-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/1940-186-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/2816-173-0x0000000001280000-0x000000000128D000-memory.dmp

Filesize
52KB

Download
memory/2816-172-0x0000000001290000-0x0000000001297000-memory.dmp

Filesize
28KB

Download
memory/2816-171-0x0000000000000000-mapping.dmp

Download
memory/2816-193-0x0000000001290000-0x0000000001297000-memory.dmp

Filesize
28KB

Download
memory/3656-175-0x0000000001320000-0x0000000001328000-memory.dmp

Filesize
32KB

Download
memory/3656-194-0x0000000001320000-0x0000000001328000-memory.dmp

Filesize
32KB

Download
memory/3656-176-0x0000000001310000-0x000000000131B000-memory.dmp

Filesize
44KB

Download
memory/3656-174-0x0000000000000000-mapping.dmp

Download
memory/4580-177-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/4580-143-0x0000000000380000-0x000000000038B000-memory.dmp

Filesize
44KB

Download
memory/4580-142-0x0000000000390000-0x0000000000397000-memory.dmp

Filesize
28KB

Download
memory/4580-141-0x0000000000000000-mapping.dmp

Download
memory/4588-132-0x000000000062D000-0x000000000063E000-memory.dmp

Filesize
68KB

Download
memory/4588-135-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4588-134-0x0000000000400000-0x0000000000449000-memory.dmp

Filesize
292KB

Download
memory/4588-133-0x00000000005E0000-0x00000000005E9000-memory.dmp

Filesize
36KB

Download
memory/24096-146-0x00000000010B0000-0x00000000010BF000-memory.dmp

Filesize
60KB

Download
memory/24096-183-0x00000000010C0000-0x00000000010C9000-memory.dmp

Filesize
36KB

Download
memory/24096-144-0x0000000000000000-mapping.dmp

Download
memory/24096-145-0x00000000010C0000-0x00000000010C9000-memory.dmp

Filesize
36KB

Download
memory/55552-148-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/55552-147-0x0000000000000000-mapping.dmp

Download
memory/55552-184-0x0000000000560000-0x0000000000565000-memory.dmp

Filesize
20KB

Download
memory/55552-149-0x0000000000550000-0x0000000000559000-memory.dmp

Filesize
36KB

Download
memory/83012-152-0x0000000000DB0000-0x0000000000DBC000-memory.dmp

Filesize
48KB

Download
memory/83012-185-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Filesize
24KB

Download
memory/83012-150-0x0000000000000000-mapping.dmp

Download
memory/83012-151-0x0000000000DC0000-0x0000000000DC6000-memory.dmp

Filesize
24KB

Download
memory/102316-181-0x00000000062E0000-0x0000000006372000-memory.dmp

Filesize
584KB

Download
memory/102316-153-0x0000000000000000-mapping.dmp

Download
memory/102316-154-0x0000000000400000-0x0000000000428000-memory.dmp

Filesize
160KB

Download
memory/102316-166-0x00000000057C0000-0x00000000057FC000-memory.dmp

Filesize
240KB

Download
memory/102316-180-0x0000000006890000-0x0000000006E34000-memory.dmp

Filesize
5.6MB

Download
memory/102316-162-0x0000000005760000-0x0000000005772000-memory.dmp

Filesize
72KB

Download
memory/102316-182-0x0000000006380000-0x00000000063E6000-memory.dmp

Filesize
408KB

Download
memory/102316-191-0x0000000008020000-0x000000000854C000-memory.dmp

Filesize
5.2MB

Download
memory/102316-160-0x0000000005CC0000-0x00000000062D8000-memory.dmp

Filesize
6.1MB

Download
memory/102316-161-0x0000000005830000-0x000000000593A000-memory.dmp

Filesize
1.0MB

Download
memory/102316-190-0x0000000007410000-0x00000000075D2000-memory.dmp

Filesize
1.8MB

Download
memory/102316-187-0x00000000070C0000-0x0000000007136000-memory.dmp

Filesize
472KB

Download
memory/102316-188-0x0000000007040000-0x0000000007090000-memory.dmp

Filesize
320KB

Download
memory/102336-189-0x0000000001230000-0x0000000001235000-memory.dmp

Filesize
20KB

Download
memory/102336-165-0x0000000000000000-mapping.dmp

Download
memory/102336-167-0x0000000001220000-0x0000000001229000-memory.dmp

Filesize
36KB

Download
memory/102368-164-0x0000000000A40000-0x0000000000A67000-memory.dmp

Filesize
156KB

Download
memory/102368-163-0x0000000000A70000-0x0000000000A92000-memory.dmp

Filesize
136KB

Download
memory/102368-159-0x0000000000000000-mapping.dmp

Download

Analysis

Sharing

General

Malware Config

Extracted

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v6

Replay Monitor

Loading Replay Monitor...

Downloads