Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25/09/2022, 06:16

General

  • Target

    17b8e5b1eaea4b290c7cb78dac201a09.exe

  • Size

    196KB

  • MD5

    17b8e5b1eaea4b290c7cb78dac201a09

  • SHA1

    24e2844dd79b501f13899f66faa8950762052092

  • SHA256

    7b49988a41f87260871578ac40ee21ce66a9b8fc614775875675866ff13188e6

  • SHA512

    1f9dd768b94814cb8e2e82ee85f5f666cb9c95218e9ae11955adeca8dc1173c83d50e45de8b546e13978202d1c71a7de9fa7b75ebcc076f42dda43118c18d3cd

  • SSDEEP

    3072:C982oLwTA29h6N5+2LbuY0daHcmIJz3NuCuOCB/X1/PkkXx:vLY9h2bJHcHJz3Nub

Malware Config

Extracted

Family

tofsee

C2

svartalfheim.top

jotunheim.name

Extracted

Family

redline

Botnet

LogsDiller Cloud (TG: @me_golds)

C2

77.73.134.27:7161

Attributes
  • auth_value

    e136da06c7c0400f4091dab1787720ea

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Tofsee

    Backdoor/botnet which carries out malicious activities based on commands from a C2 server.

  • xmrig

    XMRig is a high performance, open source, cross platform CPU/GPU miner.

  • XMRig Miner payload 2 IoCs
  • Creates new service(s) 1 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Modifies Windows Firewall 1 TTPs 1 IoCs
  • Sets service image path in registry 2 TTPs 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Drops file in System32 directory 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Launches sc.exe 3 IoCs

    Sc.exe is a Windows utlilty to control services on the system.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 7 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 46 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\17b8e5b1eaea4b290c7cb78dac201a09.exe
    "C:\Users\Admin\AppData\Local\Temp\17b8e5b1eaea4b290c7cb78dac201a09.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:1028
  • C:\Users\Admin\AppData\Local\Temp\F707.exe
    C:\Users\Admin\AppData\Local\Temp\F707.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:3124
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:100844
  • C:\Users\Admin\AppData\Local\Temp\FA44.exe
    C:\Users\Admin\AppData\Local\Temp\FA44.exe
    1⤵
    • Executes dropped EXE
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:20080
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /C mkdir C:\Windows\SysWOW64\logduvsj\
      2⤵
        PID:60208
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\System32\cmd.exe" /C move /Y "C:\Users\Admin\AppData\Local\Temp\aiobgjcx.exe" C:\Windows\SysWOW64\logduvsj\
        2⤵
          PID:77956
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" create logduvsj binPath= "C:\Windows\SysWOW64\logduvsj\aiobgjcx.exe /d\"C:\Users\Admin\AppData\Local\Temp\FA44.exe\"" type= own start= auto DisplayName= "wifi support"
          2⤵
          • Launches sc.exe
          PID:90484
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" description logduvsj "wifi internet conection"
          2⤵
          • Launches sc.exe
          PID:98276
        • C:\Windows\SysWOW64\sc.exe
          "C:\Windows\System32\sc.exe" start logduvsj
          2⤵
          • Launches sc.exe
          PID:100900
        • C:\Windows\SysWOW64\netsh.exe
          "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="Host-process for services of Windows" dir=in action=allow program="C:\Windows\SysWOW64\svchost.exe" enable=yes>nul
          2⤵
          • Modifies Windows Firewall
          PID:100988
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 20080 -s 656
          2⤵
          • Program crash
          PID:101108
      • C:\Users\Admin\AppData\Local\Temp\292.exe
        C:\Users\Admin\AppData\Local\Temp\292.exe
        1⤵
        • Executes dropped EXE
        PID:89284
      • C:\Users\Admin\AppData\Local\Temp\4C6.exe
        C:\Users\Admin\AppData\Local\Temp\4C6.exe
        1⤵
        • Executes dropped EXE
        PID:98184
      • C:\Windows\SysWOW64\logduvsj\aiobgjcx.exe
        C:\Windows\SysWOW64\logduvsj\aiobgjcx.exe /d"C:\Users\Admin\AppData\Local\Temp\FA44.exe"
        1⤵
        • Executes dropped EXE
        • Drops file in System32 directory
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:100944
        • C:\Windows\SysWOW64\svchost.exe
          svchost.exe
          2⤵
          • Sets service image path in registry
          • Drops file in System32 directory
          • Suspicious use of SetThreadContext
          • Modifies data under HKEY_USERS
          PID:101180
          • C:\Windows\SysWOW64\svchost.exe
            svchost.exe -o fastpool.xyz:10060 -u 9mLwUkiK8Yp89zQQYodWKN29jVVVz1cWDFZctWxge16Zi3TpHnSBnnVcCDhSRXdesnMBdVjtDwh1N71KD9z37EzgKSM1tmS.60000 -p x -k -a cn/half
            3⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:3460
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 100944 -s 520
          2⤵
          • Program crash
          PID:101240
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:100960
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 20080 -ip 20080
          1⤵
            PID:101076
          • C:\Windows\explorer.exe
            C:\Windows\explorer.exe
            1⤵
              PID:101140
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 100944 -ip 100944
              1⤵
                PID:101208
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:101272
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:101308
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:101340
                    • C:\Windows\SysWOW64\explorer.exe
                      C:\Windows\SysWOW64\explorer.exe
                      1⤵
                        PID:101368
                      • C:\Windows\SysWOW64\explorer.exe
                        C:\Windows\SysWOW64\explorer.exe
                        1⤵
                          PID:392
                        • C:\Windows\explorer.exe
                          C:\Windows\explorer.exe
                          1⤵
                            PID:2156
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:1692

                            Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            • C:\Users\Admin\AppData\Local\Temp\292.exe

                              Filesize

                              318KB

                              MD5

                              6917d28aae7b190af4cc9e8c82597b99

                              SHA1

                              00ac38f05b4d99691ef09883f7f141a6cd3d4d3a

                              SHA256

                              5d72a91ee3aeab2a634e8023b2c0530c8429f1151f1e29421ff7a16cec75617d

                              SHA512

                              e5a2d6d37555a7f06bfd27aa52eb2075b142ffadd155c4e27e76c371ebd01710b4072576d4ae0fabd221a47f6386a44e37bb2097d9db5e88889ea76ed8170fb4

                            • C:\Users\Admin\AppData\Local\Temp\292.exe

                              Filesize

                              318KB

                              MD5

                              6917d28aae7b190af4cc9e8c82597b99

                              SHA1

                              00ac38f05b4d99691ef09883f7f141a6cd3d4d3a

                              SHA256

                              5d72a91ee3aeab2a634e8023b2c0530c8429f1151f1e29421ff7a16cec75617d

                              SHA512

                              e5a2d6d37555a7f06bfd27aa52eb2075b142ffadd155c4e27e76c371ebd01710b4072576d4ae0fabd221a47f6386a44e37bb2097d9db5e88889ea76ed8170fb4

                            • C:\Users\Admin\AppData\Local\Temp\4C6.exe

                              Filesize

                              365KB

                              MD5

                              1c92b308eeb3ee01d7622de9f8fea0b5

                              SHA1

                              5e5c89f5c6f15bad6b62ca0ea22f6dcfac1a6dda

                              SHA256

                              775f7f9041236757b05676318037000e221a582bdfd161b89a11a19fc4fde73c

                              SHA512

                              5a9836b2af8b7088bfca79e84b3d5ef51a620fe1d59f2a0f1f02605907bcedcbb3f95fd16f9812d405045056d688061cb4c5ef47f09ba0e7779de77b45f013eb

                            • C:\Users\Admin\AppData\Local\Temp\4C6.exe

                              Filesize

                              365KB

                              MD5

                              1c92b308eeb3ee01d7622de9f8fea0b5

                              SHA1

                              5e5c89f5c6f15bad6b62ca0ea22f6dcfac1a6dda

                              SHA256

                              775f7f9041236757b05676318037000e221a582bdfd161b89a11a19fc4fde73c

                              SHA512

                              5a9836b2af8b7088bfca79e84b3d5ef51a620fe1d59f2a0f1f02605907bcedcbb3f95fd16f9812d405045056d688061cb4c5ef47f09ba0e7779de77b45f013eb

                            • C:\Users\Admin\AppData\Local\Temp\F707.exe

                              Filesize

                              2.6MB

                              MD5

                              ea6fee4ce432602e3dd2b849f8396027

                              SHA1

                              5151b46012f637fe7fdbda551be1651009eb453a

                              SHA256

                              b44181d7365ab6868e1cf0d7127a56862075944099f6f1f965b11f41c78fd75d

                              SHA512

                              b567449c006248a4311a1a3325279e2d4edfacacb272ae3152b085d3164e722370aa748cbaa3299425ede1e4910218988e88f24de744944903b2001b70e263be

                            • C:\Users\Admin\AppData\Local\Temp\F707.exe

                              Filesize

                              2.6MB

                              MD5

                              ea6fee4ce432602e3dd2b849f8396027

                              SHA1

                              5151b46012f637fe7fdbda551be1651009eb453a

                              SHA256

                              b44181d7365ab6868e1cf0d7127a56862075944099f6f1f965b11f41c78fd75d

                              SHA512

                              b567449c006248a4311a1a3325279e2d4edfacacb272ae3152b085d3164e722370aa748cbaa3299425ede1e4910218988e88f24de744944903b2001b70e263be

                            • C:\Users\Admin\AppData\Local\Temp\FA44.exe

                              Filesize

                              201KB

                              MD5

                              2e636c990dc2d04cc549d783da6f462e

                              SHA1

                              9095209d363a69b5f4696d2c1de6435dc9745db5

                              SHA256

                              857e938e8bef854c67fec66d7fbfc7f19e29b81fe4cd8c1e387a9b34918e2f1d

                              SHA512

                              22d1b71371f99da9e6211da17feca7e254cf7295b3cc2ab072c6316881ce736c4f5704013b9c03dec72ef098337bb7d5592d5d5cbfed404f76a9aaf945ce9e49

                            • C:\Users\Admin\AppData\Local\Temp\FA44.exe

                              Filesize

                              201KB

                              MD5

                              2e636c990dc2d04cc549d783da6f462e

                              SHA1

                              9095209d363a69b5f4696d2c1de6435dc9745db5

                              SHA256

                              857e938e8bef854c67fec66d7fbfc7f19e29b81fe4cd8c1e387a9b34918e2f1d

                              SHA512

                              22d1b71371f99da9e6211da17feca7e254cf7295b3cc2ab072c6316881ce736c4f5704013b9c03dec72ef098337bb7d5592d5d5cbfed404f76a9aaf945ce9e49

                            • C:\Users\Admin\AppData\Local\Temp\aiobgjcx.exe

                              Filesize

                              15.0MB

                              MD5

                              bc60549a1cd9e5b2cbe969eedabc3965

                              SHA1

                              6c6d190ee6a2fc33a7de76c39aa08420d56f4540

                              SHA256

                              6d35ab21b212b670db9513461963439059835205241b76be439a31777bdf0670

                              SHA512

                              0ca9cfbce40fc615532009c4a41eaa21dfaa0fb71d103c64005a6ffa2de06b981deae5841f743f65c8640b071e2efbf8d2df5052071f3ed0ceeb35ac5100f43a

                            • C:\Windows\SysWOW64\logduvsj\aiobgjcx.exe

                              Filesize

                              15.0MB

                              MD5

                              bc60549a1cd9e5b2cbe969eedabc3965

                              SHA1

                              6c6d190ee6a2fc33a7de76c39aa08420d56f4540

                              SHA256

                              6d35ab21b212b670db9513461963439059835205241b76be439a31777bdf0670

                              SHA512

                              0ca9cfbce40fc615532009c4a41eaa21dfaa0fb71d103c64005a6ffa2de06b981deae5841f743f65c8640b071e2efbf8d2df5052071f3ed0ceeb35ac5100f43a

                            • memory/392-243-0x0000000000970000-0x0000000000976000-memory.dmp

                              Filesize

                              24KB

                            • memory/392-196-0x0000000000970000-0x0000000000976000-memory.dmp

                              Filesize

                              24KB

                            • memory/392-197-0x0000000000960000-0x000000000096B000-memory.dmp

                              Filesize

                              44KB

                            • memory/1028-132-0x00000000008E8000-0x00000000008F8000-memory.dmp

                              Filesize

                              64KB

                            • memory/1028-135-0x0000000000400000-0x000000000058B000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/1028-134-0x0000000000400000-0x000000000058B000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/1028-133-0x0000000000710000-0x0000000000719000-memory.dmp

                              Filesize

                              36KB

                            • memory/1692-245-0x00000000014D0000-0x00000000014D8000-memory.dmp

                              Filesize

                              32KB

                            • memory/1692-205-0x00000000014D0000-0x00000000014D8000-memory.dmp

                              Filesize

                              32KB

                            • memory/1692-206-0x00000000014C0000-0x00000000014CB000-memory.dmp

                              Filesize

                              44KB

                            • memory/2156-201-0x00000000003C0000-0x00000000003CD000-memory.dmp

                              Filesize

                              52KB

                            • memory/2156-199-0x00000000003D0000-0x00000000003D7000-memory.dmp

                              Filesize

                              28KB

                            • memory/2156-244-0x00000000003D0000-0x00000000003D7000-memory.dmp

                              Filesize

                              28KB

                            • memory/3460-240-0x0000000000A70000-0x0000000000B61000-memory.dmp

                              Filesize

                              964KB

                            • memory/3460-235-0x0000000000A70000-0x0000000000B61000-memory.dmp

                              Filesize

                              964KB

                            • memory/20080-144-0x00000000005C0000-0x00000000005D3000-memory.dmp

                              Filesize

                              76KB

                            • memory/20080-143-0x0000000000769000-0x000000000077A000-memory.dmp

                              Filesize

                              68KB

                            • memory/20080-145-0x0000000000400000-0x000000000058C000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/20080-172-0x0000000000400000-0x000000000058C000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/100844-207-0x0000000006E70000-0x0000000007032000-memory.dmp

                              Filesize

                              1.8MB

                            • memory/100844-169-0x0000000005660000-0x000000000569C000-memory.dmp

                              Filesize

                              240KB

                            • memory/100844-203-0x0000000005A80000-0x0000000005AE6000-memory.dmp

                              Filesize

                              408KB

                            • memory/100844-157-0x0000000000400000-0x0000000000428000-memory.dmp

                              Filesize

                              160KB

                            • memory/100844-202-0x0000000006140000-0x00000000061D2000-memory.dmp

                              Filesize

                              584KB

                            • memory/100844-200-0x00000000066F0000-0x0000000006C94000-memory.dmp

                              Filesize

                              5.6MB

                            • memory/100844-168-0x00000000055D0000-0x00000000055E2000-memory.dmp

                              Filesize

                              72KB

                            • memory/100844-166-0x0000000005B20000-0x0000000006138000-memory.dmp

                              Filesize

                              6.1MB

                            • memory/100844-167-0x00000000056A0000-0x00000000057AA000-memory.dmp

                              Filesize

                              1.0MB

                            • memory/100844-208-0x0000000007570000-0x0000000007A9C000-memory.dmp

                              Filesize

                              5.2MB

                            • memory/100844-209-0x0000000007040000-0x00000000070B6000-memory.dmp

                              Filesize

                              472KB

                            • memory/100844-210-0x00000000070C0000-0x0000000007110000-memory.dmp

                              Filesize

                              320KB

                            • memory/100944-179-0x0000000000400000-0x000000000058C000-memory.dmp

                              Filesize

                              1.5MB

                            • memory/100944-178-0x0000000000883000-0x0000000000893000-memory.dmp

                              Filesize

                              64KB

                            • memory/100960-211-0x00000000014D0000-0x00000000014D7000-memory.dmp

                              Filesize

                              28KB

                            • memory/100960-170-0x00000000014D0000-0x00000000014D7000-memory.dmp

                              Filesize

                              28KB

                            • memory/100960-171-0x00000000014C0000-0x00000000014CB000-memory.dmp

                              Filesize

                              44KB

                            • memory/101140-212-0x0000000000CD0000-0x0000000000CD9000-memory.dmp

                              Filesize

                              36KB

                            • memory/101140-181-0x0000000000CD0000-0x0000000000CD9000-memory.dmp

                              Filesize

                              36KB

                            • memory/101140-182-0x0000000000CC0000-0x0000000000CCF000-memory.dmp

                              Filesize

                              60KB

                            • memory/101180-221-0x0000000000BD0000-0x0000000000BE0000-memory.dmp

                              Filesize

                              64KB

                            • memory/101180-214-0x0000000002400000-0x000000000260F000-memory.dmp

                              Filesize

                              2.1MB

                            • memory/101180-175-0x00000000006B0000-0x00000000006C5000-memory.dmp

                              Filesize

                              84KB

                            • memory/101180-184-0x00000000006B0000-0x00000000006C5000-memory.dmp

                              Filesize

                              84KB

                            • memory/101180-231-0x0000000001BE0000-0x0000000001BE7000-memory.dmp

                              Filesize

                              28KB

                            • memory/101180-228-0x0000000007280000-0x000000000768B000-memory.dmp

                              Filesize

                              4.0MB

                            • memory/101180-225-0x0000000000BF0000-0x0000000000BF5000-memory.dmp

                              Filesize

                              20KB

                            • memory/101180-217-0x0000000000BC0000-0x0000000000BC6000-memory.dmp

                              Filesize

                              24KB

                            • memory/101180-213-0x00000000006B0000-0x00000000006C5000-memory.dmp

                              Filesize

                              84KB

                            • memory/101272-186-0x0000000000500000-0x0000000000505000-memory.dmp

                              Filesize

                              20KB

                            • memory/101272-183-0x00000000004F0000-0x00000000004F9000-memory.dmp

                              Filesize

                              36KB

                            • memory/101272-220-0x0000000000500000-0x0000000000505000-memory.dmp

                              Filesize

                              20KB

                            • memory/101308-187-0x00000000005B0000-0x00000000005B6000-memory.dmp

                              Filesize

                              24KB

                            • memory/101308-222-0x00000000005B0000-0x00000000005B6000-memory.dmp

                              Filesize

                              24KB

                            • memory/101308-188-0x00000000005A0000-0x00000000005AC000-memory.dmp

                              Filesize

                              48KB

                            • memory/101340-190-0x00000000003C0000-0x00000000003E2000-memory.dmp

                              Filesize

                              136KB

                            • memory/101340-191-0x0000000000390000-0x00000000003B7000-memory.dmp

                              Filesize

                              156KB

                            • memory/101340-241-0x00000000003C0000-0x00000000003E2000-memory.dmp

                              Filesize

                              136KB

                            • memory/101368-193-0x0000000000C50000-0x0000000000C55000-memory.dmp

                              Filesize

                              20KB

                            • memory/101368-242-0x0000000000C50000-0x0000000000C55000-memory.dmp

                              Filesize

                              20KB

                            • memory/101368-194-0x0000000000C40000-0x0000000000C49000-memory.dmp

                              Filesize

                              36KB