Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
26-09-2022 08:15
Static task
static1
General
-
Target
fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe
-
Size
153KB
-
MD5
dbb6a86db570838ff33d617d752c45c6
-
SHA1
cc3279720fdeb2f69c77326786672acb4da7a4e2
-
SHA256
fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d
-
SHA512
56717dc44d2c0243b8e7f05564ed4c9274c5e76a9f360b6df023632bde411f8367e9a104d1a96276e3885b440be2016a81355003aecaed7846e2ed0299839a43
-
SSDEEP
3072:WaZKIuG5okFesKIp+bXLuVE+GLUopMYABvZtVSsd5x:wKesf+bXLu2LUoC9Ss
Malware Config
Extracted
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1896-144-0x00000000006A0000-0x00000000006A9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
370E.exeA76C.exepid process 3724 370E.exe 3564 A76C.exe -
Deletes itself 1 IoCs
Processes:
pid process 3068 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exedescription ioc process Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exepid process 1896 fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe 1896 fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3068 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exepid process 1896 fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
A76C.exedescription pid process Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeDebugPrivilege 3564 A76C.exe Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
370E.exedescription pid process target process PID 3068 wrote to memory of 3724 3068 370E.exe PID 3068 wrote to memory of 3724 3068 370E.exe PID 3068 wrote to memory of 3724 3068 370E.exe PID 3724 wrote to memory of 4292 3724 370E.exe appidtel.exe PID 3724 wrote to memory of 4292 3724 370E.exe appidtel.exe PID 3724 wrote to memory of 4292 3724 370E.exe appidtel.exe PID 3068 wrote to memory of 3564 3068 A76C.exe PID 3068 wrote to memory of 3564 3068 A76C.exe PID 3068 wrote to memory of 3564 3068 A76C.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe"C:\Users\Admin\AppData\Local\Temp\fe7f36fd3159928a35a504afad76621903ce59a6ca898065de8fe9342178957d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\370E.exeC:\Users\Admin\AppData\Local\Temp\370E.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\A76C.exeC:\Users\Admin\AppData\Local\Temp\A76C.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\370E.exeFilesize
1.2MB
MD52da264809fd8bf18ef7726eb24255eaf
SHA1732eddd75364c669197a8c4ca30a15890a4554fe
SHA256c8f6ef5e44f2c9e4a090e781a2240901ef8a305c48cf6dd3f8ab7f6c3233fe2e
SHA512960a059b2df608012c98648905d258942df3beb7d263b011c336456d3cf9521f8b3d339881f7b6c2aedcf9335dd9eb9634dd9f8c7a31cf056cda42ad8f9862ec
-
C:\Users\Admin\AppData\Local\Temp\370E.exeFilesize
1.2MB
MD52da264809fd8bf18ef7726eb24255eaf
SHA1732eddd75364c669197a8c4ca30a15890a4554fe
SHA256c8f6ef5e44f2c9e4a090e781a2240901ef8a305c48cf6dd3f8ab7f6c3233fe2e
SHA512960a059b2df608012c98648905d258942df3beb7d263b011c336456d3cf9521f8b3d339881f7b6c2aedcf9335dd9eb9634dd9f8c7a31cf056cda42ad8f9862ec
-
C:\Users\Admin\AppData\Local\Temp\A76C.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\A76C.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
memory/1896-149-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-148-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-124-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-125-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-126-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-127-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-152-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-129-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-130-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-131-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-132-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-133-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-134-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-136-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-137-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-138-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-139-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-140-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-141-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-143-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-142-0x0000000000590000-0x000000000063E000-memory.dmpFilesize
696KB
-
memory/1896-144-0x00000000006A0000-0x00000000006A9000-memory.dmpFilesize
36KB
-
memory/1896-145-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-147-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/1896-146-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-153-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-151-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-150-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-120-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-128-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-123-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-154-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-155-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-156-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-157-0x0000000000400000-0x0000000000581000-memory.dmpFilesize
1.5MB
-
memory/1896-121-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/1896-122-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3564-208-0x0000000000000000-mapping.dmp
-
memory/3564-313-0x0000000006C90000-0x0000000006CAE000-memory.dmpFilesize
120KB
-
memory/3564-286-0x0000000004DE0000-0x0000000004E2B000-memory.dmpFilesize
300KB
-
memory/3564-312-0x0000000007990000-0x0000000007A06000-memory.dmpFilesize
472KB
-
memory/3564-306-0x00000000064D0000-0x00000000069FC000-memory.dmpFilesize
5.2MB
-
memory/3564-305-0x00000000062F0000-0x00000000064B2000-memory.dmpFilesize
1.8MB
-
memory/3564-304-0x0000000006220000-0x00000000062B2000-memory.dmpFilesize
584KB
-
memory/3564-296-0x0000000005B70000-0x0000000005BD6000-memory.dmpFilesize
408KB
-
memory/3564-274-0x0000000002690000-0x00000000026A2000-memory.dmpFilesize
72KB
-
memory/3564-314-0x0000000007C10000-0x0000000007C60000-memory.dmpFilesize
320KB
-
memory/3564-278-0x00000000026E0000-0x000000000271E000-memory.dmpFilesize
248KB
-
memory/3564-316-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3564-275-0x0000000004CD0000-0x0000000004DDA000-memory.dmpFilesize
1.0MB
-
memory/3564-273-0x0000000005390000-0x0000000005996000-memory.dmpFilesize
6.0MB
-
memory/3564-262-0x00000000025A0000-0x00000000025CE000-memory.dmpFilesize
184KB
-
memory/3564-260-0x0000000004E90000-0x000000000538E000-memory.dmpFilesize
5.0MB
-
memory/3564-255-0x0000000002300000-0x0000000002330000-memory.dmpFilesize
192KB
-
memory/3564-248-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3564-247-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3564-245-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3564-321-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/3564-315-0x00000000006D0000-0x000000000081A000-memory.dmpFilesize
1.3MB
-
memory/3724-171-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-187-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-186-0x0000000002400000-0x0000000002530000-memory.dmpFilesize
1.2MB
-
memory/3724-189-0x0000000002530000-0x000000000280B000-memory.dmpFilesize
2.9MB
-
memory/3724-188-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-190-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-191-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-192-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-197-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/3724-206-0x0000000002530000-0x000000000280B000-memory.dmpFilesize
2.9MB
-
memory/3724-207-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/3724-185-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-184-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-182-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-183-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-181-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-180-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-178-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-179-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-177-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-173-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-175-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-174-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-172-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-170-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-169-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-168-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-166-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-164-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-165-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-163-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-161-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-162-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-160-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/3724-158-0x0000000000000000-mapping.dmp
-
memory/3724-323-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4292-193-0x0000000000000000-mapping.dmp
-
memory/4292-194-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB
-
memory/4292-195-0x0000000077250000-0x00000000773DE000-memory.dmpFilesize
1.6MB