Analysis

  • max time kernel
    151s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2022 04:12

General

  • Target

    40cafffb20e76da2090434720a692d8d.exe

  • Size

    129KB

  • MD5

    40cafffb20e76da2090434720a692d8d

  • SHA1

    331a58ae824e22e444056fab9769f14db1eecc4c

  • SHA256

    08415e962db965deaa4e02ecf2e198942100c56b5835e9298242da837b585b69

  • SHA512

    ce479e46e4696461eaabbddcace3ad51581381762b04fd6bdce44285af5304de2382a1c2ed787d2c422204bcd4a978fc5e7eece1f8aeed78eaee0da314d45184

  • SSDEEP

    3072:BW+pT85Nk3bm3e8DIok0xTwEE7W/LS6g+lQf5B:BBD6e8y0RHWMLg+

Malware Config

Extracted

Family

redline

Botnet

11

C2

77.73.134.27:7161

Attributes
auth_value
e6aadafed1fda7723d7655a5894828d2

Extracted

Family

redline

Botnet

install

C2

212.8.244.233:43690

Attributes
auth_value
cbce7277fef2185d93b8332df3940ad5

Signatures

  • Detects Smokeloader packer ⋅ 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload ⋅ 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE ⋅ 4 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 ⋅ 1 TTPs
  • Suspicious use of SetThreadContext ⋅ 2 IoCs
  • Checks SCSI registry key(s) ⋅ 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses ⋅ 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam ⋅ 1 IoCs
  • Suspicious behavior: MapViewOfSection ⋅ 19 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 35 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40cafffb20e76da2090434720a692d8d.exe
    "C:\Users\Admin\AppData\Local\Temp\40cafffb20e76da2090434720a692d8d.exe"
    Checks SCSI registry key(s)
    Suspicious behavior: EnumeratesProcesses
    Suspicious behavior: MapViewOfSection
    PID:4208
  • C:\Users\Admin\AppData\Local\Temp\DE01.exe
    C:\Users\Admin\AppData\Local\Temp\DE01.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      Suspicious use of AdjustPrivilegeToken
      PID:102888
  • C:\Users\Admin\AppData\Local\Temp\EB31.exe
    C:\Users\Admin\AppData\Local\Temp\EB31.exe
    Executes dropped EXE
    Suspicious use of AdjustPrivilegeToken
    PID:102952
  • C:\Users\Admin\AppData\Local\Temp\F5C1.exe
    C:\Users\Admin\AppData\Local\Temp\F5C1.exe
    Executes dropped EXE
    PID:103084
  • C:\Users\Admin\AppData\Local\Temp\FE2E.exe
    C:\Users\Admin\AppData\Local\Temp\FE2E.exe
    Executes dropped EXE
    Suspicious use of SetThreadContext
    Suspicious use of WriteProcessMemory
    PID:103168
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      Suspicious use of AdjustPrivilegeToken
      PID:102768
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:55188
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:67320
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:102812
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:102864
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:4000
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:102980
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:103020
  • C:\Windows\explorer.exe
    C:\Windows\explorer.exe
    PID:103132
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    PID:103104

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

    Execution

      Exfiltration

        Impact

          Initial Access

            Lateral Movement

              Persistence

                Privilege Escalation

                  Replay Monitor

                  00:00 00:00

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
                    MD5

                    5c9237df35c69a284b3cfd66970ce736

                    SHA1

                    6c25b1319637046c663d18e36bdafbb6f5cadf00

                    SHA256

                    b4a0eea59921d24fe0f743c96ed5322c79af4c22d37c16f62bdba777c6be717e

                    SHA512

                    01dcd3afd5f4d395299ad2b8f8c41c1b39422486274d0a95c0f4e187b38d75ff40fce896815fa9dc05b2d66403ae83a697cb43927271f0eb1de28d78163dcc06

                  • C:\Users\Admin\AppData\Local\Temp\DE01.exe
                    MD5

                    68d0826f868433f44dd9aaf631f7d616

                    SHA1

                    3ba777f68d4e4051317b0676c0eea794f3515dfa

                    SHA256

                    e51fb04aabdb1102bf3ee0a0dd8d4d19e43b3f7735d5839391af244660152e55

                    SHA512

                    e00313c5c637f3db1a612c38c4a67bab0b5b5a7443264bb63f8c266e2d5f70d58688c776f301753049ca8f8672b921162fffc8cf563eccf9462fda89f6aaccc2

                  • C:\Users\Admin\AppData\Local\Temp\DE01.exe
                    MD5

                    68d0826f868433f44dd9aaf631f7d616

                    SHA1

                    3ba777f68d4e4051317b0676c0eea794f3515dfa

                    SHA256

                    e51fb04aabdb1102bf3ee0a0dd8d4d19e43b3f7735d5839391af244660152e55

                    SHA512

                    e00313c5c637f3db1a612c38c4a67bab0b5b5a7443264bb63f8c266e2d5f70d58688c776f301753049ca8f8672b921162fffc8cf563eccf9462fda89f6aaccc2

                  • C:\Users\Admin\AppData\Local\Temp\EB31.exe
                    MD5

                    07ea3bc2b9eaacd002de4f59803ef234

                    SHA1

                    8a796069e5eac844f40b4487c80ed1c93316a331

                    SHA256

                    2302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1

                    SHA512

                    d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092

                  • C:\Users\Admin\AppData\Local\Temp\EB31.exe
                    MD5

                    07ea3bc2b9eaacd002de4f59803ef234

                    SHA1

                    8a796069e5eac844f40b4487c80ed1c93316a331

                    SHA256

                    2302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1

                    SHA512

                    d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092

                  • C:\Users\Admin\AppData\Local\Temp\F5C1.exe
                    MD5

                    2012a6a9ac2ae06fe3a2caa92c67dc8b

                    SHA1

                    359f24688cafb5384efa2cd31d3abb7d1bc3e2ce

                    SHA256

                    36cc3881c0ea55a7e80c288c0e60ab6d6849abe814e581acaeb8d467bcb8358b

                    SHA512

                    75531bcbc504dce0b0b0b9368f65ec87b0103e39341ee1c337b2d7c6b9c5d70178700e436aad1b70ccab0190438fa6911b2b9ef668594cf3c5ab36fbe7da7c21

                  • C:\Users\Admin\AppData\Local\Temp\F5C1.exe
                    MD5

                    2012a6a9ac2ae06fe3a2caa92c67dc8b

                    SHA1

                    359f24688cafb5384efa2cd31d3abb7d1bc3e2ce

                    SHA256

                    36cc3881c0ea55a7e80c288c0e60ab6d6849abe814e581acaeb8d467bcb8358b

                    SHA512

                    75531bcbc504dce0b0b0b9368f65ec87b0103e39341ee1c337b2d7c6b9c5d70178700e436aad1b70ccab0190438fa6911b2b9ef668594cf3c5ab36fbe7da7c21

                  • C:\Users\Admin\AppData\Local\Temp\FE2E.exe
                    MD5

                    30c9c5718ae5e894dca2283bc4506924

                    SHA1

                    98d366e2d2e3ba56caf9c6934d9538cf60a26971

                    SHA256

                    ac98964943f2bdb3d7b1874c8a64a3670c64e03ac87a18fcc2b0a9f33d56b0c0

                    SHA512

                    eaf44d6c02f6a1d55764f10ed4d129115f18ee8198de9dbe64ec960c1b25c2e363c0b868c2caaa92179d6639bb8c12f7cfc0c36f26d6a949904ec721f1ca500b

                  • C:\Users\Admin\AppData\Local\Temp\FE2E.exe
                    MD5

                    30c9c5718ae5e894dca2283bc4506924

                    SHA1

                    98d366e2d2e3ba56caf9c6934d9538cf60a26971

                    SHA256

                    ac98964943f2bdb3d7b1874c8a64a3670c64e03ac87a18fcc2b0a9f33d56b0c0

                    SHA512

                    eaf44d6c02f6a1d55764f10ed4d129115f18ee8198de9dbe64ec960c1b25c2e363c0b868c2caaa92179d6639bb8c12f7cfc0c36f26d6a949904ec721f1ca500b

                  • memory/4000-137-0x0000000000000000-mapping.dmp
                  • memory/4000-210-0x0000000001000000-0x0000000001022000-memory.dmp
                  • memory/4000-192-0x0000000000DC0000-0x0000000000DE7000-memory.dmp
                  • memory/4000-190-0x0000000000000000-mapping.dmp
                  • memory/4000-191-0x0000000001000000-0x0000000001022000-memory.dmp
                  • memory/4208-136-0x0000000000400000-0x000000000057E000-memory.dmp
                  • memory/4208-135-0x0000000000400000-0x000000000057E000-memory.dmp
                  • memory/4208-133-0x00000000005D8000-0x00000000005E9000-memory.dmp
                  • memory/4208-134-0x00000000022B0000-0x00000000022B9000-memory.dmp
                  • memory/55188-168-0x0000000000000000-mapping.dmp
                  • memory/55188-171-0x0000000000C80000-0x0000000000C87000-memory.dmp
                  • memory/55188-172-0x0000000000C70000-0x0000000000C7B000-memory.dmp
                  • memory/55188-205-0x0000000000C80000-0x0000000000C87000-memory.dmp
                  • memory/67320-206-0x0000000001240000-0x0000000001249000-memory.dmp
                  • memory/67320-174-0x0000000001240000-0x0000000001249000-memory.dmp
                  • memory/67320-175-0x0000000001230000-0x000000000123F000-memory.dmp
                  • memory/67320-173-0x0000000000000000-mapping.dmp
                  • memory/102768-177-0x0000000000400000-0x0000000000428000-memory.dmp
                  • memory/102768-176-0x0000000000000000-mapping.dmp
                  • memory/102812-182-0x0000000000000000-mapping.dmp
                  • memory/102812-185-0x0000000000AB0000-0x0000000000AB5000-memory.dmp
                  • memory/102812-186-0x0000000000AA0000-0x0000000000AA9000-memory.dmp
                  • memory/102812-208-0x0000000000AB0000-0x0000000000AB5000-memory.dmp
                  • memory/102864-188-0x0000000000AA0000-0x0000000000AA6000-memory.dmp
                  • memory/102864-189-0x0000000000A90000-0x0000000000A9C000-memory.dmp
                  • memory/102864-187-0x0000000000000000-mapping.dmp
                  • memory/102864-209-0x0000000000AA0000-0x0000000000AA6000-memory.dmp
                  • memory/102888-146-0x0000000005E70000-0x0000000006488000-memory.dmp
                  • memory/102888-140-0x0000000000000000-mapping.dmp
                  • memory/102888-141-0x0000000000400000-0x0000000000428000-memory.dmp
                  • memory/102888-147-0x00000000059F0000-0x0000000005AFA000-memory.dmp
                  • memory/102888-148-0x0000000005920000-0x0000000005932000-memory.dmp
                  • memory/102888-152-0x00000000059A0000-0x00000000059DC000-memory.dmp
                  • memory/102952-155-0x0000000000720000-0x0000000000758000-memory.dmp
                  • memory/102952-158-0x0000000005D50000-0x0000000005DB6000-memory.dmp
                  • memory/102952-183-0x00000000007E9000-0x0000000000813000-memory.dmp
                  • memory/102952-170-0x00000000067E0000-0x0000000006D0C000-memory.dmp
                  • memory/102952-169-0x0000000006610000-0x00000000067D2000-memory.dmp
                  • memory/102952-149-0x0000000000000000-mapping.dmp
                  • memory/102952-164-0x0000000006D70000-0x0000000006D8E000-memory.dmp
                  • memory/102952-162-0x00000000072E0000-0x0000000007356000-memory.dmp
                  • memory/102952-159-0x00000000065B0000-0x0000000006600000-memory.dmp
                  • memory/102952-153-0x0000000004C60000-0x0000000005204000-memory.dmp
                  • memory/102952-154-0x00000000007E9000-0x0000000000813000-memory.dmp
                  • memory/102952-156-0x0000000000400000-0x000000000059A000-memory.dmp
                  • memory/102952-157-0x0000000005CB0000-0x0000000005D42000-memory.dmp
                  • memory/102952-184-0x0000000000400000-0x000000000059A000-memory.dmp
                  • memory/102980-211-0x0000000001250000-0x0000000001255000-memory.dmp
                  • memory/102980-193-0x0000000000000000-mapping.dmp
                  • memory/102980-194-0x0000000001250000-0x0000000001255000-memory.dmp
                  • memory/102980-195-0x0000000001240000-0x0000000001249000-memory.dmp
                  • memory/103020-196-0x0000000000000000-mapping.dmp
                  • memory/103020-198-0x00000000010D0000-0x00000000010DB000-memory.dmp
                  • memory/103020-212-0x00000000010E0000-0x00000000010E6000-memory.dmp
                  • memory/103020-197-0x00000000010E0000-0x00000000010E6000-memory.dmp
                  • memory/103084-160-0x0000000000000000-mapping.dmp
                  • memory/103104-204-0x0000000000940000-0x000000000094B000-memory.dmp
                  • memory/103104-203-0x0000000000950000-0x0000000000958000-memory.dmp
                  • memory/103104-202-0x0000000000000000-mapping.dmp
                  • memory/103104-214-0x0000000000950000-0x0000000000958000-memory.dmp
                  • memory/103132-201-0x0000000000700000-0x000000000070D000-memory.dmp
                  • memory/103132-200-0x0000000000710000-0x0000000000717000-memory.dmp
                  • memory/103132-199-0x0000000000000000-mapping.dmp
                  • memory/103132-213-0x0000000000710000-0x0000000000717000-memory.dmp
                  • memory/103168-165-0x0000000000000000-mapping.dmp