Analysis

  • max time kernel
    151s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    27-09-2022 04:12

General

  • Target

    40cafffb20e76da2090434720a692d8d.exe

  • Size

    129KB

  • MD5

    40cafffb20e76da2090434720a692d8d

  • SHA1

    331a58ae824e22e444056fab9769f14db1eecc4c

  • SHA256

    08415e962db965deaa4e02ecf2e198942100c56b5835e9298242da837b585b69

  • SHA512

    ce479e46e4696461eaabbddcace3ad51581381762b04fd6bdce44285af5304de2382a1c2ed787d2c422204bcd4a978fc5e7eece1f8aeed78eaee0da314d45184

  • SSDEEP

    3072:BW+pT85Nk3bm3e8DIok0xTwEE7W/LS6g+lQf5B:BBD6e8y0RHWMLg+

Malware Config

Extracted

Family

redline

Botnet

11

C2

77.73.134.27:7161

Attributes
  • auth_value

    e6aadafed1fda7723d7655a5894828d2

Extracted

Family

redline

Botnet

install

C2

212.8.244.233:43690

Attributes
  • auth_value

    cbce7277fef2185d93b8332df3940ad5

Signatures

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 4 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 19 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 55 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\40cafffb20e76da2090434720a692d8d.exe
    "C:\Users\Admin\AppData\Local\Temp\40cafffb20e76da2090434720a692d8d.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4208
  • C:\Users\Admin\AppData\Local\Temp\DE01.exe
    C:\Users\Admin\AppData\Local\Temp\DE01.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4000
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:102888
  • C:\Users\Admin\AppData\Local\Temp\EB31.exe
    C:\Users\Admin\AppData\Local\Temp\EB31.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of AdjustPrivilegeToken
    PID:102952
  • C:\Users\Admin\AppData\Local\Temp\F5C1.exe
    C:\Users\Admin\AppData\Local\Temp\F5C1.exe
    1⤵
    • Executes dropped EXE
    PID:103084
  • C:\Users\Admin\AppData\Local\Temp\FE2E.exe
    C:\Users\Admin\AppData\Local\Temp\FE2E.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:103168
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:102768
  • C:\Windows\SysWOW64\explorer.exe
    C:\Windows\SysWOW64\explorer.exe
    1⤵
      PID:55188
    • C:\Windows\explorer.exe
      C:\Windows\explorer.exe
      1⤵
        PID:67320
      • C:\Windows\SysWOW64\explorer.exe
        C:\Windows\SysWOW64\explorer.exe
        1⤵
          PID:102812
        • C:\Windows\explorer.exe
          C:\Windows\explorer.exe
          1⤵
            PID:102864
          • C:\Windows\SysWOW64\explorer.exe
            C:\Windows\SysWOW64\explorer.exe
            1⤵
              PID:4000
            • C:\Windows\SysWOW64\explorer.exe
              C:\Windows\SysWOW64\explorer.exe
              1⤵
                PID:102980
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:103020
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:103132
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:103104

                    Network

                    MITRE ATT&CK Matrix ATT&CK v6

                    Credential Access

                    Credentials in Files

                    2
                    T1081

                    Discovery

                    Query Registry

                    2
                    T1012

                    Peripheral Device Discovery

                    1
                    T1120

                    System Information Discovery

                    1
                    T1082

                    Collection

                    Data from Local System

                    2
                    T1005

                    Command and Control

                    Web Service

                    1
                    T1102

                    Replay Monitor

                    Loading Replay Monitor...

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AppLaunch.exe.log
                      Filesize

                      2KB

                      MD5

                      5c9237df35c69a284b3cfd66970ce736

                      SHA1

                      6c25b1319637046c663d18e36bdafbb6f5cadf00

                      SHA256

                      b4a0eea59921d24fe0f743c96ed5322c79af4c22d37c16f62bdba777c6be717e

                      SHA512

                      01dcd3afd5f4d395299ad2b8f8c41c1b39422486274d0a95c0f4e187b38d75ff40fce896815fa9dc05b2d66403ae83a697cb43927271f0eb1de28d78163dcc06

                    • C:\Users\Admin\AppData\Local\Temp\DE01.exe
                      Filesize

                      2.6MB

                      MD5

                      68d0826f868433f44dd9aaf631f7d616

                      SHA1

                      3ba777f68d4e4051317b0676c0eea794f3515dfa

                      SHA256

                      e51fb04aabdb1102bf3ee0a0dd8d4d19e43b3f7735d5839391af244660152e55

                      SHA512

                      e00313c5c637f3db1a612c38c4a67bab0b5b5a7443264bb63f8c266e2d5f70d58688c776f301753049ca8f8672b921162fffc8cf563eccf9462fda89f6aaccc2

                    • C:\Users\Admin\AppData\Local\Temp\DE01.exe
                      Filesize

                      2.6MB

                      MD5

                      68d0826f868433f44dd9aaf631f7d616

                      SHA1

                      3ba777f68d4e4051317b0676c0eea794f3515dfa

                      SHA256

                      e51fb04aabdb1102bf3ee0a0dd8d4d19e43b3f7735d5839391af244660152e55

                      SHA512

                      e00313c5c637f3db1a612c38c4a67bab0b5b5a7443264bb63f8c266e2d5f70d58688c776f301753049ca8f8672b921162fffc8cf563eccf9462fda89f6aaccc2

                    • C:\Users\Admin\AppData\Local\Temp\EB31.exe
                      Filesize

                      255KB

                      MD5

                      07ea3bc2b9eaacd002de4f59803ef234

                      SHA1

                      8a796069e5eac844f40b4487c80ed1c93316a331

                      SHA256

                      2302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1

                      SHA512

                      d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092

                    • C:\Users\Admin\AppData\Local\Temp\EB31.exe
                      Filesize

                      255KB

                      MD5

                      07ea3bc2b9eaacd002de4f59803ef234

                      SHA1

                      8a796069e5eac844f40b4487c80ed1c93316a331

                      SHA256

                      2302396062d7523a230f0a81ada322bb8907e11d006c0ec29a37821dd084bfe1

                      SHA512

                      d89e46145536d9b5fc310b72b24a4b1790100bbfd18b39a48dd10938255233132f0d87190c4c84c2b78076d9b0a39c4c9f6f27ece40a9b3f93b3e65aaca2c092

                    • C:\Users\Admin\AppData\Local\Temp\F5C1.exe
                      Filesize

                      346KB

                      MD5

                      2012a6a9ac2ae06fe3a2caa92c67dc8b

                      SHA1

                      359f24688cafb5384efa2cd31d3abb7d1bc3e2ce

                      SHA256

                      36cc3881c0ea55a7e80c288c0e60ab6d6849abe814e581acaeb8d467bcb8358b

                      SHA512

                      75531bcbc504dce0b0b0b9368f65ec87b0103e39341ee1c337b2d7c6b9c5d70178700e436aad1b70ccab0190438fa6911b2b9ef668594cf3c5ab36fbe7da7c21

                    • C:\Users\Admin\AppData\Local\Temp\F5C1.exe
                      Filesize

                      346KB

                      MD5

                      2012a6a9ac2ae06fe3a2caa92c67dc8b

                      SHA1

                      359f24688cafb5384efa2cd31d3abb7d1bc3e2ce

                      SHA256

                      36cc3881c0ea55a7e80c288c0e60ab6d6849abe814e581acaeb8d467bcb8358b

                      SHA512

                      75531bcbc504dce0b0b0b9368f65ec87b0103e39341ee1c337b2d7c6b9c5d70178700e436aad1b70ccab0190438fa6911b2b9ef668594cf3c5ab36fbe7da7c21

                    • C:\Users\Admin\AppData\Local\Temp\FE2E.exe
                      Filesize

                      2.6MB

                      MD5

                      30c9c5718ae5e894dca2283bc4506924

                      SHA1

                      98d366e2d2e3ba56caf9c6934d9538cf60a26971

                      SHA256

                      ac98964943f2bdb3d7b1874c8a64a3670c64e03ac87a18fcc2b0a9f33d56b0c0

                      SHA512

                      eaf44d6c02f6a1d55764f10ed4d129115f18ee8198de9dbe64ec960c1b25c2e363c0b868c2caaa92179d6639bb8c12f7cfc0c36f26d6a949904ec721f1ca500b

                    • C:\Users\Admin\AppData\Local\Temp\FE2E.exe
                      Filesize

                      2.6MB

                      MD5

                      30c9c5718ae5e894dca2283bc4506924

                      SHA1

                      98d366e2d2e3ba56caf9c6934d9538cf60a26971

                      SHA256

                      ac98964943f2bdb3d7b1874c8a64a3670c64e03ac87a18fcc2b0a9f33d56b0c0

                      SHA512

                      eaf44d6c02f6a1d55764f10ed4d129115f18ee8198de9dbe64ec960c1b25c2e363c0b868c2caaa92179d6639bb8c12f7cfc0c36f26d6a949904ec721f1ca500b

                    • memory/4000-137-0x0000000000000000-mapping.dmp
                    • memory/4000-210-0x0000000001000000-0x0000000001022000-memory.dmp
                      Filesize

                      136KB

                    • memory/4000-192-0x0000000000DC0000-0x0000000000DE7000-memory.dmp
                      Filesize

                      156KB

                    • memory/4000-190-0x0000000000000000-mapping.dmp
                    • memory/4000-191-0x0000000001000000-0x0000000001022000-memory.dmp
                      Filesize

                      136KB

                    • memory/4208-136-0x0000000000400000-0x000000000057E000-memory.dmp
                      Filesize

                      1.5MB

                    • memory/4208-135-0x0000000000400000-0x000000000057E000-memory.dmp
                      Filesize

                      1.5MB

                    • memory/4208-133-0x00000000005D8000-0x00000000005E9000-memory.dmp
                      Filesize

                      68KB

                    • memory/4208-134-0x00000000022B0000-0x00000000022B9000-memory.dmp
                      Filesize

                      36KB

                    • memory/55188-168-0x0000000000000000-mapping.dmp
                    • memory/55188-171-0x0000000000C80000-0x0000000000C87000-memory.dmp
                      Filesize

                      28KB

                    • memory/55188-172-0x0000000000C70000-0x0000000000C7B000-memory.dmp
                      Filesize

                      44KB

                    • memory/55188-205-0x0000000000C80000-0x0000000000C87000-memory.dmp
                      Filesize

                      28KB

                    • memory/67320-206-0x0000000001240000-0x0000000001249000-memory.dmp
                      Filesize

                      36KB

                    • memory/67320-174-0x0000000001240000-0x0000000001249000-memory.dmp
                      Filesize

                      36KB

                    • memory/67320-175-0x0000000001230000-0x000000000123F000-memory.dmp
                      Filesize

                      60KB

                    • memory/67320-173-0x0000000000000000-mapping.dmp
                    • memory/102768-177-0x0000000000400000-0x0000000000428000-memory.dmp
                      Filesize

                      160KB

                    • memory/102768-176-0x0000000000000000-mapping.dmp
                    • memory/102812-182-0x0000000000000000-mapping.dmp
                    • memory/102812-185-0x0000000000AB0000-0x0000000000AB5000-memory.dmp
                      Filesize

                      20KB

                    • memory/102812-186-0x0000000000AA0000-0x0000000000AA9000-memory.dmp
                      Filesize

                      36KB

                    • memory/102812-208-0x0000000000AB0000-0x0000000000AB5000-memory.dmp
                      Filesize

                      20KB

                    • memory/102864-188-0x0000000000AA0000-0x0000000000AA6000-memory.dmp
                      Filesize

                      24KB

                    • memory/102864-189-0x0000000000A90000-0x0000000000A9C000-memory.dmp
                      Filesize

                      48KB

                    • memory/102864-187-0x0000000000000000-mapping.dmp
                    • memory/102864-209-0x0000000000AA0000-0x0000000000AA6000-memory.dmp
                      Filesize

                      24KB

                    • memory/102888-146-0x0000000005E70000-0x0000000006488000-memory.dmp
                      Filesize

                      6.1MB

                    • memory/102888-140-0x0000000000000000-mapping.dmp
                    • memory/102888-141-0x0000000000400000-0x0000000000428000-memory.dmp
                      Filesize

                      160KB

                    • memory/102888-147-0x00000000059F0000-0x0000000005AFA000-memory.dmp
                      Filesize

                      1.0MB

                    • memory/102888-148-0x0000000005920000-0x0000000005932000-memory.dmp
                      Filesize

                      72KB

                    • memory/102888-152-0x00000000059A0000-0x00000000059DC000-memory.dmp
                      Filesize

                      240KB

                    • memory/102952-155-0x0000000000720000-0x0000000000758000-memory.dmp
                      Filesize

                      224KB

                    • memory/102952-158-0x0000000005D50000-0x0000000005DB6000-memory.dmp
                      Filesize

                      408KB

                    • memory/102952-183-0x00000000007E9000-0x0000000000813000-memory.dmp
                      Filesize

                      168KB

                    • memory/102952-170-0x00000000067E0000-0x0000000006D0C000-memory.dmp
                      Filesize

                      5.2MB

                    • memory/102952-169-0x0000000006610000-0x00000000067D2000-memory.dmp
                      Filesize

                      1.8MB

                    • memory/102952-149-0x0000000000000000-mapping.dmp
                    • memory/102952-164-0x0000000006D70000-0x0000000006D8E000-memory.dmp
                      Filesize

                      120KB

                    • memory/102952-162-0x00000000072E0000-0x0000000007356000-memory.dmp
                      Filesize

                      472KB

                    • memory/102952-159-0x00000000065B0000-0x0000000006600000-memory.dmp
                      Filesize

                      320KB

                    • memory/102952-153-0x0000000004C60000-0x0000000005204000-memory.dmp
                      Filesize

                      5.6MB

                    • memory/102952-154-0x00000000007E9000-0x0000000000813000-memory.dmp
                      Filesize

                      168KB

                    • memory/102952-156-0x0000000000400000-0x000000000059A000-memory.dmp
                      Filesize

                      1.6MB

                    • memory/102952-157-0x0000000005CB0000-0x0000000005D42000-memory.dmp
                      Filesize

                      584KB

                    • memory/102952-184-0x0000000000400000-0x000000000059A000-memory.dmp
                      Filesize

                      1.6MB

                    • memory/102980-211-0x0000000001250000-0x0000000001255000-memory.dmp
                      Filesize

                      20KB

                    • memory/102980-193-0x0000000000000000-mapping.dmp
                    • memory/102980-194-0x0000000001250000-0x0000000001255000-memory.dmp
                      Filesize

                      20KB

                    • memory/102980-195-0x0000000001240000-0x0000000001249000-memory.dmp
                      Filesize

                      36KB

                    • memory/103020-196-0x0000000000000000-mapping.dmp
                    • memory/103020-198-0x00000000010D0000-0x00000000010DB000-memory.dmp
                      Filesize

                      44KB

                    • memory/103020-212-0x00000000010E0000-0x00000000010E6000-memory.dmp
                      Filesize

                      24KB

                    • memory/103020-197-0x00000000010E0000-0x00000000010E6000-memory.dmp
                      Filesize

                      24KB

                    • memory/103084-160-0x0000000000000000-mapping.dmp
                    • memory/103104-204-0x0000000000940000-0x000000000094B000-memory.dmp
                      Filesize

                      44KB

                    • memory/103104-203-0x0000000000950000-0x0000000000958000-memory.dmp
                      Filesize

                      32KB

                    • memory/103104-202-0x0000000000000000-mapping.dmp
                    • memory/103104-214-0x0000000000950000-0x0000000000958000-memory.dmp
                      Filesize

                      32KB

                    • memory/103132-201-0x0000000000700000-0x000000000070D000-memory.dmp
                      Filesize

                      52KB

                    • memory/103132-200-0x0000000000710000-0x0000000000717000-memory.dmp
                      Filesize

                      28KB

                    • memory/103132-199-0x0000000000000000-mapping.dmp
                    • memory/103132-213-0x0000000000710000-0x0000000000717000-memory.dmp
                      Filesize

                      28KB

                    • memory/103168-165-0x0000000000000000-mapping.dmp