Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
27-09-2022 16:52
Static task
static1
General
-
Target
8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe
-
Size
329KB
-
MD5
3760371240026648da3a426888ec2767
-
SHA1
dfedf2d331df88103ea9449f00927322ad523710
-
SHA256
8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491
-
SHA512
7748eff2c69a414b8e70979afdf3a342a6bab799bdafae7481cade210111baa29bfa7e36499c793c7a279dc9e800215c37f88e6a3ead51f9a50d284419774962
-
SSDEEP
6144:NYn7gjbhe56QIAwkGCCImLd0RTcnigabwVfs:NYn7gBe5jxwk+imiB
Malware Config
Extracted
danabot
-
embedded_hash
6618C163D57D6441FCCA65D86C4D380D
-
type
loader
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Extracted
systembc
141.98.82.229:4001
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/344-154-0x00000000001E0000-0x00000000001E9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 4 IoCs
Processes:
3B24.exeAE42.exeEE2B.exenhabvr.exepid process 4616 3B24.exe 4608 AE42.exe 4892 EE2B.exe 384 nhabvr.exe -
Deletes itself 1 IoCs
Processes:
pid process 3068 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
EE2B.exedescription ioc process File created C:\Windows\Tasks\nhabvr.job EE2B.exe File opened for modification C:\Windows\Tasks\nhabvr.job EE2B.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exepid process 344 8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe 344 8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 3068 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3068 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exepid process 344 8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
AE42.exedescription pid process Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeDebugPrivilege 4608 AE42.exe Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 Token: SeShutdownPrivilege 3068 Token: SeCreatePagefilePrivilege 3068 -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
3B24.exedescription pid process target process PID 3068 wrote to memory of 4616 3068 3B24.exe PID 3068 wrote to memory of 4616 3068 3B24.exe PID 3068 wrote to memory of 4616 3068 3B24.exe PID 4616 wrote to memory of 4040 4616 3B24.exe appidtel.exe PID 4616 wrote to memory of 4040 4616 3B24.exe appidtel.exe PID 4616 wrote to memory of 4040 4616 3B24.exe appidtel.exe PID 3068 wrote to memory of 4608 3068 AE42.exe PID 3068 wrote to memory of 4608 3068 AE42.exe PID 3068 wrote to memory of 4608 3068 AE42.exe PID 3068 wrote to memory of 4892 3068 EE2B.exe PID 3068 wrote to memory of 4892 3068 EE2B.exe PID 3068 wrote to memory of 4892 3068 EE2B.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe"C:\Users\Admin\AppData\Local\Temp\8e515af7458e5ba4c811105fd16aa55a7b2d4746d8d6455d4de171e1bcb4f491.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3B24.exeC:\Users\Admin\AppData\Local\Temp\3B24.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\appidtel.exeC:\Windows\system32\appidtel.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\AE42.exeC:\Users\Admin\AppData\Local\Temp\AE42.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\EE2B.exeC:\Users\Admin\AppData\Local\Temp\EE2B.exe1⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\ProgramData\meqjpxb\nhabvr.exeC:\ProgramData\meqjpxb\nhabvr.exe start1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\meqjpxb\nhabvr.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\ProgramData\meqjpxb\nhabvr.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\Users\Admin\AppData\Local\Temp\3B24.exeFilesize
1.4MB
MD5fc33cf03d61eaeff9d0556d2bede67f0
SHA121170d09ff52a09b127341db22a195015d9b517d
SHA2560b138f03a0188e07a25495c5be7f5794c7f66ee121960019ded8264bc41b9a10
SHA5128bcfa32d5291244d1b7e490d8dc0b34436476206c62eb7d3f234228df42ad11612534cea5946c107ac631fffa10e14ec3f8d2cf87ef425c95b187043a58eafb3
-
C:\Users\Admin\AppData\Local\Temp\3B24.exeFilesize
1.4MB
MD5fc33cf03d61eaeff9d0556d2bede67f0
SHA121170d09ff52a09b127341db22a195015d9b517d
SHA2560b138f03a0188e07a25495c5be7f5794c7f66ee121960019ded8264bc41b9a10
SHA5128bcfa32d5291244d1b7e490d8dc0b34436476206c62eb7d3f234228df42ad11612534cea5946c107ac631fffa10e14ec3f8d2cf87ef425c95b187043a58eafb3
-
C:\Users\Admin\AppData\Local\Temp\AE42.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\AE42.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\EE2B.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
C:\Users\Admin\AppData\Local\Temp\EE2B.exeFilesize
329KB
MD55a97df322aaa1061de7186b345a03a85
SHA11aa1df1b086e92c4d29435de5ec20897e531f862
SHA256ecc6272c6638604a841838537580c6f935c0701f0ada36a1ebf056b7b262cbb9
SHA51222e36053ff0a2866295dda8be6bbaf912c55f882d54aab98e1b17712ceaa860f8f5ad8a1458fb89a3465c09cbbea37123d9d4cb6b09239f981debba866b08e13
-
memory/344-146-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-151-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-130-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-131-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-132-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-134-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-133-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-135-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-136-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-137-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-138-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-139-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-140-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-141-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-142-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-144-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-143-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-145-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-128-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-147-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-148-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-149-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-150-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-129-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-152-0x000000000067C000-0x000000000068D000-memory.dmpFilesize
68KB
-
memory/344-153-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-154-0x00000000001E0000-0x00000000001E9000-memory.dmpFilesize
36KB
-
memory/344-156-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/344-155-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-157-0x000000000067C000-0x000000000068D000-memory.dmpFilesize
68KB
-
memory/344-158-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/344-121-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-127-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-122-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-120-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-123-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-124-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-126-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/344-125-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/384-423-0x0000000000755000-0x0000000000765000-memory.dmpFilesize
64KB
-
memory/384-425-0x00000000004A0000-0x00000000005EA000-memory.dmpFilesize
1.3MB
-
memory/384-435-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/384-438-0x0000000000755000-0x0000000000765000-memory.dmpFilesize
64KB
-
memory/384-439-0x00000000004A0000-0x00000000005EA000-memory.dmpFilesize
1.3MB
-
memory/4040-195-0x0000000000000000-mapping.dmp
-
memory/4608-274-0x0000000005220000-0x0000000005826000-memory.dmpFilesize
6.0MB
-
memory/4608-323-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/4608-322-0x0000000000816000-0x0000000000840000-memory.dmpFilesize
168KB
-
memory/4608-317-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/4608-316-0x0000000000816000-0x0000000000840000-memory.dmpFilesize
168KB
-
memory/4608-310-0x00000000068B0000-0x0000000006DDC000-memory.dmpFilesize
5.2MB
-
memory/4608-309-0x00000000066D0000-0x0000000006892000-memory.dmpFilesize
1.8MB
-
memory/4608-308-0x0000000006680000-0x00000000066D0000-memory.dmpFilesize
320KB
-
memory/4608-307-0x00000000065D0000-0x00000000065EE000-memory.dmpFilesize
120KB
-
memory/4608-306-0x0000000006510000-0x0000000006586000-memory.dmpFilesize
472KB
-
memory/4608-298-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/4608-296-0x0000000005CB0000-0x0000000005D42000-memory.dmpFilesize
584KB
-
memory/4608-287-0x0000000005A10000-0x0000000005A5B000-memory.dmpFilesize
300KB
-
memory/4608-279-0x00000000059A0000-0x00000000059DE000-memory.dmpFilesize
248KB
-
memory/4608-276-0x0000000005870000-0x000000000597A000-memory.dmpFilesize
1.0MB
-
memory/4608-275-0x0000000005840000-0x0000000005852000-memory.dmpFilesize
72KB
-
memory/4608-263-0x0000000004C40000-0x0000000004C6E000-memory.dmpFilesize
184KB
-
memory/4608-261-0x0000000004D20000-0x000000000521E000-memory.dmpFilesize
5.0MB
-
memory/4608-256-0x0000000002420000-0x0000000002450000-memory.dmpFilesize
192KB
-
memory/4608-253-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/4608-252-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/4608-250-0x0000000000816000-0x0000000000840000-memory.dmpFilesize
168KB
-
memory/4608-210-0x0000000000000000-mapping.dmp
-
memory/4616-180-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-193-0x00000000023E0000-0x0000000002512000-memory.dmpFilesize
1.2MB
-
memory/4616-178-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-172-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-171-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-173-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-196-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4616-179-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-192-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-191-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-190-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-170-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-208-0x00000000023E0000-0x0000000002512000-memory.dmpFilesize
1.2MB
-
memory/4616-188-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-186-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-185-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-184-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-183-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-182-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-181-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-189-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-209-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4616-194-0x0000000002550000-0x000000000282B000-memory.dmpFilesize
2.9MB
-
memory/4616-177-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-176-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-174-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-175-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-159-0x0000000000000000-mapping.dmp
-
memory/4616-169-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-167-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-161-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-437-0x0000000000400000-0x00000000006E8000-memory.dmpFilesize
2.9MB
-
memory/4616-163-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-166-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-165-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-162-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4616-164-0x0000000077170000-0x00000000772FE000-memory.dmpFilesize
1.6MB
-
memory/4892-414-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/4892-383-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/4892-382-0x0000000000580000-0x0000000000589000-memory.dmpFilesize
36KB
-
memory/4892-381-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/4892-324-0x0000000000000000-mapping.dmp