Analysis
-
max time kernel
150s -
max time network
143s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
27-09-2022 18:42
Static task
static1
Behavioral task
behavioral1
Sample
7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe
Resource
win10-20220812-en
General
-
Target
7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe
-
Size
329KB
-
MD5
71094c78bc75f1ad1df80aca84171853
-
SHA1
10aa220e30cd032cd473472363ecc2b3c811239f
-
SHA256
7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e
-
SHA512
8c59e3ff0ee41af8a1d6ceb19fbed0bcd3079b1a4b45d6c9e9db9a3ffb0a22f63fa27c60c212f9c2f6f64d6b6ce9dd80aca34cab27d474fe3643c91321561fa0
-
SSDEEP
6144:pyIKU06MvnMQfXb0/bfLB7WnigabwVfse:pyIC6MvnMQfg/bfVaiBe
Malware Config
Extracted
redline
insmix
jamesmillion2.xyz:9420
-
auth_value
f388a05524f756108c9e4b0f4c4bafb6
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1764-147-0x00000000001D0000-0x00000000001D9000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
11BE.exepid process 1952 11BE.exe -
Deletes itself 1 IoCs
Processes:
pid process 3020 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exepid process 1764 7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe 1764 7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 3020 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3020 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exepid process 1764 7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
11BE.exedescription pid process Token: SeDebugPrivilege 1952 11BE.exe Token: SeShutdownPrivilege 3020 Token: SeCreatePagefilePrivilege 3020 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
description pid process target process PID 3020 wrote to memory of 1952 3020 11BE.exe PID 3020 wrote to memory of 1952 3020 11BE.exe PID 3020 wrote to memory of 1952 3020 11BE.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe"C:\Users\Admin\AppData\Local\Temp\7b0902efeeb48cc377563c4a147a701d5c53840636b52d010cc1d9643eac7f0e.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\11BE.exeC:\Users\Admin\AppData\Local\Temp\11BE.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\11BE.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
C:\Users\Admin\AppData\Local\Temp\11BE.exeFilesize
304KB
MD515f1517f0ceaaf9b6c78cf7625510c07
SHA18aabce20aff43476586a1b69b0b761a7f39d1e7e
SHA256d0d47dec11c63b6fa1a2dcac89e5a7352220e371b728781de041bf42fa8965fb
SHA512931a79a6e0d38c9b59b03a68d31e3c8fdb2b51e5eeed1df45790eba38f516f767ed67d9edd10bef16d169dc253c81ba6afb5d52738761cc2fa84f601f86b3516
-
memory/1764-117-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-118-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-119-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-120-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-121-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-122-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-123-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-124-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-125-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-126-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-127-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-128-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-129-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-130-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-131-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-132-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-133-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-134-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-135-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-136-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-137-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-138-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-139-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-141-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-140-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-142-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-143-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-144-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-145-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-146-0x00000000006AC000-0x00000000006BD000-memory.dmpFilesize
68KB
-
memory/1764-148-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-147-0x00000000001D0000-0x00000000001D9000-memory.dmpFilesize
36KB
-
memory/1764-149-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-150-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/1764-151-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-152-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-153-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1764-154-0x00000000006AC000-0x00000000006BD000-memory.dmpFilesize
68KB
-
memory/1764-155-0x0000000000400000-0x0000000000492000-memory.dmpFilesize
584KB
-
memory/1952-156-0x0000000000000000-mapping.dmp
-
memory/1952-158-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-159-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-160-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-161-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-163-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-162-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-164-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-166-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-167-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-168-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-169-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-170-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-171-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-172-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-173-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-174-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-175-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-176-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-179-0x00000000021F0000-0x0000000002227000-memory.dmpFilesize
220KB
-
memory/1952-178-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-182-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-181-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-183-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-184-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-185-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-186-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-180-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-187-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-177-0x0000000000766000-0x0000000000790000-memory.dmpFilesize
168KB
-
memory/1952-188-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-190-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-189-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/1952-191-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/1952-202-0x0000000002390000-0x00000000023C0000-memory.dmpFilesize
192KB
-
memory/1952-207-0x0000000004D20000-0x000000000521E000-memory.dmpFilesize
5.0MB
-
memory/1952-209-0x0000000004C80000-0x0000000004CAE000-memory.dmpFilesize
184KB
-
memory/1952-220-0x0000000005220000-0x0000000005826000-memory.dmpFilesize
6.0MB
-
memory/1952-221-0x0000000005840000-0x0000000005852000-memory.dmpFilesize
72KB
-
memory/1952-222-0x0000000005870000-0x000000000597A000-memory.dmpFilesize
1.0MB
-
memory/1952-225-0x00000000059A0000-0x00000000059DE000-memory.dmpFilesize
248KB
-
memory/1952-233-0x0000000005B10000-0x0000000005B5B000-memory.dmpFilesize
300KB
-
memory/1952-242-0x0000000005CB0000-0x0000000005D42000-memory.dmpFilesize
584KB
-
memory/1952-244-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/1952-252-0x0000000000766000-0x0000000000790000-memory.dmpFilesize
168KB
-
memory/1952-253-0x00000000021F0000-0x0000000002227000-memory.dmpFilesize
220KB
-
memory/1952-254-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB
-
memory/1952-255-0x0000000006400000-0x0000000006450000-memory.dmpFilesize
320KB
-
memory/1952-256-0x0000000006470000-0x00000000064E6000-memory.dmpFilesize
472KB
-
memory/1952-260-0x00000000074B0000-0x00000000074CE000-memory.dmpFilesize
120KB
-
memory/1952-261-0x0000000006750000-0x0000000006912000-memory.dmpFilesize
1.8MB
-
memory/1952-262-0x0000000006930000-0x0000000006E5C000-memory.dmpFilesize
5.2MB
-
memory/1952-269-0x0000000000766000-0x0000000000790000-memory.dmpFilesize
168KB
-
memory/1952-270-0x0000000000400000-0x00000000005A5000-memory.dmpFilesize
1.6MB