Analysis
- max time kernel
151s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
13/10/2022, 11:54
General
- Target 0055086d95839dc87dbec1bbc15c0351.exe
- Size 231KB
- Sample221013-n2vxysdae2
- SHA256 e7dffaab7ae3daae4f456ba1c93b9fd841de3c7d3dd061d1bd27a6e0e2bcf35a
Malware Config
Extracted
-
redline
-
volka
-
89.208.106.66:4691
-
auth_value
55e3d2ed624d802226951cc2788e8bbe
Signatures
- Detects Smokeloader packer 3 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Executes dropped EXE 4 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 26 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0055086d95839dc87dbec1bbc15c0351.exe"C:\Users\Admin\AppData\Local\Temp\0055086d95839dc87dbec1bbc15c0351.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Mkjpqtideianxjkdmpuududsimplecommon_s.exe"C:\Users\Admin\AppData\Local\Temp\Mkjpqtideianxjkdmpuududsimplecommon_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Mkjpqtideianxjkdmpuududsimplecommon_s.exeC:\Users\Admin\AppData\Local\Temp\Mkjpqtideianxjkdmpuududsimplecommon_s.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
SETUP_~1.EXE.log
powershell.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
SETUP_~1.EXE
SETUP_~1.EXE
SETUP_~1.EXE
Mkjpqtideianxjkdmpuududsimplecommon_s.exe
Mkjpqtideianxjkdmpuududsimplecommon_s.exe
Mkjpqtideianxjkdmpuududsimplecommon_s.exe
memory/2816-169-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2816-171-0x0000000000400000-0x0000000000409000-memory.dmp
memory/2816-172-0x0000000000400000-0x0000000000409000-memory.dmp
memory/3568-154-0x0000000000950000-0x000000000096E000-memory.dmp
memory/3836-142-0x00000000050E0000-0x0000000005708000-memory.dmp
memory/3836-144-0x0000000004FB0000-0x0000000005016000-memory.dmp
memory/3836-141-0x00000000027B0000-0x00000000027E6000-memory.dmp
memory/3836-143-0x0000000004F40000-0x0000000004FA6000-memory.dmp
memory/3836-146-0x0000000007590000-0x0000000007C0A000-memory.dmp
memory/3836-145-0x0000000005D60000-0x0000000005D7E000-memory.dmp
memory/3836-147-0x0000000006260000-0x000000000627A000-memory.dmp
memory/3876-138-0x0000000005230000-0x000000000523A000-memory.dmp
memory/3876-139-0x0000000008040000-0x0000000008062000-memory.dmp
memory/3876-137-0x00000000050A0000-0x0000000005132000-memory.dmp
memory/3876-136-0x0000000005570000-0x0000000005B14000-memory.dmp
memory/3876-135-0x00000000006E0000-0x00000000006EC000-memory.dmp
memory/4660-155-0x00000000055A0000-0x0000000005BB8000-memory.dmp
memory/4660-164-0x0000000005FC0000-0x0000000006010000-memory.dmp
memory/4660-165-0x00000000068F0000-0x0000000006AB2000-memory.dmp
memory/4660-166-0x0000000006FF0000-0x000000000751C000-memory.dmp
memory/4660-163-0x0000000005F40000-0x0000000005FB6000-memory.dmp
memory/4660-158-0x0000000004F80000-0x0000000004FBC000-memory.dmp
memory/4660-157-0x0000000002AC0000-0x0000000002AD2000-memory.dmp
memory/4660-156-0x0000000005090000-0x000000000519A000-memory.dmp
memory/4660-152-0x0000000000400000-0x0000000000428000-memory.dmp