Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
17-10-2022 00:44
Static task
static1
Behavioral task
behavioral1
Sample
b30d09ee47eafb236742ad7831adedb8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b30d09ee47eafb236742ad7831adedb8.exe
Resource
win10v2004-20220812-en
General
-
Target
b30d09ee47eafb236742ad7831adedb8.exe
-
Size
374KB
-
MD5
b30d09ee47eafb236742ad7831adedb8
-
SHA1
88339c398d0cc01f720f55499dd622ab6b29a561
-
SHA256
e00e158ba45b49cdfdca374f0f8f64a1df6c3b05f2034ac71ed0f3a1144f2ee2
-
SHA512
c4c0613e991242ab87cd0d312da42b67b1ef20ebbcebe08fd79aee5ac72b617a3fcb8a97c6cb7254205e6715642039ed557c99bb7637dac2104454b5a5b7f412
-
SSDEEP
1536:HI47GyTGCwiSnmQUt0LB1c5s5gvubJueyupHgz:HvGyYiSDnt1cW54u9lx1W
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral2/memory/3484-170-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3484-172-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral2/memory/3484-173-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/744-150-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 5 IoCs
Processes:
SETUP_~1.EXERevtlsvokenlxncqyejbesttechnology_s.exeSETUP_~1.EXERevtlsvokenlxncqyejbesttechnology_s.exeRevtlsvokenlxncqyejbesttechnology_s.exepid process 4320 SETUP_~1.EXE 1572 Revtlsvokenlxncqyejbesttechnology_s.exe 744 SETUP_~1.EXE 4488 Revtlsvokenlxncqyejbesttechnology_s.exe 3484 Revtlsvokenlxncqyejbesttechnology_s.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SETUP_~1.EXERevtlsvokenlxncqyejbesttechnology_s.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SETUP_~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Revtlsvokenlxncqyejbesttechnology_s.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b30d09ee47eafb236742ad7831adedb8.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce b30d09ee47eafb236742ad7831adedb8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" b30d09ee47eafb236742ad7831adedb8.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
SETUP_~1.EXERevtlsvokenlxncqyejbesttechnology_s.exedescription pid process target process PID 4320 set thread context of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 1572 set thread context of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Revtlsvokenlxncqyejbesttechnology_s.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Revtlsvokenlxncqyejbesttechnology_s.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Revtlsvokenlxncqyejbesttechnology_s.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Revtlsvokenlxncqyejbesttechnology_s.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeSETUP_~1.EXERevtlsvokenlxncqyejbesttechnology_s.exeRevtlsvokenlxncqyejbesttechnology_s.exepid process 2044 powershell.exe 2044 powershell.exe 2300 powershell.exe 2300 powershell.exe 744 SETUP_~1.EXE 744 SETUP_~1.EXE 1572 Revtlsvokenlxncqyejbesttechnology_s.exe 1572 Revtlsvokenlxncqyejbesttechnology_s.exe 3484 Revtlsvokenlxncqyejbesttechnology_s.exe 3484 Revtlsvokenlxncqyejbesttechnology_s.exe 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 2616 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Revtlsvokenlxncqyejbesttechnology_s.exepid process 3484 Revtlsvokenlxncqyejbesttechnology_s.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SETUP_~1.EXEpowershell.exeRevtlsvokenlxncqyejbesttechnology_s.exepowershell.exeSETUP_~1.EXEdescription pid process Token: SeDebugPrivilege 4320 SETUP_~1.EXE Token: SeDebugPrivilege 2044 powershell.exe Token: SeDebugPrivilege 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Token: SeDebugPrivilege 2300 powershell.exe Token: SeDebugPrivilege 744 SETUP_~1.EXE -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
b30d09ee47eafb236742ad7831adedb8.exeSETUP_~1.EXERevtlsvokenlxncqyejbesttechnology_s.exedescription pid process target process PID 5080 wrote to memory of 4320 5080 b30d09ee47eafb236742ad7831adedb8.exe SETUP_~1.EXE PID 5080 wrote to memory of 4320 5080 b30d09ee47eafb236742ad7831adedb8.exe SETUP_~1.EXE PID 5080 wrote to memory of 4320 5080 b30d09ee47eafb236742ad7831adedb8.exe SETUP_~1.EXE PID 4320 wrote to memory of 2044 4320 SETUP_~1.EXE powershell.exe PID 4320 wrote to memory of 2044 4320 SETUP_~1.EXE powershell.exe PID 4320 wrote to memory of 2044 4320 SETUP_~1.EXE powershell.exe PID 4320 wrote to memory of 1572 4320 SETUP_~1.EXE Revtlsvokenlxncqyejbesttechnology_s.exe PID 4320 wrote to memory of 1572 4320 SETUP_~1.EXE Revtlsvokenlxncqyejbesttechnology_s.exe PID 4320 wrote to memory of 1572 4320 SETUP_~1.EXE Revtlsvokenlxncqyejbesttechnology_s.exe PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 4320 wrote to memory of 744 4320 SETUP_~1.EXE SETUP_~1.EXE PID 1572 wrote to memory of 2300 1572 Revtlsvokenlxncqyejbesttechnology_s.exe powershell.exe PID 1572 wrote to memory of 2300 1572 Revtlsvokenlxncqyejbesttechnology_s.exe powershell.exe PID 1572 wrote to memory of 2300 1572 Revtlsvokenlxncqyejbesttechnology_s.exe powershell.exe PID 1572 wrote to memory of 4488 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 4488 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 4488 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe PID 1572 wrote to memory of 3484 1572 Revtlsvokenlxncqyejbesttechnology_s.exe Revtlsvokenlxncqyejbesttechnology_s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b30d09ee47eafb236742ad7831adedb8.exe"C:\Users\Admin\AppData\Local\Temp\b30d09ee47eafb236742ad7831adedb8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA2AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exe"C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA2AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exeC:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exeC:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD56c0b439430882c4ad85721a770a41e17
SHA1687cf6bc732acca04f55be637f88573321b01143
SHA256fff42483b9663938f568e1c5a3fad84a762b58bf71827af976aceec3f77a1ac1
SHA512273a57870367a617738dd4a0392d2200e0e583bb8d766ee5792ca09f379489bab555d3a4c5c4350857f2b8fcd90ba8afb3d8801d3f25fbd2b1d6a531a376ad5e
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5d620f827d3dda5c71e569b06aaec7768
SHA1386a70eaec19e8bf23bbd6d73c0abb6535cf57c6
SHA25631a172f868fff8093463d08364ac1b4135416d6e2eb6c24fc9cf4677416ba411
SHA51234f81f0e8e6a3f32b98b1b61fcfaa889c41dabcfda0a1c1d81583d9feea7d74e69f75cc8bbf9f2b23e892f9d49785ae34e7777b7734f01ca5974b1739489ddf3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5d620f827d3dda5c71e569b06aaec7768
SHA1386a70eaec19e8bf23bbd6d73c0abb6535cf57c6
SHA25631a172f868fff8093463d08364ac1b4135416d6e2eb6c24fc9cf4677416ba411
SHA51234f81f0e8e6a3f32b98b1b61fcfaa889c41dabcfda0a1c1d81583d9feea7d74e69f75cc8bbf9f2b23e892f9d49785ae34e7777b7734f01ca5974b1739489ddf3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5d620f827d3dda5c71e569b06aaec7768
SHA1386a70eaec19e8bf23bbd6d73c0abb6535cf57c6
SHA25631a172f868fff8093463d08364ac1b4135416d6e2eb6c24fc9cf4677416ba411
SHA51234f81f0e8e6a3f32b98b1b61fcfaa889c41dabcfda0a1c1d81583d9feea7d74e69f75cc8bbf9f2b23e892f9d49785ae34e7777b7734f01ca5974b1739489ddf3
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exeFilesize
6KB
MD5864bd33dae22fb16bcfb7f6aa68fba71
SHA174e22f9a8b7ebc6686c3657198ad57a150a257ae
SHA256ecc055fa4966adfa0c1636e556ca4fc564b7db9f10681c7914428aca5886c96e
SHA512840b6dad4295f27e39279074efe78ae93d58393d1629de056ce305f3ced9122a78c7186f3f13b17a2c035a3ac60c0845d8ac2c32579cae02134b7ed0e6ff4011
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exeFilesize
6KB
MD5864bd33dae22fb16bcfb7f6aa68fba71
SHA174e22f9a8b7ebc6686c3657198ad57a150a257ae
SHA256ecc055fa4966adfa0c1636e556ca4fc564b7db9f10681c7914428aca5886c96e
SHA512840b6dad4295f27e39279074efe78ae93d58393d1629de056ce305f3ced9122a78c7186f3f13b17a2c035a3ac60c0845d8ac2c32579cae02134b7ed0e6ff4011
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exeFilesize
6KB
MD5864bd33dae22fb16bcfb7f6aa68fba71
SHA174e22f9a8b7ebc6686c3657198ad57a150a257ae
SHA256ecc055fa4966adfa0c1636e556ca4fc564b7db9f10681c7914428aca5886c96e
SHA512840b6dad4295f27e39279074efe78ae93d58393d1629de056ce305f3ced9122a78c7186f3f13b17a2c035a3ac60c0845d8ac2c32579cae02134b7ed0e6ff4011
-
C:\Users\Admin\AppData\Local\Temp\Revtlsvokenlxncqyejbesttechnology_s.exeFilesize
6KB
MD5864bd33dae22fb16bcfb7f6aa68fba71
SHA174e22f9a8b7ebc6686c3657198ad57a150a257ae
SHA256ecc055fa4966adfa0c1636e556ca4fc564b7db9f10681c7914428aca5886c96e
SHA512840b6dad4295f27e39279074efe78ae93d58393d1629de056ce305f3ced9122a78c7186f3f13b17a2c035a3ac60c0845d8ac2c32579cae02134b7ed0e6ff4011
-
memory/744-162-0x0000000006E60000-0x0000000007404000-memory.dmpFilesize
5.6MB
-
memory/744-150-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/744-156-0x0000000005540000-0x000000000557C000-memory.dmpFilesize
240KB
-
memory/744-166-0x0000000007B10000-0x000000000803C000-memory.dmpFilesize
5.2MB
-
memory/744-165-0x0000000007410000-0x00000000075D2000-memory.dmpFilesize
1.8MB
-
memory/744-155-0x0000000005360000-0x0000000005372000-memory.dmpFilesize
72KB
-
memory/744-149-0x0000000000000000-mapping.dmp
-
memory/744-161-0x0000000006810000-0x00000000068A2000-memory.dmpFilesize
584KB
-
memory/744-164-0x0000000006BB0000-0x0000000006C00000-memory.dmpFilesize
320KB
-
memory/744-163-0x0000000006B30000-0x0000000006BA6000-memory.dmpFilesize
472KB
-
memory/744-153-0x00000000058B0000-0x0000000005EC8000-memory.dmpFilesize
6.1MB
-
memory/744-154-0x0000000005430000-0x000000000553A000-memory.dmpFilesize
1.0MB
-
memory/1572-148-0x0000000000D20000-0x0000000000D28000-memory.dmpFilesize
32KB
-
memory/1572-145-0x0000000000000000-mapping.dmp
-
memory/2044-141-0x0000000005E30000-0x0000000005E96000-memory.dmpFilesize
408KB
-
memory/2044-143-0x0000000007AB0000-0x000000000812A000-memory.dmpFilesize
6.5MB
-
memory/2044-138-0x0000000002ED0000-0x0000000002F06000-memory.dmpFilesize
216KB
-
memory/2044-137-0x0000000000000000-mapping.dmp
-
memory/2044-139-0x0000000005620000-0x0000000005C48000-memory.dmpFilesize
6.2MB
-
memory/2044-140-0x0000000005DC0000-0x0000000005E26000-memory.dmpFilesize
408KB
-
memory/2044-144-0x0000000006980000-0x000000000699A000-memory.dmpFilesize
104KB
-
memory/2044-142-0x0000000006480000-0x000000000649E000-memory.dmpFilesize
120KB
-
memory/2300-157-0x0000000000000000-mapping.dmp
-
memory/3484-170-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3484-169-0x0000000000000000-mapping.dmp
-
memory/3484-172-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3484-173-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/4320-136-0x0000000005B20000-0x0000000005B42000-memory.dmpFilesize
136KB
-
memory/4320-132-0x0000000000000000-mapping.dmp
-
memory/4320-135-0x0000000000420000-0x0000000000428000-memory.dmpFilesize
32KB
-
memory/4488-167-0x0000000000000000-mapping.dmp