Resubmissions
22-12-2022 00:38
221222-azdc8sdf64 804-11-2022 18:34
221104-w73hzsbgal 1004-11-2022 17:36
221104-v6p1tsbcbp 10Analysis
-
max time kernel
301s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04-11-2022 18:34
Static task
static1
Behavioral task
behavioral1
Sample
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
Resource
win10-20220812-en
Behavioral task
behavioral3
Sample
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
Resource
win10v2004-20220812-en
General
-
Target
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
-
Size
427KB
-
MD5
c34729173ecc820eb7674431597d78be
-
SHA1
884f343876a8bb0ebac63c28191c22c6f69590f8
-
SHA256
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0
-
SHA512
f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0
-
SSDEEP
3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
Detects Smokeloader packer 3 IoCs
Processes:
resource yara_rule behavioral3/memory/3904-163-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral3/memory/3904-165-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader behavioral3/memory/3904-166-0x0000000000400000-0x0000000000409000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral3/memory/3372-150-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 5 IoCs
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exeSETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exeHwqujbjwlyvggktrainingadministrator_s.exepid process 2176 SETUP_~1.EXE 2608 Hwqujbjwlyvggktrainingadministrator_s.exe 3372 SETUP_~1.EXE 2304 Hwqujbjwlyvggktrainingadministrator_s.exe 3904 Hwqujbjwlyvggktrainingadministrator_s.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SETUP_~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Hwqujbjwlyvggktrainingadministrator_s.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
SETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription pid process target process PID 2176 set thread context of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2608 set thread context of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
Hwqujbjwlyvggktrainingadministrator_s.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI Hwqujbjwlyvggktrainingadministrator_s.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
powershell.exepowershell.exeHwqujbjwlyvggktrainingadministrator_s.exeHwqujbjwlyvggktrainingadministrator_s.exepid process 3844 powershell.exe 3844 powershell.exe 2164 powershell.exe 2164 powershell.exe 2608 Hwqujbjwlyvggktrainingadministrator_s.exe 2608 Hwqujbjwlyvggktrainingadministrator_s.exe 3904 Hwqujbjwlyvggktrainingadministrator_s.exe 3904 Hwqujbjwlyvggktrainingadministrator_s.exe 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 2152 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2152 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Hwqujbjwlyvggktrainingadministrator_s.exepid process 3904 Hwqujbjwlyvggktrainingadministrator_s.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
SETUP_~1.EXEpowershell.exeHwqujbjwlyvggktrainingadministrator_s.exepowershell.exedescription pid process Token: SeDebugPrivilege 2176 SETUP_~1.EXE Token: SeDebugPrivilege 3844 powershell.exe Token: SeDebugPrivilege 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Token: SeDebugPrivilege 2164 powershell.exe Token: SeShutdownPrivilege 2152 Token: SeCreatePagefilePrivilege 2152 -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exeSETUP_~1.EXEHwqujbjwlyvggktrainingadministrator_s.exedescription pid process target process PID 4860 wrote to memory of 2176 4860 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe SETUP_~1.EXE PID 4860 wrote to memory of 2176 4860 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe SETUP_~1.EXE PID 4860 wrote to memory of 2176 4860 7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe SETUP_~1.EXE PID 2176 wrote to memory of 3844 2176 SETUP_~1.EXE powershell.exe PID 2176 wrote to memory of 3844 2176 SETUP_~1.EXE powershell.exe PID 2176 wrote to memory of 3844 2176 SETUP_~1.EXE powershell.exe PID 2176 wrote to memory of 2608 2176 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2176 wrote to memory of 2608 2176 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2176 wrote to memory of 2608 2176 SETUP_~1.EXE Hwqujbjwlyvggktrainingadministrator_s.exe PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2176 wrote to memory of 3372 2176 SETUP_~1.EXE SETUP_~1.EXE PID 2608 wrote to memory of 2164 2608 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 2608 wrote to memory of 2164 2608 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 2608 wrote to memory of 2164 2608 Hwqujbjwlyvggktrainingadministrator_s.exe powershell.exe PID 2608 wrote to memory of 2304 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 2304 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 2304 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe PID 2608 wrote to memory of 3904 2608 Hwqujbjwlyvggktrainingadministrator_s.exe Hwqujbjwlyvggktrainingadministrator_s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe"C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeC:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeC:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe4⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.logFilesize
1KB
MD54280e36a29fa31c01e4d8b2ba726a0d8
SHA1c485c2c9ce0a99747b18d899b71dfa9a64dabe32
SHA256e2486a1bdcba80dad6dd6210d7374bd70ae196a523c06ceda71370fd3ea78359
SHA512494fe5f0ade03669e5830bed93c964d69b86629440148d7b0881cf53203fd89443ebff9b4d1ee9d96244f62af6edede622d9eacba37f80f389a0d522e4ad4ea4
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5323da0dbe7c4bb4eb915d1a9536a3089
SHA1af2d192bc0f58853647bb54941d0a97dc53127fd
SHA2569437f33d54f13d3c3b6147e355d6ee3c62b8d87be1863f07742d54bccf69a907
SHA5123cf6e13fc48d67bab3c165bd3310537619d98d1c3b82a34fed4c09f480f88dd50d2740e0c00829bab2a8371e64e1c8ad7b92ee3c1c83d6e0f44d6bc92b68cb55
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exeFilesize
6KB
MD5d0b53e53092311bc055630adf3e4ccdc
SHA1bf66777607a1d968e3194fe047f9a0e03f249f28
SHA2560cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e
SHA51234ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD54786de75433835fdc9d3d08edf8116ca
SHA12c6843f4b1992eeb9215c4d582a94c4ceb7284f9
SHA256d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb
SHA512e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9
-
memory/2164-156-0x0000000000000000-mapping.dmp
-
memory/2176-136-0x0000000005C70000-0x0000000005C92000-memory.dmpFilesize
136KB
-
memory/2176-135-0x0000000000880000-0x0000000000892000-memory.dmpFilesize
72KB
-
memory/2176-132-0x0000000000000000-mapping.dmp
-
memory/2304-160-0x0000000000000000-mapping.dmp
-
memory/2608-149-0x00000000006B0000-0x00000000006B8000-memory.dmpFilesize
32KB
-
memory/2608-145-0x0000000000000000-mapping.dmp
-
memory/3372-155-0x00000000050C0000-0x00000000050FC000-memory.dmpFilesize
240KB
-
memory/3372-148-0x0000000000000000-mapping.dmp
-
memory/3372-150-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/3372-152-0x0000000005580000-0x0000000005B98000-memory.dmpFilesize
6.1MB
-
memory/3372-153-0x0000000005100000-0x000000000520A000-memory.dmpFilesize
1.0MB
-
memory/3372-154-0x0000000005030000-0x0000000005042000-memory.dmpFilesize
72KB
-
memory/3844-143-0x00000000076D0000-0x0000000007D4A000-memory.dmpFilesize
6.5MB
-
memory/3844-144-0x0000000006590000-0x00000000065AA000-memory.dmpFilesize
104KB
-
memory/3844-142-0x0000000006080000-0x000000000609E000-memory.dmpFilesize
120KB
-
memory/3844-141-0x0000000005A30000-0x0000000005A96000-memory.dmpFilesize
408KB
-
memory/3844-140-0x00000000059C0000-0x0000000005A26000-memory.dmpFilesize
408KB
-
memory/3844-139-0x0000000005320000-0x0000000005948000-memory.dmpFilesize
6.2MB
-
memory/3844-138-0x0000000000EC0000-0x0000000000EF6000-memory.dmpFilesize
216KB
-
memory/3844-137-0x0000000000000000-mapping.dmp
-
memory/3904-162-0x0000000000000000-mapping.dmp
-
memory/3904-163-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3904-165-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3904-166-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB