Analysis
- max time kernel
152s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
14/11/2022, 07:01
General
- Target 98d10b62db545e1265acd1e02042f366.exe
- Size 154KB
- Sample221114-hs782aae7z
- SHA256 8bdb4f4788feb9f22e0f2f76e856a835f5a22baf24a8f8e4e36ef965a23f040c
Malware Config
Extracted
-
redline
-
rozena1113
-
jalocliche.xyz:81
-
chardhesha.xyz:81
-
auth_value
a670b3d452a168677a236f3679080dea
Signatures
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- UPX packed file 6 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- GoLang User-Agent 1 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 53 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98d10b62db545e1265acd1e02042f366.exe"C:\Users\Admin\AppData\Local\Temp\98d10b62db545e1265acd1e02042f366.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\55F0.exeC:\Users\Admin\AppData\Local\Temp\55F0.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1888 -s 19202⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\5B40.exeC:\Users\Admin\AppData\Local\Temp\5B40.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\5E9D.exeC:\Users\Admin\AppData\Local\Temp\5E9D.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 372 -p 1888 -ip 18881⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
55F0.exe
55F0.exe
5B40.exe
5B40.exe
5E9D.exe
5E9D.exe
memory/1352-173-0x0000000000620000-0x0000000000629000-memory.dmp
memory/1352-172-0x0000000000630000-0x0000000000635000-memory.dmp
memory/1352-201-0x0000000000630000-0x0000000000635000-memory.dmp
memory/1888-203-0x0000000000919000-0x000000000094A000-memory.dmp
memory/1888-149-0x0000000004E50000-0x00000000053F4000-memory.dmp
memory/1888-144-0x0000000000820000-0x000000000085E000-memory.dmp
memory/1888-145-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/1888-187-0x0000000000919000-0x000000000094A000-memory.dmp
memory/1888-186-0x0000000005E80000-0x0000000005EE6000-memory.dmp
memory/1888-158-0x00000000055E0000-0x0000000005BF8000-memory.dmp
memory/1888-143-0x0000000000919000-0x000000000094A000-memory.dmp
memory/1888-164-0x0000000005560000-0x000000000559C000-memory.dmp
memory/1888-152-0x0000000004D30000-0x0000000004DC2000-memory.dmp
memory/1888-198-0x0000000007520000-0x00000000076E2000-memory.dmp
memory/1888-200-0x00000000076F0000-0x0000000007C1C000-memory.dmp
memory/1888-161-0x0000000005540000-0x0000000005552000-memory.dmp
memory/1888-204-0x0000000000400000-0x00000000005A8000-memory.dmp
memory/1888-159-0x0000000005410000-0x000000000551A000-memory.dmp
memory/2336-197-0x0000000000510000-0x0000000000516000-memory.dmp
memory/2336-166-0x0000000000510000-0x0000000000516000-memory.dmp
memory/2336-167-0x0000000000500000-0x000000000050C000-memory.dmp
memory/2440-176-0x0000000000160000-0x000000000016B000-memory.dmp
memory/2440-202-0x0000000000170000-0x0000000000176000-memory.dmp
memory/2440-175-0x0000000000170000-0x0000000000176000-memory.dmp
memory/2592-193-0x0000000000E80000-0x0000000000E87000-memory.dmp
memory/2592-154-0x0000000000E80000-0x0000000000E87000-memory.dmp
memory/2592-155-0x0000000000E70000-0x0000000000E7B000-memory.dmp
memory/2832-179-0x00000000012C0000-0x00000000012CD000-memory.dmp
memory/2832-178-0x00000000012D0000-0x00000000012D7000-memory.dmp
memory/3148-205-0x0000000000860000-0x0000000000868000-memory.dmp
memory/3148-184-0x0000000000850000-0x000000000085B000-memory.dmp
memory/3148-183-0x0000000000860000-0x0000000000868000-memory.dmp
memory/4136-191-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4136-189-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4220-206-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/4220-212-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/4220-209-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/4220-210-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/4220-211-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/4220-208-0x0000000000400000-0x0000000000BEB000-memory.dmp
memory/4464-194-0x0000000000540000-0x0000000000549000-memory.dmp
memory/4464-156-0x0000000000540000-0x0000000000549000-memory.dmp
memory/4464-157-0x0000000000530000-0x000000000053F000-memory.dmp
memory/4624-195-0x0000000003277000-0x0000000003370000-memory.dmp
memory/4624-192-0x0000000002D71000-0x0000000003267000-memory.dmp
memory/4624-185-0x000000000E3A0000-0x000000000E4F6000-memory.dmp
memory/4624-180-0x0000000003277000-0x0000000003370000-memory.dmp
memory/4624-151-0x0000000002D71000-0x0000000003267000-memory.dmp
memory/4624-182-0x000000000E3A0000-0x000000000E4F6000-memory.dmp
memory/4648-196-0x0000000000F60000-0x0000000000F65000-memory.dmp
memory/4648-163-0x0000000000F50000-0x0000000000F59000-memory.dmp
memory/4648-162-0x0000000000F60000-0x0000000000F65000-memory.dmp
memory/4756-169-0x00000000012D0000-0x00000000012F2000-memory.dmp
memory/4756-199-0x00000000012D0000-0x00000000012F2000-memory.dmp
memory/4756-170-0x00000000012A0000-0x00000000012C7000-memory.dmp
memory/4820-132-0x0000000000888000-0x0000000000899000-memory.dmp
memory/4820-136-0x0000000000400000-0x000000000058C000-memory.dmp
memory/4820-135-0x0000000000888000-0x0000000000899000-memory.dmp
memory/4820-134-0x0000000000400000-0x000000000058C000-memory.dmp
memory/4820-133-0x0000000000820000-0x0000000000829000-memory.dmp