Analysis
- max time kernel
150s - max time network
171s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
19/11/2022, 09:36
General
- Target ffb4cf34b38f126c917e1c1e1d26df73.exe
- Size 335KB
- Sample221119-lkxdcaab7v
- SHA256 4a47fdbb09dd09ea813c0475d32f693cbbded09b3753def43179f91e1a8f8a55
Malware Config
Extracted
-
redline
-
easy1018
-
chardhesha.xyz:81
-
jalocliche.xyz:81
-
auth_value
56edfa3741d7e2286e0bcfe901712a2c
Extracted
-
amadey
-
3.50
-
193.56.146.174/g84kvj4jck/index.php
Extracted
-
redline
-
KRIPT
-
212.8.246.157:32348
-
auth_value
80ebe4bab7a98a7ce9c75989ff9f40b4
Extracted
-
vidar
-
55.7
-
1148
-
https://t.me/deadftx
-
https://www.tiktok.com/@user6068972597711
-
profile_id
1148
Signatures
- Amadey
Amadey bot is a simple trojan bot primarily used for collecting reconnaissance information.
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Nirsoft 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 12 IoCs
- UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Uses the VBS compiler for execution 1 TTPs
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 4 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 13 IoCs
- Suspicious use of AdjustPrivilegeToken 57 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ffb4cf34b38f126c917e1c1e1d26df73.exe"C:\Users\Admin\AppData\Local\Temp\ffb4cf34b38f126c917e1c1e1d26df73.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\470.exeC:\Users\Admin\AppData\Local\Temp\470.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3652 -s 1402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 404 -p 3652 -ip 36521⤵
-
C:\Users\Admin\AppData\Local\Temp\631B.exeC:\Users\Admin\AppData\Local\Temp\631B.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2460 -s 14042⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\6658.exeC:\Users\Admin\AppData\Local\Temp\6658.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN rovwer.exe /TR "C:\Users\Admin\AppData\Local\Temp\99e342142d\rovwer.exe" /F3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "rovwer.exe" /P "Admin:N"&&CACLS "rovwer.exe" /P "Admin:R" /E&&echo Y|CACLS "..\99e342142d" /P "Admin:N"&&CACLS "..\99e342142d" /P "Admin:R" /E&&Exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:N"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "rovwer.exe" /P "Admin:R" /E4⤵
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:N"4⤵
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\99e342142d" /P "Admin:R" /E4⤵
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 772 -s 9082⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\6E39.exeC:\Users\Admin\AppData\Local\Temp\6E39.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\B.exe"C:\Users\Admin\AppData\Local\Temp\B.exe"3⤵
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 772 -ip 7721⤵
-
C:\Users\Admin\AppData\Local\Temp\7CD0.exeC:\Users\Admin\AppData\Local\Temp\7CD0.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\80C9.exeC:\Users\Admin\AppData\Local\Temp\80C9.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C cd "C:\Users\Admin\AppData\Roaming\PingboardCache" & argq.exe -o wpiq.zip3⤵
-
C:\Users\Admin\AppData\Roaming\PingboardCache\argq.exeargq.exe -o wpiq.zip4⤵
- Executes dropped EXE
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C systeminfo | findstr /C:"OS Name" > "C:\Users\Admin\AppData\Roaming\PingboardCache\fig"3⤵
-
C:\Windows\SysWOW64\systeminfo.exesysteminfo4⤵
- Gathers system information
-
-
C:\Windows\SysWOW64\findstr.exefindstr /C:"OS Name"4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C C:\Users\Admin\AppData\Roaming\PingboardCache\nircmdc.exe shortcut "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" PingboardCache3⤵
-
C:\Users\Admin\AppData\Roaming\PingboardCache\nircmdc.exeC:\Users\Admin\AppData\Roaming\PingboardCache\nircmdc.exe shortcut "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\" PingboardCache4⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C SCHTASKS /CREATE /SC MINUTE /TN "MyTasks\PingboardCache" /TR "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
-
C:\Windows\SysWOW64\schtasks.exeSCHTASKS /CREATE /SC MINUTE /TN "MyTasks\PingboardCache" /TR "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"4⤵
- Creates scheduled task(s)
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 5092 -s 2402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 5092 -ip 50921⤵
-
C:\Users\Admin\AppData\Local\Temp\8A20.exeC:\Users\Admin\AppData\Local\Temp\8A20.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping google.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping google.com3⤵
- Runs ping.exe
-
-
-
C:\Users\Admin\AppData\Local\Temp\8F13.exeC:\Users\Admin\AppData\Local\Temp\8F13.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\8F13.exe"C:\Users\Admin\AppData\Local\Temp\8F13.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\8F13.exe"C:\Users\Admin\AppData\Local\Temp\8F13.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\8F13.exe" & exit4⤵
-
C:\Windows\SysWOW64\timeout.exetimeout /t 65⤵
- Delays execution with timeout.exe
-
-
-
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 2460 -ip 24601⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
470.exe
470.exe
631B.exe
631B.exe
6658.exe
6658.exe
6E39.exe
6E39.exe
7CD0.exe
7CD0.exe
80C9.exe
80C9.exe
8A20.exe
8A20.exe
8F13.exe
8F13.exe
8F13.exe
8F13.exe
rovwer.exe
rovwer.exe
B.exe
B.exe
argq.exe
argq.exe
fig
nircmdc.exe
wpiq.zip
memory/332-277-0x00000000005F0000-0x00000000005F7000-memory.dmp
memory/332-302-0x00000000005F0000-0x00000000005F7000-memory.dmp
memory/332-278-0x00000000005E0000-0x00000000005ED000-memory.dmp
memory/772-242-0x0000000000510000-0x000000000051C000-memory.dmp
memory/772-170-0x0000000000A90000-0x0000000000ACE000-memory.dmp
memory/772-171-0x0000000000400000-0x0000000000861000-memory.dmp
memory/772-169-0x00000000009A3000-0x00000000009C2000-memory.dmp
memory/772-241-0x0000000000520000-0x0000000000526000-memory.dmp
memory/772-294-0x0000000000520000-0x0000000000526000-memory.dmp
memory/1592-177-0x0000000000400000-0x0000000000861000-memory.dmp
memory/1592-268-0x0000000000400000-0x0000000000861000-memory.dmp
memory/1592-176-0x0000000000B93000-0x0000000000BB2000-memory.dmp
memory/2016-288-0x0000000000B30000-0x0000000000B3B000-memory.dmp
memory/2016-303-0x0000000000B40000-0x0000000000B48000-memory.dmp
memory/2016-287-0x0000000000B40000-0x0000000000B48000-memory.dmp
memory/2024-285-0x0000000000400000-0x000000000041B000-memory.dmp
memory/2052-192-0x0000000000770000-0x00000000007B1000-memory.dmp
memory/2052-198-0x0000000000770000-0x00000000007B1000-memory.dmp
memory/2460-284-0x0000000000749000-0x000000000077A000-memory.dmp
memory/2460-160-0x0000000000749000-0x000000000077A000-memory.dmp
memory/2460-161-0x00000000021D0000-0x000000000220E000-memory.dmp
memory/2460-286-0x0000000000400000-0x00000000005AE000-memory.dmp
memory/2460-162-0x0000000000400000-0x00000000005AE000-memory.dmp
memory/2840-204-0x00000000054F0000-0x00000000054FA000-memory.dmp
memory/2840-202-0x00000000009F0000-0x0000000000A2E000-memory.dmp
memory/3392-209-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3392-207-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3392-272-0x0000000006E60000-0x0000000006ED6000-memory.dmp
memory/3392-275-0x0000000006EE0000-0x0000000006F30000-memory.dmp
memory/3480-154-0x0000000007130000-0x00000000076D4000-memory.dmp
memory/3480-147-0x0000000005290000-0x00000000052A2000-memory.dmp
memory/3480-145-0x0000000005830000-0x0000000005E48000-memory.dmp
memory/3480-153-0x0000000006AE0000-0x0000000006B72000-memory.dmp
memory/3480-157-0x0000000007C10000-0x000000000813C000-memory.dmp
memory/3480-146-0x0000000005360000-0x000000000546A000-memory.dmp
memory/3480-148-0x00000000052F0000-0x000000000532C000-memory.dmp
memory/3480-149-0x00000000068C0000-0x0000000006926000-memory.dmp
memory/3480-140-0x0000000000400000-0x0000000000428000-memory.dmp
memory/3480-155-0x0000000006EC0000-0x0000000007082000-memory.dmp
memory/3980-260-0x0000000000CB0000-0x0000000000CB9000-memory.dmp
memory/3980-299-0x0000000000CC0000-0x0000000000CC5000-memory.dmp
memory/4024-298-0x0000000000B80000-0x0000000000BA2000-memory.dmp
memory/4024-243-0x0000000000B50000-0x0000000000B77000-memory.dmp
memory/4024-258-0x0000000000B80000-0x0000000000BA2000-memory.dmp
memory/4064-237-0x0000000000C40000-0x0000000000C49000-memory.dmp
memory/4064-236-0x0000000000C50000-0x0000000000C55000-memory.dmp
memory/4064-293-0x0000000000C50000-0x0000000000C55000-memory.dmp
memory/4216-172-0x0000000002835000-0x0000000002CF6000-memory.dmp
memory/4216-185-0x0000000002389000-0x0000000002478000-memory.dmp
memory/4216-210-0x0000000002389000-0x0000000002478000-memory.dmp
memory/4216-189-0x0000000011330000-0x0000000011482000-memory.dmp
memory/4340-135-0x0000000000400000-0x0000000000857000-memory.dmp
memory/4340-132-0x00000000009D2000-0x00000000009E7000-memory.dmp
memory/4340-134-0x0000000000400000-0x0000000000857000-memory.dmp
memory/4340-133-0x0000000000030000-0x0000000000039000-memory.dmp
memory/4408-244-0x0000000061E00000-0x0000000061EF3000-memory.dmp
memory/4408-239-0x0000000000400000-0x000000000045F000-memory.dmp
memory/4408-235-0x0000000000400000-0x000000000045F000-memory.dmp
memory/4408-234-0x0000000000400000-0x000000000045F000-memory.dmp
memory/4408-232-0x0000000000400000-0x000000000045F000-memory.dmp
memory/4408-273-0x0000000000400000-0x000000000045F000-memory.dmp
memory/4420-291-0x0000000000440000-0x0000000000447000-memory.dmp
memory/4420-223-0x0000000000440000-0x0000000000447000-memory.dmp
memory/4420-224-0x0000000000430000-0x000000000043B000-memory.dmp
memory/4636-228-0x0000000001100000-0x0000000001109000-memory.dmp
memory/4636-229-0x00000000010F0000-0x00000000010FF000-memory.dmp
memory/4636-292-0x0000000001100000-0x0000000001109000-memory.dmp
memory/4664-270-0x0000000000CB0000-0x0000000000CBB000-memory.dmp
memory/4664-269-0x0000000000CC0000-0x0000000000CC6000-memory.dmp
memory/4664-300-0x0000000000CC0000-0x0000000000CC6000-memory.dmp
memory/5032-301-0x0000000002BC3000-0x00000000044B5000-memory.dmp
memory/5032-304-0x00000000044C0000-0x00000000049BB000-memory.dmp