Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
23/11/2022, 02:07
General
- Target file.exe
- Size 307KB
- Sample221123-cjzmmsgc77
- SHA256 8a501ac8fcf5efaec2c9b4bcba98ac7273e238fac42a0a2d24ad7323a989d1f3
Malware Config
Extracted
-
redline
-
185.215.113.83:60722
-
auth_value
674feb1d15af397f9322eb62587035b3
Signatures
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Uses the VBS compiler for execution 1 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 13 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5B79.exeC:\Users\Admin\AppData\Local\Temp\5B79.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4688 -s 3722⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 192 -p 4688 -ip 46881⤵
-
C:\Users\Admin\AppData\Local\Temp\634A.exeC:\Users\Admin\AppData\Local\Temp\634A.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
5B79.exe
5B79.exe
634A.exe
634A.exe
memory/1116-133-0x00000000005B0000-0x00000000005B9000-memory.dmp
memory/1116-134-0x0000000000400000-0x0000000000453000-memory.dmp
memory/1116-135-0x0000000000400000-0x0000000000453000-memory.dmp
memory/1116-132-0x000000000064C000-0x0000000000661000-memory.dmp
memory/4160-152-0x00000000055F0000-0x000000000562C000-memory.dmp
memory/4160-167-0x0000000007E10000-0x0000000007FD2000-memory.dmp
memory/4160-140-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4160-161-0x0000000005910000-0x0000000005986000-memory.dmp
memory/4160-149-0x0000000005B50000-0x0000000006168000-memory.dmp
memory/4160-150-0x0000000005570000-0x0000000005582000-memory.dmp
memory/4160-151-0x00000000056A0000-0x00000000057AA000-memory.dmp
memory/4160-168-0x0000000008510000-0x0000000008A3C000-memory.dmp
memory/4160-162-0x0000000005AF0000-0x0000000005B0E000-memory.dmp
memory/4160-164-0x0000000007AF0000-0x0000000007B40000-memory.dmp
memory/4224-148-0x0000000000650000-0x0000000000658000-memory.dmp
memory/4224-155-0x0000000005E80000-0x0000000005EA2000-memory.dmp
memory/4224-154-0x0000000006400000-0x00000000069A4000-memory.dmp
memory/4224-153-0x0000000005DB0000-0x0000000005E42000-memory.dmp
memory/4308-157-0x0000000004F10000-0x0000000004F46000-memory.dmp
memory/4308-160-0x0000000005E90000-0x0000000005EF6000-memory.dmp
memory/4308-159-0x0000000005E20000-0x0000000005E86000-memory.dmp
memory/4308-163-0x00000000064D0000-0x00000000064EE000-memory.dmp
memory/4308-158-0x0000000005680000-0x0000000005CA8000-memory.dmp
memory/4308-165-0x0000000007B40000-0x00000000081BA000-memory.dmp
memory/4308-166-0x00000000069B0000-0x00000000069CA000-memory.dmp