Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 11:59
Static task
static1
Behavioral task
behavioral1
Sample
7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe
Resource
win10v2004-20220901-en
General
-
Target
7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe
-
Size
378KB
-
MD5
8b9827570321a0758ed35c59c0f23d76
-
SHA1
b9f0c0070b0502f0e532c5d336179b0622911448
-
SHA256
7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8
-
SHA512
0cff9065057c6bb545f89a8d761fd5a59a30964189693051202df725b341745a5bc6ab6f3d6c343e6205f4dc2f3d36ed6fefbdc523faf44c1329284382a1d61c
-
SSDEEP
6144:XV1yABL34ml/b2chs5prNl99wAnF2yigD10P0cBlwPMk:Xby8j4ml/ScuhJF2yzD1Y04l
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3256-133-0x0000000000030000-0x0000000000039000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
1F7E.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 1F7E.exe -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
1F7E.exe20F6.exeauwfawbpid process 4032 1F7E.exe 4340 20F6.exe 1352 auwfawb -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
1F7E.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 1F7E.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 1F7E.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\1F7E.exe themida C:\Users\Admin\AppData\Local\Temp\1F7E.exe themida behavioral1/memory/4032-145-0x0000000000D30000-0x0000000001230000-memory.dmp themida behavioral1/memory/4032-171-0x0000000000D30000-0x0000000001230000-memory.dmp themida -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
1F7E.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1F7E.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
1F7E.exepid process 4032 1F7E.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1F7E.exe20F6.exedescription pid process target process PID 4032 set thread context of 3152 4032 1F7E.exe InstallUtil.exe PID 4340 set thread context of 1656 4340 20F6.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1640 4340 WerFault.exe 20F6.exe -
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
auwfawb7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI auwfawb Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI auwfawb Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI auwfawb Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exepid process 3256 7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe 3256 7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1040 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exeauwfawbpid process 3256 7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1040 1352 auwfawb -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
InstallUtil.exevbc.exedescription pid process Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 Token: SeDebugPrivilege 3152 InstallUtil.exe Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 Token: SeDebugPrivilege 1656 vbc.exe Token: SeShutdownPrivilege 1040 Token: SeCreatePagefilePrivilege 1040 -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
1F7E.exe20F6.exedescription pid process target process PID 1040 wrote to memory of 4032 1040 1F7E.exe PID 1040 wrote to memory of 4032 1040 1F7E.exe PID 1040 wrote to memory of 4340 1040 20F6.exe PID 1040 wrote to memory of 4340 1040 20F6.exe PID 1040 wrote to memory of 4340 1040 20F6.exe PID 1040 wrote to memory of 4068 1040 explorer.exe PID 1040 wrote to memory of 4068 1040 explorer.exe PID 1040 wrote to memory of 4068 1040 explorer.exe PID 1040 wrote to memory of 4068 1040 explorer.exe PID 1040 wrote to memory of 4948 1040 explorer.exe PID 1040 wrote to memory of 4948 1040 explorer.exe PID 1040 wrote to memory of 4948 1040 explorer.exe PID 1040 wrote to memory of 2960 1040 explorer.exe PID 1040 wrote to memory of 2960 1040 explorer.exe PID 1040 wrote to memory of 2960 1040 explorer.exe PID 1040 wrote to memory of 2960 1040 explorer.exe PID 1040 wrote to memory of 2052 1040 explorer.exe PID 1040 wrote to memory of 2052 1040 explorer.exe PID 1040 wrote to memory of 2052 1040 explorer.exe PID 1040 wrote to memory of 1144 1040 explorer.exe PID 1040 wrote to memory of 1144 1040 explorer.exe PID 1040 wrote to memory of 1144 1040 explorer.exe PID 1040 wrote to memory of 1144 1040 explorer.exe PID 1040 wrote to memory of 4820 1040 explorer.exe PID 1040 wrote to memory of 4820 1040 explorer.exe PID 1040 wrote to memory of 4820 1040 explorer.exe PID 1040 wrote to memory of 4820 1040 explorer.exe PID 1040 wrote to memory of 4112 1040 explorer.exe PID 1040 wrote to memory of 4112 1040 explorer.exe PID 1040 wrote to memory of 4112 1040 explorer.exe PID 1040 wrote to memory of 4112 1040 explorer.exe PID 1040 wrote to memory of 3540 1040 explorer.exe PID 1040 wrote to memory of 3540 1040 explorer.exe PID 1040 wrote to memory of 3540 1040 explorer.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 4032 wrote to memory of 3152 4032 1F7E.exe InstallUtil.exe PID 1040 wrote to memory of 5052 1040 explorer.exe PID 1040 wrote to memory of 5052 1040 explorer.exe PID 1040 wrote to memory of 5052 1040 explorer.exe PID 1040 wrote to memory of 5052 1040 explorer.exe PID 4340 wrote to memory of 1656 4340 20F6.exe vbc.exe PID 4340 wrote to memory of 1656 4340 20F6.exe vbc.exe PID 4340 wrote to memory of 1656 4340 20F6.exe vbc.exe PID 4340 wrote to memory of 1656 4340 20F6.exe vbc.exe PID 4340 wrote to memory of 1656 4340 20F6.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe"C:\Users\Admin\AppData\Local\Temp\7d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1F7E.exeC:\Users\Admin\AppData\Local\Temp\1F7E.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\20F6.exeC:\Users\Admin\AppData\Local\Temp\20F6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4340 -s 5162⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\auwfawbC:\Users\Admin\AppData\Roaming\auwfawb1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4340 -ip 43401⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1F7E.exeFilesize
1.5MB
MD5d1964c1b30d01262eccaee06c600d726
SHA1e213ef1a963cc1825b9183742bb2af555da72efe
SHA25606ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
SHA51202d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
C:\Users\Admin\AppData\Local\Temp\1F7E.exeFilesize
1.5MB
MD5d1964c1b30d01262eccaee06c600d726
SHA1e213ef1a963cc1825b9183742bb2af555da72efe
SHA25606ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
SHA51202d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
C:\Users\Admin\AppData\Local\Temp\20F6.exeFilesize
510KB
MD52c7867a1749edef10274f3e34b047865
SHA1c2009f052e54f3c788e1872e7ac6f4d5fea218f9
SHA2568845215ed3299ff3381580ab3c1e1feb69d8c44361bc15d64b57a597147a74c7
SHA51260b503650f7f4ca7d14cfa7dabc1cda68eee8f0e34800fb160f44b3af9135bf27b15c57e26f19301baa1eb4eb6a6191cfa70d8ca28361db71969f7c0c3435e68
-
C:\Users\Admin\AppData\Local\Temp\20F6.exeFilesize
510KB
MD52c7867a1749edef10274f3e34b047865
SHA1c2009f052e54f3c788e1872e7ac6f4d5fea218f9
SHA2568845215ed3299ff3381580ab3c1e1feb69d8c44361bc15d64b57a597147a74c7
SHA51260b503650f7f4ca7d14cfa7dabc1cda68eee8f0e34800fb160f44b3af9135bf27b15c57e26f19301baa1eb4eb6a6191cfa70d8ca28361db71969f7c0c3435e68
-
C:\Users\Admin\AppData\Roaming\auwfawbFilesize
378KB
MD58b9827570321a0758ed35c59c0f23d76
SHA1b9f0c0070b0502f0e532c5d336179b0622911448
SHA2567d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8
SHA5120cff9065057c6bb545f89a8d761fd5a59a30964189693051202df725b341745a5bc6ab6f3d6c343e6205f4dc2f3d36ed6fefbdc523faf44c1329284382a1d61c
-
C:\Users\Admin\AppData\Roaming\auwfawbFilesize
378KB
MD58b9827570321a0758ed35c59c0f23d76
SHA1b9f0c0070b0502f0e532c5d336179b0622911448
SHA2567d8600d5b4bcd5e353b0eff070275d17beb110a12fcd518a1b99d13edf96e4f8
SHA5120cff9065057c6bb545f89a8d761fd5a59a30964189693051202df725b341745a5bc6ab6f3d6c343e6205f4dc2f3d36ed6fefbdc523faf44c1329284382a1d61c
-
memory/1144-160-0x0000000000B40000-0x0000000000B62000-memory.dmpFilesize
136KB
-
memory/1144-161-0x0000000000B10000-0x0000000000B37000-memory.dmpFilesize
156KB
-
memory/1144-159-0x0000000000000000-mapping.dmp
-
memory/1144-189-0x0000000000B40000-0x0000000000B62000-memory.dmpFilesize
136KB
-
memory/1352-205-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1352-193-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/1352-192-0x0000000000652000-0x0000000000668000-memory.dmpFilesize
88KB
-
memory/1656-197-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1656-196-0x0000000000000000-mapping.dmp
-
memory/2052-158-0x00000000006A0000-0x00000000006AC000-memory.dmpFilesize
48KB
-
memory/2052-156-0x0000000000000000-mapping.dmp
-
memory/2052-188-0x00000000006B0000-0x00000000006B6000-memory.dmpFilesize
24KB
-
memory/2052-157-0x00000000006B0000-0x00000000006B6000-memory.dmpFilesize
24KB
-
memory/2960-187-0x0000000001600000-0x0000000001605000-memory.dmpFilesize
20KB
-
memory/2960-151-0x0000000000000000-mapping.dmp
-
memory/2960-154-0x0000000001600000-0x0000000001605000-memory.dmpFilesize
20KB
-
memory/2960-155-0x0000000000FB0000-0x0000000000FB9000-memory.dmpFilesize
36KB
-
memory/3152-169-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/3152-206-0x0000000007E60000-0x0000000008022000-memory.dmpFilesize
1.8MB
-
memory/3152-207-0x0000000008560000-0x0000000008A8C000-memory.dmpFilesize
5.2MB
-
memory/3152-177-0x00000000056D0000-0x0000000005CE8000-memory.dmpFilesize
6.1MB
-
memory/3152-179-0x0000000005170000-0x0000000005182000-memory.dmpFilesize
72KB
-
memory/3152-190-0x00000000054E0000-0x0000000005546000-memory.dmpFilesize
408KB
-
memory/3152-180-0x00000000051D0000-0x000000000520C000-memory.dmpFilesize
240KB
-
memory/3152-178-0x0000000005240000-0x000000000534A000-memory.dmpFilesize
1.0MB
-
memory/3152-195-0x00000000066E0000-0x0000000006C84000-memory.dmpFilesize
5.6MB
-
memory/3152-194-0x0000000006090000-0x0000000006122000-memory.dmpFilesize
584KB
-
memory/3152-170-0x000000000041B576-mapping.dmp
-
memory/3256-135-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3256-134-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3256-132-0x0000000000532000-0x0000000000547000-memory.dmpFilesize
84KB
-
memory/3256-133-0x0000000000030000-0x0000000000039000-memory.dmpFilesize
36KB
-
memory/3540-168-0x0000000000000000-mapping.dmp
-
memory/3540-175-0x00000000012B0000-0x00000000012BD000-memory.dmpFilesize
52KB
-
memory/3540-203-0x00000000012C0000-0x00000000012C7000-memory.dmpFilesize
28KB
-
memory/3540-174-0x00000000012C0000-0x00000000012C7000-memory.dmpFilesize
28KB
-
memory/4032-146-0x00007FF9E6370000-0x00007FF9E6565000-memory.dmpFilesize
2.0MB
-
memory/4032-173-0x00007FF9E6370000-0x00007FF9E6565000-memory.dmpFilesize
2.0MB
-
memory/4032-172-0x00007FF9C6F20000-0x00007FF9C79E1000-memory.dmpFilesize
10.8MB
-
memory/4032-171-0x0000000000D30000-0x0000000001230000-memory.dmpFilesize
5.0MB
-
memory/4032-147-0x00007FF9C6F20000-0x00007FF9C79E1000-memory.dmpFilesize
10.8MB
-
memory/4032-145-0x0000000000D30000-0x0000000001230000-memory.dmpFilesize
5.0MB
-
memory/4032-139-0x0000000000D30000-0x0000000001230000-memory.dmpFilesize
5.0MB
-
memory/4032-136-0x0000000000000000-mapping.dmp
-
memory/4068-152-0x0000000000850000-0x000000000085B000-memory.dmpFilesize
44KB
-
memory/4068-149-0x0000000000860000-0x0000000000867000-memory.dmpFilesize
28KB
-
memory/4068-142-0x0000000000000000-mapping.dmp
-
memory/4068-184-0x0000000000860000-0x0000000000867000-memory.dmpFilesize
28KB
-
memory/4112-166-0x0000000000A40000-0x0000000000A46000-memory.dmpFilesize
24KB
-
memory/4112-167-0x0000000000A30000-0x0000000000A3B000-memory.dmpFilesize
44KB
-
memory/4112-165-0x0000000000000000-mapping.dmp
-
memory/4112-202-0x0000000000A40000-0x0000000000A46000-memory.dmpFilesize
24KB
-
memory/4340-140-0x0000000000000000-mapping.dmp
-
memory/4820-191-0x0000000000780000-0x0000000000785000-memory.dmpFilesize
20KB
-
memory/4820-164-0x0000000000770000-0x0000000000779000-memory.dmpFilesize
36KB
-
memory/4820-163-0x0000000000780000-0x0000000000785000-memory.dmpFilesize
20KB
-
memory/4820-162-0x0000000000000000-mapping.dmp
-
memory/4948-148-0x0000000000000000-mapping.dmp
-
memory/4948-150-0x0000000000D30000-0x0000000000D3F000-memory.dmpFilesize
60KB
-
memory/4948-186-0x0000000000D40000-0x0000000000D49000-memory.dmpFilesize
36KB
-
memory/4948-153-0x0000000000D40000-0x0000000000D49000-memory.dmpFilesize
36KB
-
memory/5052-176-0x0000000000000000-mapping.dmp
-
memory/5052-204-0x0000000000C40000-0x0000000000C48000-memory.dmpFilesize
32KB
-
memory/5052-181-0x0000000000C40000-0x0000000000C48000-memory.dmpFilesize
32KB
-
memory/5052-182-0x0000000000C30000-0x0000000000C3B000-memory.dmpFilesize
44KB