Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-12-2022 22:06
Static task
static1
Behavioral task
behavioral1
Sample
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe
Resource
win10v2004-20220812-en
General
-
Target
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe
-
Size
231KB
-
MD5
801d35bad81609af210c455e11d2f13d
-
SHA1
f3e56dde38c5d425d196ab218859a87250c1c0c3
-
SHA256
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518
-
SHA512
95b36568c332e5a812d057a288b880b7161459b9b1474282f7cd843d5ff4c709c979fb00f04dc796098722662f1155f6cdf6e7da471e2eb732f05a8c48b96df9
-
SSDEEP
3072:Vni+LdxD4qH5W5EWfLv+tU6o+D8wxqUMTOLtJ/33bRS1w7RkxmJZs:V3L3D4qqEQL167jFigJ/7E1GymI
Malware Config
Extracted
redline
11
79.137.202.18:45218
-
auth_value
107e09eee63158d2488feb03dac75204
Signatures
-
Detects Smokeloader packer 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3444-133-0x0000000002190000-0x0000000002199000-memory.dmp family_smokeloader -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
DD93.exeE1EA.exepid process 4108 DD93.exe 4460 E1EA.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
E1EA.exedescription pid process target process PID 4460 set thread context of 1636 4460 E1EA.exe vbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2276 4460 WerFault.exe E1EA.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exepid process 3444 18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe 3444 18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2220 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exepid process 3444 18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 2220 -
Suspicious use of AdjustPrivilegeToken 13 IoCs
Processes:
vbc.exedescription pid process Token: SeShutdownPrivilege 2220 Token: SeCreatePagefilePrivilege 2220 Token: SeShutdownPrivilege 2220 Token: SeCreatePagefilePrivilege 2220 Token: SeShutdownPrivilege 2220 Token: SeCreatePagefilePrivilege 2220 Token: SeShutdownPrivilege 2220 Token: SeCreatePagefilePrivilege 2220 Token: SeShutdownPrivilege 2220 Token: SeCreatePagefilePrivilege 2220 Token: SeDebugPrivilege 1636 vbc.exe Token: SeShutdownPrivilege 2220 Token: SeCreatePagefilePrivilege 2220 -
Suspicious use of WriteProcessMemory 56 IoCs
Processes:
E1EA.exeDD93.exedescription pid process target process PID 2220 wrote to memory of 4108 2220 DD93.exe PID 2220 wrote to memory of 4108 2220 DD93.exe PID 2220 wrote to memory of 4108 2220 DD93.exe PID 2220 wrote to memory of 4460 2220 E1EA.exe PID 2220 wrote to memory of 4460 2220 E1EA.exe PID 2220 wrote to memory of 4460 2220 E1EA.exe PID 2220 wrote to memory of 684 2220 explorer.exe PID 2220 wrote to memory of 684 2220 explorer.exe PID 2220 wrote to memory of 684 2220 explorer.exe PID 2220 wrote to memory of 684 2220 explorer.exe PID 4460 wrote to memory of 1636 4460 E1EA.exe vbc.exe PID 4460 wrote to memory of 1636 4460 E1EA.exe vbc.exe PID 4460 wrote to memory of 1636 4460 E1EA.exe vbc.exe PID 4460 wrote to memory of 1636 4460 E1EA.exe vbc.exe PID 4460 wrote to memory of 1636 4460 E1EA.exe vbc.exe PID 2220 wrote to memory of 2908 2220 explorer.exe PID 2220 wrote to memory of 2908 2220 explorer.exe PID 2220 wrote to memory of 2908 2220 explorer.exe PID 4108 wrote to memory of 4272 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 4272 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 4272 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 3720 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 3720 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 3720 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 2284 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 2284 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 2284 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 2568 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 2568 4108 DD93.exe vbc.exe PID 4108 wrote to memory of 2568 4108 DD93.exe vbc.exe PID 2220 wrote to memory of 4276 2220 explorer.exe PID 2220 wrote to memory of 4276 2220 explorer.exe PID 2220 wrote to memory of 4276 2220 explorer.exe PID 2220 wrote to memory of 4276 2220 explorer.exe PID 2220 wrote to memory of 2720 2220 explorer.exe PID 2220 wrote to memory of 2720 2220 explorer.exe PID 2220 wrote to memory of 2720 2220 explorer.exe PID 2220 wrote to memory of 3636 2220 explorer.exe PID 2220 wrote to memory of 3636 2220 explorer.exe PID 2220 wrote to memory of 3636 2220 explorer.exe PID 2220 wrote to memory of 3636 2220 explorer.exe PID 2220 wrote to memory of 4988 2220 explorer.exe PID 2220 wrote to memory of 4988 2220 explorer.exe PID 2220 wrote to memory of 4988 2220 explorer.exe PID 2220 wrote to memory of 4988 2220 explorer.exe PID 2220 wrote to memory of 2608 2220 explorer.exe PID 2220 wrote to memory of 2608 2220 explorer.exe PID 2220 wrote to memory of 2608 2220 explorer.exe PID 2220 wrote to memory of 2608 2220 explorer.exe PID 2220 wrote to memory of 2824 2220 explorer.exe PID 2220 wrote to memory of 2824 2220 explorer.exe PID 2220 wrote to memory of 2824 2220 explorer.exe PID 2220 wrote to memory of 3524 2220 explorer.exe PID 2220 wrote to memory of 3524 2220 explorer.exe PID 2220 wrote to memory of 3524 2220 explorer.exe PID 2220 wrote to memory of 3524 2220 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe"C:\Users\Admin\AppData\Local\Temp\18c6d5ec902169904318f43825aff792b44b35fd0df5c042ba391f716b609518.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\DD93.exeC:\Users\Admin\AppData\Local\Temp\DD93.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\E1EA.exeC:\Users\Admin\AppData\Local\Temp\E1EA.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4460 -s 1562⤵
- Program crash
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4460 -ip 44601⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DD93.exeFilesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
C:\Users\Admin\AppData\Local\Temp\DD93.exeFilesize
67KB
MD5666d8f33d37064fd5d14e2166c9bfa69
SHA13b27df9335a9b2efe9da1057e9f8312a72d1ca9d
SHA2567fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157
SHA512ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df
-
C:\Users\Admin\AppData\Local\Temp\E1EA.exeFilesize
399KB
MD589be4ac8a06eefdd3939ef7c949d2eaa
SHA13fe3f325bf7743fe859a67b426d94cd574333b2e
SHA25605046a5abb7522d5839de7fc774ca23486cb8cfc9d1ccdeb0357b44171353a5d
SHA512e56ecdfa4516b916116a4b167eb9b26f641afd6d4a6fbac4cdcb23d1d6fa3d707f425eef912e4fea91e10b4e8821ddb7c11b183fb83efb60dd87bdc84a0fbf6f
-
C:\Users\Admin\AppData\Local\Temp\E1EA.exeFilesize
399KB
MD589be4ac8a06eefdd3939ef7c949d2eaa
SHA13fe3f325bf7743fe859a67b426d94cd574333b2e
SHA25605046a5abb7522d5839de7fc774ca23486cb8cfc9d1ccdeb0357b44171353a5d
SHA512e56ecdfa4516b916116a4b167eb9b26f641afd6d4a6fbac4cdcb23d1d6fa3d707f425eef912e4fea91e10b4e8821ddb7c11b183fb83efb60dd87bdc84a0fbf6f
-
memory/684-189-0x0000000000A10000-0x0000000000A17000-memory.dmpFilesize
28KB
-
memory/684-151-0x0000000000A10000-0x0000000000A17000-memory.dmpFilesize
28KB
-
memory/684-152-0x0000000000A00000-0x0000000000A0B000-memory.dmpFilesize
44KB
-
memory/684-144-0x0000000000000000-mapping.dmp
-
memory/1636-185-0x00000000062D0000-0x0000000006346000-memory.dmpFilesize
472KB
-
memory/1636-186-0x0000000006350000-0x00000000063A0000-memory.dmpFilesize
320KB
-
memory/1636-180-0x00000000060B0000-0x0000000006142000-memory.dmpFilesize
584KB
-
memory/1636-183-0x0000000006700000-0x0000000006CA4000-memory.dmpFilesize
5.6MB
-
memory/1636-192-0x0000000007A30000-0x0000000007BF2000-memory.dmpFilesize
1.8MB
-
memory/1636-145-0x0000000000000000-mapping.dmp
-
memory/1636-146-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/1636-153-0x00000000057B0000-0x0000000005DC8000-memory.dmpFilesize
6.1MB
-
memory/1636-193-0x0000000008130000-0x000000000865C000-memory.dmpFilesize
5.2MB
-
memory/1636-157-0x00000000051F0000-0x000000000522C000-memory.dmpFilesize
240KB
-
memory/1636-154-0x00000000052A0000-0x00000000053AA000-memory.dmpFilesize
1.0MB
-
memory/1636-155-0x0000000005190000-0x00000000051A2000-memory.dmpFilesize
72KB
-
memory/2284-160-0x0000000000000000-mapping.dmp
-
memory/2568-161-0x0000000000000000-mapping.dmp
-
memory/2608-176-0x0000000000000000-mapping.dmp
-
memory/2608-178-0x0000000000BB0000-0x0000000000BBB000-memory.dmpFilesize
44KB
-
memory/2608-177-0x0000000000BC0000-0x0000000000BC6000-memory.dmpFilesize
24KB
-
memory/2608-197-0x0000000000BC0000-0x0000000000BC6000-memory.dmpFilesize
24KB
-
memory/2720-194-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/2720-167-0x0000000000000000-mapping.dmp
-
memory/2720-168-0x0000000000790000-0x0000000000796000-memory.dmpFilesize
24KB
-
memory/2720-169-0x0000000000780000-0x000000000078C000-memory.dmpFilesize
48KB
-
memory/2824-179-0x0000000000000000-mapping.dmp
-
memory/2824-181-0x00000000003F0000-0x00000000003F7000-memory.dmpFilesize
28KB
-
memory/2824-182-0x00000000003E0000-0x00000000003ED000-memory.dmpFilesize
52KB
-
memory/2824-198-0x00000000003F0000-0x00000000003F7000-memory.dmpFilesize
28KB
-
memory/2908-162-0x0000000000550000-0x0000000000559000-memory.dmpFilesize
36KB
-
memory/2908-190-0x0000000000550000-0x0000000000559000-memory.dmpFilesize
36KB
-
memory/2908-163-0x0000000000540000-0x000000000054F000-memory.dmpFilesize
60KB
-
memory/2908-156-0x0000000000000000-mapping.dmp
-
memory/3444-132-0x000000000048E000-0x000000000049F000-memory.dmpFilesize
68KB
-
memory/3444-133-0x0000000002190000-0x0000000002199000-memory.dmpFilesize
36KB
-
memory/3444-134-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/3444-135-0x0000000000400000-0x000000000045E000-memory.dmpFilesize
376KB
-
memory/3524-187-0x0000000000750000-0x0000000000758000-memory.dmpFilesize
32KB
-
memory/3524-188-0x0000000000740000-0x000000000074B000-memory.dmpFilesize
44KB
-
memory/3524-184-0x0000000000000000-mapping.dmp
-
memory/3524-199-0x0000000000750000-0x0000000000758000-memory.dmpFilesize
32KB
-
memory/3636-171-0x0000000000830000-0x0000000000852000-memory.dmpFilesize
136KB
-
memory/3636-172-0x0000000000800000-0x0000000000827000-memory.dmpFilesize
156KB
-
memory/3636-170-0x0000000000000000-mapping.dmp
-
memory/3636-195-0x0000000000830000-0x0000000000852000-memory.dmpFilesize
136KB
-
memory/3720-159-0x0000000000000000-mapping.dmp
-
memory/4108-140-0x0000000004B80000-0x0000000004BE6000-memory.dmpFilesize
408KB
-
memory/4108-139-0x0000000000230000-0x0000000000246000-memory.dmpFilesize
88KB
-
memory/4108-136-0x0000000000000000-mapping.dmp
-
memory/4272-158-0x0000000000000000-mapping.dmp
-
memory/4276-191-0x0000000000420000-0x0000000000425000-memory.dmpFilesize
20KB
-
memory/4276-164-0x0000000000000000-mapping.dmp
-
memory/4276-165-0x0000000000420000-0x0000000000425000-memory.dmpFilesize
20KB
-
memory/4276-166-0x0000000000410000-0x0000000000419000-memory.dmpFilesize
36KB
-
memory/4460-141-0x0000000000000000-mapping.dmp
-
memory/4988-175-0x0000000000870000-0x0000000000879000-memory.dmpFilesize
36KB
-
memory/4988-196-0x0000000000880000-0x0000000000885000-memory.dmpFilesize
20KB
-
memory/4988-173-0x0000000000000000-mapping.dmp
-
memory/4988-174-0x0000000000880000-0x0000000000885000-memory.dmpFilesize
20KB