Analysis

  • max time kernel
    150s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-12-2022 17:37

General

  • Target

    f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe

  • Size

    232KB

  • MD5

    612690d2d2a6c5aec8e5b623e2c390cf

  • SHA1

    8f05ab45296839473b91afd9f4ad158f6bd1c2ba

  • SHA256

    f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce

  • SHA512

    894691078f834e5038c03ab32d46fee12719af18357c48cdd9b511c196828b9e64d8d10a563aac7693eb024fd968fcb2085af03b9072acf7eb58bb9f0888f88c

  • SSDEEP

    3072:sl8NLawRLUhJ5hX6YMnfaJJZ4s2/nIVzW+5SeAddxZtJ/SRLjw7RkxmJZs:tLFRLk7J/4BEW+ce6dxPJ/SZGymI

Malware Config

Extracted

Family

redline

Botnet

11

C2

79.137.202.18:45218

Attributes
  • auth_value

    107e09eee63158d2488feb03dac75204

Extracted

Family

aurora

C2

195.43.142.218:8081

Signatures

  • Aurora

    Aurora is a crypto wallet stealer written in Golang.

  • Detects Smokeloader packer 1 IoCs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 5 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 20 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe
    "C:\Users\Admin\AppData\Local\Temp\f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:5060
  • C:\Users\Admin\AppData\Local\Temp\4314.exe
    C:\Users\Admin\AppData\Local\Temp\4314.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of WriteProcessMemory
    PID:4512
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:2156
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
          PID:4504
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
            PID:4856
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:4644
          • C:\Users\Admin\AppData\Local\Temp\45C4.exe
            C:\Users\Admin\AppData\Local\Temp\45C4.exe
            1⤵
            • Executes dropped EXE
            PID:3088
          • C:\Users\Admin\AppData\Local\Temp\47C9.exe
            C:\Users\Admin\AppData\Local\Temp\47C9.exe
            1⤵
            • Executes dropped EXE
            • Suspicious use of SetThreadContext
            • Suspicious use of WriteProcessMemory
            PID:4344
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:3996
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 4344 -s 252
                2⤵
                • Program crash
                PID:1484
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 4344 -ip 4344
              1⤵
                PID:3332
              • C:\Windows\SysWOW64\explorer.exe
                C:\Windows\SysWOW64\explorer.exe
                1⤵
                  PID:4292
                • C:\Users\Admin\AppData\Local\Temp\4C7D.exe
                  C:\Users\Admin\AppData\Local\Temp\4C7D.exe
                  1⤵
                  • Executes dropped EXE
                  • Suspicious use of WriteProcessMemory
                  PID:2824
                  • C:\Windows\System32\Wbem\wmic.exe
                    wmic os get Caption
                    2⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2060
                  • C:\Windows\system32\cmd.exe
                    cmd /C "wmic cpu get name"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:3560
                  • C:\Windows\system32\cmd.exe
                    cmd /C "wmic path win32_VideoController get name"
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1900
                • C:\Windows\explorer.exe
                  C:\Windows\explorer.exe
                  1⤵
                    PID:3360
                  • C:\Windows\SysWOW64\explorer.exe
                    C:\Windows\SysWOW64\explorer.exe
                    1⤵
                      PID:448
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic path win32_VideoController get name
                      1⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2848
                    • C:\Windows\System32\Wbem\WMIC.exe
                      wmic cpu get name
                      1⤵
                        PID:2704
                      • C:\Windows\explorer.exe
                        C:\Windows\explorer.exe
                        1⤵
                          PID:3752
                        • C:\Windows\SysWOW64\explorer.exe
                          C:\Windows\SysWOW64\explorer.exe
                          1⤵
                            PID:4672
                          • C:\Windows\SysWOW64\explorer.exe
                            C:\Windows\SysWOW64\explorer.exe
                            1⤵
                              PID:864
                            • C:\Windows\SysWOW64\explorer.exe
                              C:\Windows\SysWOW64\explorer.exe
                              1⤵
                                PID:4772
                              • C:\Windows\explorer.exe
                                C:\Windows\explorer.exe
                                1⤵
                                  PID:3508
                                • C:\Windows\SysWOW64\explorer.exe
                                  C:\Windows\SysWOW64\explorer.exe
                                  1⤵
                                    PID:3792
                                  • C:\Users\Admin\AppData\Roaming\uhaaivh
                                    C:\Users\Admin\AppData\Roaming\uhaaivh
                                    1⤵
                                    • Executes dropped EXE
                                    • Checks SCSI registry key(s)
                                    • Suspicious behavior: MapViewOfSection
                                    PID:4136

                                  Network

                                  MITRE ATT&CK Matrix ATT&CK v6

                                  Execution

                                  Scripting

                                  1
                                  T1064

                                  Defense Evasion

                                  Scripting

                                  1
                                  T1064

                                  Credential Access

                                  Credentials in Files

                                  2
                                  T1081

                                  Discovery

                                  Query Registry

                                  1
                                  T1012

                                  Peripheral Device Discovery

                                  1
                                  T1120

                                  System Information Discovery

                                  1
                                  T1082

                                  Collection

                                  Data from Local System

                                  2
                                  T1005

                                  Command and Control

                                  Web Service

                                  1
                                  T1102

                                  Replay Monitor

                                  Loading Replay Monitor...

                                  Downloads

                                  • C:\Users\Admin\AppData\Local\Temp\4314.exe
                                    Filesize

                                    67KB

                                    MD5

                                    666d8f33d37064fd5d14e2166c9bfa69

                                    SHA1

                                    3b27df9335a9b2efe9da1057e9f8312a72d1ca9d

                                    SHA256

                                    7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157

                                    SHA512

                                    ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df

                                  • C:\Users\Admin\AppData\Local\Temp\4314.exe
                                    Filesize

                                    67KB

                                    MD5

                                    666d8f33d37064fd5d14e2166c9bfa69

                                    SHA1

                                    3b27df9335a9b2efe9da1057e9f8312a72d1ca9d

                                    SHA256

                                    7fddf1b75f50d43214867f367223f2d241d62ae63deea334d051c0ee19d18157

                                    SHA512

                                    ac3c993f019bb402db474fda65d587ae7717725eea9b3a869acd3530543b7b94d354f19474f6b1c7fc760b5b22622328def2bef26e3900c186b16e8a3d3b90df

                                  • C:\Users\Admin\AppData\Local\Temp\45C4.exe
                                    Filesize

                                    4KB

                                    MD5

                                    9748489855d9dd82ab09da5e3e55b19e

                                    SHA1

                                    6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                    SHA256

                                    05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                    SHA512

                                    7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                  • C:\Users\Admin\AppData\Local\Temp\45C4.exe
                                    Filesize

                                    4KB

                                    MD5

                                    9748489855d9dd82ab09da5e3e55b19e

                                    SHA1

                                    6ed2bf6a1a53a59cd2137812cb43b5032817f6a1

                                    SHA256

                                    05bdd09d934144589f7b90ac4ef6e8d7743c35f551219d98bc7fc933f98a157b

                                    SHA512

                                    7eebbc3e42aad1af304ba38ca0c74e5f2293a630d98d4cfd48957f5f288bcb52cf323421c2b166e3b459450d5ef024167f8729b7b4b66651a34c3c3d4581a2be

                                  • C:\Users\Admin\AppData\Local\Temp\47C9.exe
                                    Filesize

                                    399KB

                                    MD5

                                    ac508206006eb41c605373e9793e7622

                                    SHA1

                                    3223ac24de6fd4650bbcf1495e73944085bc0e07

                                    SHA256

                                    775f35230e0d3bd996440811af08110905803280094996a22b02f6b7b85c6b32

                                    SHA512

                                    9aa4d2d50a915919f1f238f0838636cfa6f7fc3e634508f5a110ac4097c919d9076753612af7c2e1c9013281ca4e1a209743560d2f0f01c8c9329c47b113ba2c

                                  • C:\Users\Admin\AppData\Local\Temp\47C9.exe
                                    Filesize

                                    399KB

                                    MD5

                                    ac508206006eb41c605373e9793e7622

                                    SHA1

                                    3223ac24de6fd4650bbcf1495e73944085bc0e07

                                    SHA256

                                    775f35230e0d3bd996440811af08110905803280094996a22b02f6b7b85c6b32

                                    SHA512

                                    9aa4d2d50a915919f1f238f0838636cfa6f7fc3e634508f5a110ac4097c919d9076753612af7c2e1c9013281ca4e1a209743560d2f0f01c8c9329c47b113ba2c

                                  • C:\Users\Admin\AppData\Local\Temp\4C7D.exe
                                    Filesize

                                    1MB

                                    MD5

                                    3e8b9e2a1f3d5a7a2322bce514e90a27

                                    SHA1

                                    d0e6cf406c70bb223ebaa41aa12f3b34ac217e7f

                                    SHA256

                                    00c142f59684f5582673779b0a21edb9309ac9bf24392e41b621899a626cc6d5

                                    SHA512

                                    b75b86bcc939946944239222f7dc0498f0fad890a61325d53114431f6b746bb4853f6a15f65716c7880afd5c21dd85b91f10e4235b503643314e2371aa4648b7

                                  • C:\Users\Admin\AppData\Local\Temp\4C7D.exe
                                    Filesize

                                    1MB

                                    MD5

                                    3e8b9e2a1f3d5a7a2322bce514e90a27

                                    SHA1

                                    d0e6cf406c70bb223ebaa41aa12f3b34ac217e7f

                                    SHA256

                                    00c142f59684f5582673779b0a21edb9309ac9bf24392e41b621899a626cc6d5

                                    SHA512

                                    b75b86bcc939946944239222f7dc0498f0fad890a61325d53114431f6b746bb4853f6a15f65716c7880afd5c21dd85b91f10e4235b503643314e2371aa4648b7

                                  • C:\Users\Admin\AppData\Roaming\uhaaivh
                                    Filesize

                                    232KB

                                    MD5

                                    612690d2d2a6c5aec8e5b623e2c390cf

                                    SHA1

                                    8f05ab45296839473b91afd9f4ad158f6bd1c2ba

                                    SHA256

                                    f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce

                                    SHA512

                                    894691078f834e5038c03ab32d46fee12719af18357c48cdd9b511c196828b9e64d8d10a563aac7693eb024fd968fcb2085af03b9072acf7eb58bb9f0888f88c

                                  • C:\Users\Admin\AppData\Roaming\uhaaivh
                                    Filesize

                                    232KB

                                    MD5

                                    612690d2d2a6c5aec8e5b623e2c390cf

                                    SHA1

                                    8f05ab45296839473b91afd9f4ad158f6bd1c2ba

                                    SHA256

                                    f03cfa30317eefbc658e645242cf7be5a3d012cc26d91f04284b80127d07b6ce

                                    SHA512

                                    894691078f834e5038c03ab32d46fee12719af18357c48cdd9b511c196828b9e64d8d10a563aac7693eb024fd968fcb2085af03b9072acf7eb58bb9f0888f88c

                                  • memory/448-182-0x00000000006A0000-0x00000000006A9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/448-181-0x00000000006B0000-0x00000000006B5000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/448-212-0x00000000006B0000-0x00000000006B5000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/448-178-0x0000000000000000-mapping.dmp
                                  • memory/864-194-0x00000000005A0000-0x00000000005A9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/864-192-0x0000000000000000-mapping.dmp
                                  • memory/864-215-0x00000000005B0000-0x00000000005B5000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/864-193-0x00000000005B0000-0x00000000005B5000-memory.dmp
                                    Filesize

                                    20KB

                                  • memory/1900-180-0x0000000000000000-mapping.dmp
                                  • memory/2060-179-0x0000000000000000-mapping.dmp
                                  • memory/2156-169-0x0000000000000000-mapping.dmp
                                  • memory/2704-186-0x0000000000000000-mapping.dmp
                                  • memory/2824-159-0x0000000000000000-mapping.dmp
                                  • memory/2824-172-0x0000016EB3970000-0x0000016EB39B9000-memory.dmp
                                    Filesize

                                    292KB

                                  • memory/2824-219-0x0000000000760000-0x0000000000B4A000-memory.dmp
                                    Filesize

                                    3MB

                                  • memory/2824-171-0x0000000000760000-0x0000000000B4A000-memory.dmp
                                    Filesize

                                    3MB

                                  • memory/2848-183-0x0000000000000000-mapping.dmp
                                  • memory/3088-144-0x0000000000CB0000-0x0000000000CB8000-memory.dmp
                                    Filesize

                                    32KB

                                  • memory/3088-145-0x00007FFF3B1C0000-0x00007FFF3BC81000-memory.dmp
                                    Filesize

                                    10MB

                                  • memory/3088-141-0x0000000000000000-mapping.dmp
                                  • memory/3360-175-0x0000000000000000-mapping.dmp
                                  • memory/3360-211-0x0000000000C00000-0x0000000000C09000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/3360-177-0x00000000009F0000-0x00000000009FF000-memory.dmp
                                    Filesize

                                    60KB

                                  • memory/3360-176-0x0000000000C00000-0x0000000000C09000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/3508-202-0x0000000000000000-mapping.dmp
                                  • memory/3508-205-0x00000000001F0000-0x00000000001F7000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/3508-217-0x00000000001F0000-0x00000000001F7000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/3508-206-0x00000000001E0000-0x00000000001ED000-memory.dmp
                                    Filesize

                                    52KB

                                  • memory/3560-184-0x0000000000000000-mapping.dmp
                                  • memory/3752-188-0x00000000003D0000-0x00000000003DC000-memory.dmp
                                    Filesize

                                    48KB

                                  • memory/3752-187-0x00000000003E0000-0x00000000003E6000-memory.dmp
                                    Filesize

                                    24KB

                                  • memory/3752-185-0x0000000000000000-mapping.dmp
                                  • memory/3752-213-0x00000000003E0000-0x00000000003E6000-memory.dmp
                                    Filesize

                                    24KB

                                  • memory/3792-209-0x0000000001360000-0x000000000136B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/3792-207-0x0000000000000000-mapping.dmp
                                  • memory/3792-208-0x0000000001370000-0x0000000001378000-memory.dmp
                                    Filesize

                                    32KB

                                  • memory/3792-218-0x0000000001370000-0x0000000001378000-memory.dmp
                                    Filesize

                                    32KB

                                  • memory/3996-156-0x0000000005190000-0x000000000529A000-memory.dmp
                                    Filesize

                                    1MB

                                  • memory/3996-197-0x0000000005580000-0x0000000005612000-memory.dmp
                                    Filesize

                                    584KB

                                  • memory/3996-203-0x0000000006CB0000-0x0000000006D26000-memory.dmp
                                    Filesize

                                    472KB

                                  • memory/3996-204-0x0000000006AF0000-0x0000000006B40000-memory.dmp
                                    Filesize

                                    320KB

                                  • memory/3996-199-0x0000000006F20000-0x000000000744C000-memory.dmp
                                    Filesize

                                    5MB

                                  • memory/3996-150-0x0000000000400000-0x0000000000432000-memory.dmp
                                    Filesize

                                    200KB

                                  • memory/3996-149-0x0000000000000000-mapping.dmp
                                  • memory/3996-155-0x00000000056A0000-0x0000000005CB8000-memory.dmp
                                    Filesize

                                    6MB

                                  • memory/3996-158-0x0000000005080000-0x0000000005092000-memory.dmp
                                    Filesize

                                    72KB

                                  • memory/3996-196-0x0000000006270000-0x0000000006814000-memory.dmp
                                    Filesize

                                    5MB

                                  • memory/3996-166-0x00000000050E0000-0x000000000511C000-memory.dmp
                                    Filesize

                                    240KB

                                  • memory/3996-198-0x0000000006820000-0x00000000069E2000-memory.dmp
                                    Filesize

                                    1MB

                                  • memory/4136-222-0x000000000061D000-0x000000000062E000-memory.dmp
                                    Filesize

                                    68KB

                                  • memory/4136-223-0x0000000000400000-0x000000000045E000-memory.dmp
                                    Filesize

                                    376KB

                                  • memory/4136-224-0x0000000000400000-0x000000000045E000-memory.dmp
                                    Filesize

                                    376KB

                                  • memory/4292-165-0x0000000000000000-mapping.dmp
                                  • memory/4292-210-0x0000000000C90000-0x0000000000C97000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/4292-173-0x0000000000C90000-0x0000000000C97000-memory.dmp
                                    Filesize

                                    28KB

                                  • memory/4292-174-0x0000000000C80000-0x0000000000C8B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/4344-146-0x0000000000000000-mapping.dmp
                                  • memory/4504-164-0x0000000000000000-mapping.dmp
                                  • memory/4512-136-0x0000000000000000-mapping.dmp
                                  • memory/4512-139-0x0000000000560000-0x0000000000576000-memory.dmp
                                    Filesize

                                    88KB

                                  • memory/4512-140-0x0000000004F00000-0x0000000004F66000-memory.dmp
                                    Filesize

                                    408KB

                                  • memory/4644-157-0x0000000000000000-mapping.dmp
                                  • memory/4672-189-0x0000000000000000-mapping.dmp
                                  • memory/4672-191-0x0000000000BC0000-0x0000000000BE7000-memory.dmp
                                    Filesize

                                    156KB

                                  • memory/4672-190-0x0000000000E00000-0x0000000000E22000-memory.dmp
                                    Filesize

                                    136KB

                                  • memory/4672-214-0x0000000000E00000-0x0000000000E22000-memory.dmp
                                    Filesize

                                    136KB

                                  • memory/4772-201-0x0000000001340000-0x000000000134B000-memory.dmp
                                    Filesize

                                    44KB

                                  • memory/4772-216-0x0000000001350000-0x0000000001356000-memory.dmp
                                    Filesize

                                    24KB

                                  • memory/4772-200-0x0000000001350000-0x0000000001356000-memory.dmp
                                    Filesize

                                    24KB

                                  • memory/4772-195-0x0000000000000000-mapping.dmp
                                  • memory/4856-162-0x0000000000000000-mapping.dmp
                                  • memory/5060-135-0x0000000000400000-0x000000000045E000-memory.dmp
                                    Filesize

                                    376KB

                                  • memory/5060-134-0x0000000000400000-0x000000000045E000-memory.dmp
                                    Filesize

                                    376KB

                                  • memory/5060-133-0x00000000006B0000-0x00000000006B9000-memory.dmp
                                    Filesize

                                    36KB

                                  • memory/5060-132-0x000000000075E000-0x000000000076F000-memory.dmp
                                    Filesize

                                    68KB