Analysis
- max time kernel
150s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
02/01/2023, 08:11
General
- Target a06556da458525e0ce6e57d4960dc00b.exe
- Size 240KB
- Sample230102-j29nwsgh41
- SHA256 df25912c1ea938ce4084ca5a0bd710fd636353f47f4ed45e12a7b2218dc3691e
Malware Config
Extracted
-
redline
-
@zallllis
-
45.15.157.136:7429
-
auth_value
819f274cbc0e7c8d89e811e4a9877964
Signatures
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of FindShellTrayWindow 3 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of WriteProcessMemory 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a06556da458525e0ce6e57d4960dc00b.exe"C:\Users\Admin\AppData\Local\Temp\a06556da458525e0ce6e57d4960dc00b.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7C0.exeC:\Users\Admin\AppData\Local\Temp\7C0.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 1402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 1482⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3896 -s 1362⤵
- Program crash
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3896 -ip 38961⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 508 -p 3896 -ip 38961⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 188 -p 3896 -ip 38961⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
7C0.exe
7C0.exe
memory/368-188-0x00000000003E0000-0x00000000003E7000-memory.dmp
memory/368-167-0x00000000003E0000-0x00000000003E7000-memory.dmp
memory/368-168-0x00000000003D0000-0x00000000003DD000-memory.dmp
memory/1288-165-0x00000000001B0000-0x00000000001BB000-memory.dmp
memory/1288-164-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/1288-185-0x00000000001C0000-0x00000000001C6000-memory.dmp
memory/1944-135-0x0000000000400000-0x0000000000459000-memory.dmp
memory/1944-134-0x0000000000400000-0x0000000000459000-memory.dmp
memory/1944-132-0x000000000074E000-0x000000000075F000-memory.dmp
memory/1944-133-0x00000000006F0000-0x00000000006F9000-memory.dmp
memory/2144-161-0x0000000000400000-0x0000000000405000-memory.dmp
memory/2144-162-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/2144-182-0x0000000000400000-0x0000000000405000-memory.dmp
memory/3092-189-0x0000000000890000-0x0000000000898000-memory.dmp
memory/3092-175-0x0000000000880000-0x000000000088B000-memory.dmp
memory/3092-174-0x0000000000890000-0x0000000000898000-memory.dmp
memory/3520-156-0x0000000000400000-0x0000000000432000-memory.dmp
memory/3520-172-0x00000000056E0000-0x00000000056F2000-memory.dmp
memory/3520-184-0x0000000005C30000-0x0000000005C96000-memory.dmp
memory/3520-183-0x0000000005B90000-0x0000000005C22000-memory.dmp
memory/3520-181-0x0000000006880000-0x0000000006E24000-memory.dmp
memory/3520-186-0x00000000067F0000-0x0000000006866000-memory.dmp
memory/3520-187-0x0000000006E30000-0x0000000006E80000-memory.dmp
memory/3520-190-0x0000000007050000-0x0000000007212000-memory.dmp
memory/3520-191-0x0000000007750000-0x0000000007C7C000-memory.dmp
memory/3520-173-0x0000000005740000-0x000000000577C000-memory.dmp
memory/3520-169-0x0000000005CB0000-0x00000000062C8000-memory.dmp
memory/3520-170-0x00000000057A0000-0x00000000058AA000-memory.dmp
memory/3528-153-0x0000000000490000-0x00000000004B7000-memory.dmp
memory/3528-152-0x00000000004C0000-0x00000000004E2000-memory.dmp
memory/3528-180-0x00000000004C0000-0x00000000004E2000-memory.dmp
memory/3900-141-0x00000000005E0000-0x00000000005E7000-memory.dmp
memory/3900-176-0x00000000005E0000-0x00000000005E7000-memory.dmp
memory/3900-142-0x00000000005D0000-0x00000000005DB000-memory.dmp
memory/4296-177-0x0000000000380000-0x0000000000389000-memory.dmp
memory/4296-143-0x0000000000380000-0x0000000000389000-memory.dmp
memory/4296-144-0x0000000000370000-0x000000000037F000-memory.dmp
memory/4452-146-0x00000000006C0000-0x00000000006C5000-memory.dmp
memory/4452-178-0x00000000006C0000-0x00000000006C5000-memory.dmp
memory/4452-147-0x00000000006B0000-0x00000000006B9000-memory.dmp
memory/4980-179-0x00000000008E0000-0x00000000008E6000-memory.dmp
memory/4980-150-0x00000000008D0000-0x00000000008DC000-memory.dmp
memory/4980-149-0x00000000008E0000-0x00000000008E6000-memory.dmp