Analysis
- max time kernel
150s - max time network
135s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
02/01/2023, 12:16
General
- Target 8a307d860136a10c6c89b549a2e0d4a8.exe
- Size 216KB
- Sample230102-pffrkshb9y
- SHA256 46763a6c69ef95bcb1e5f62b7d2cfbfe60c26df1b65a0731a3b3050d85229660
Malware Config
Extracted
-
redline
-
@zallllis
-
45.15.157.136:7429
-
auth_value
819f274cbc0e7c8d89e811e4a9877964
Signatures
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Uses the VBS compiler for execution 1 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 3 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 41 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8a307d860136a10c6c89b549a2e0d4a8.exe"C:\Users\Admin\AppData\Local\Temp\8a307d860136a10c6c89b549a2e0d4a8.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F050.exeC:\Users\Admin\AppData\Local\Temp\F050.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2362⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2402⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1720 -s 2802⤵
- Program crash
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 1720 -ip 17201⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
F050.exe
F050.exe
memory/220-164-0x0000000000140000-0x0000000000145000-memory.dmp
memory/220-166-0x0000000000130000-0x0000000000139000-memory.dmp
memory/220-188-0x0000000000140000-0x0000000000145000-memory.dmp
memory/440-190-0x0000000000310000-0x0000000000317000-memory.dmp
memory/440-172-0x0000000000300000-0x000000000030D000-memory.dmp
memory/440-171-0x0000000000310000-0x0000000000317000-memory.dmp
memory/1704-176-0x0000000000650000-0x0000000000657000-memory.dmp
memory/1704-141-0x0000000000640000-0x000000000064B000-memory.dmp
memory/1704-140-0x0000000000650000-0x0000000000657000-memory.dmp
memory/1960-177-0x0000000000FE0000-0x0000000000FE9000-memory.dmp
memory/1960-144-0x0000000000FD0000-0x0000000000FDF000-memory.dmp
memory/1960-143-0x0000000000FE0000-0x0000000000FE9000-memory.dmp
memory/2064-174-0x00000000006F0000-0x00000000006F8000-memory.dmp
memory/2064-175-0x00000000006E0000-0x00000000006EB000-memory.dmp
memory/2064-191-0x00000000006F0000-0x00000000006F8000-memory.dmp
memory/2804-150-0x0000000001010000-0x000000000101C000-memory.dmp
memory/2804-149-0x0000000001020000-0x0000000001026000-memory.dmp
memory/2804-186-0x0000000001020000-0x0000000001026000-memory.dmp
memory/2988-169-0x0000000001230000-0x000000000123B000-memory.dmp
memory/2988-189-0x0000000001240000-0x0000000001246000-memory.dmp
memory/2988-168-0x0000000001240000-0x0000000001246000-memory.dmp
memory/3316-146-0x0000000001240000-0x0000000001245000-memory.dmp
memory/3316-181-0x0000000001240000-0x0000000001245000-memory.dmp
memory/3316-147-0x0000000001230000-0x0000000001239000-memory.dmp
memory/3836-133-0x0000000002190000-0x0000000002199000-memory.dmp
memory/3836-134-0x0000000000400000-0x0000000000453000-memory.dmp
memory/3836-135-0x0000000000400000-0x0000000000453000-memory.dmp
memory/3836-132-0x00000000004D8000-0x00000000004E9000-memory.dmp
memory/4072-159-0x0000000000360000-0x0000000000387000-memory.dmp
memory/4072-158-0x0000000000390000-0x00000000003B2000-memory.dmp
memory/4072-187-0x0000000000390000-0x00000000003B2000-memory.dmp
memory/5004-153-0x0000000000580000-0x00000000005B2000-memory.dmp
memory/5004-180-0x00000000051F0000-0x0000000005256000-memory.dmp
memory/5004-179-0x0000000005150000-0x00000000051E2000-memory.dmp
memory/5004-182-0x0000000006670000-0x0000000006832000-memory.dmp
memory/5004-183-0x0000000006D70000-0x000000000729C000-memory.dmp
memory/5004-184-0x00000000065B0000-0x0000000006626000-memory.dmp
memory/5004-185-0x0000000006840000-0x0000000006890000-memory.dmp
memory/5004-178-0x0000000005EF0000-0x0000000006494000-memory.dmp
memory/5004-165-0x0000000004E00000-0x0000000004E3C000-memory.dmp
memory/5004-161-0x0000000005320000-0x0000000005938000-memory.dmp
memory/5004-162-0x0000000004E50000-0x0000000004F5A000-memory.dmp
memory/5004-163-0x0000000004DA0000-0x0000000004DB2000-memory.dmp