Analysis
- max time kernel
150s - max time network
144s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
18/01/2023, 04:31
General
- Target file.exe
- Size 270KB
- Sample230118-e5dneaea8v
- SHA256 d760bcc24f920cb5dad3deb0728e979d3476fda9f75f6b515ada91ee44bd42b5
Malware Config
Extracted
-
redline
-
TestedPotikUodated
-
82.115.223.9:15486
-
auth_value
85a219bdf260de0a4b8a6127147534fe
Signatures
- Detect rhadamanthys stealer shellcode 2 IoCs
- Detects Smokeloader packer 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Blocklisted process makes network request 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 6 IoCs
- VMProtect packed file 6 IoCs
Detects executables packed with VMProtect commercial packer.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 20 IoCs
Processor information is often read in order to detect sandboxing environments.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 30 IoCs
- Suspicious behavior: AddClipboardFormatListener 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 32 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C64.exeC:\Users\Admin\AppData\Local\Temp\C64.exe1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F82.exeC:\Users\Admin\AppData\Local\Temp\F82.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\132C.exeC:\Users\Admin\AppData\Local\Temp\132C.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\693C.exeC:\Users\Admin\AppData\Local\Temp\693C.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6A47.exeC:\Users\Admin\AppData\Local\Temp\6A47.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_unse57b69e.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8FX|AHgAOQA1AFPvAEkAZj8AWABUPwAwAG0AQ0sALQH|WUiD7CjoBAL|AABIg8Qow8z|zMxMiUQkGEj|iVQkEEiJTCT9CF0BSItEJDBIt4kEJIEBOEhvAAjfSMdEJBAtAesOvoEBEEiDwAGPARBugQFASDmWAHMlnwP|iwwkSAPISIuvwUiLTKsBVHsAA||RSIvKigmICPvrwWYFZUiLBCX9YPPwM8lIi1AY|0g70XQ2SIPC|yBIiwJIO8J0|ypmg3hIGHUa|0yLQFBmQYM4d2t0BxERS3UIERD|eBAudAVIiwBf69VIi0j9AMFqAP9AU1VWV0FUQd9VQVZBV10BZoH|OU1aTYv4TIt|8kiL2Q+F|PPw|0xjSTxBgTwJf1BFAAAPherz8N9Bi4QJiPPwhcB|SI08AQ+E1moR74O8CYwtAQ+Ex|7z8ESLZyBEi1||HIt3JESLTxj|TAPhTAPZSAP|8TPJRYXJD4T9pPPwTYvEQYsQ|0Uz0kgD04oC|4TAdB1BwcoN9w++wPoAAUQD0P6|EXXsQYH6qvz|DXx0DoPBAUn|g8AEQTvJc2n|68aLwQ+3DE7|RYssi0wD63T3WDPtqhB0UUGL|RTBANMzyYoCTL+LwusPwcnIEQO9yOUQAUGKANUQ7f8zwDP2QTsMtvzgEKYAg8YBg|gI|3Lu6wpIi8tB|||VSYkE94PF|uQQxAQ7bxhyr|5mAUFfQV5BXUHfXF9eXVszF0iB9+xgAWQAi+noZv|+||9IhcAPhK2YdSBMja8BiysQyO8z|+ibfSCNXwT|TI1FRjPSi8vv|1QkaIAgTIvg1w+Ea3UgRagQM8D7i9ORIEiJfCQg+qYgcIAgSIvwD4T5S3UgpiBQSI1WCP9EjUdASI2MJH6FEUiL2Oh8|X4gV41WSN4gEOIhzPPw++hn7yBEiwaNV+kIQSCmIFjKIYmEJLWAhxLe8|CLDtogWMeJjCRxEQcwkSDoMfbvIIucLTJMi10630iD+2xIiiAwTH+JZCQ4TIukGjJ3TIlchAGEJNyHEduGko0RjUdLMIwk|fDz8EmL1Ojp|HYFMIqceDJIjYR4Mv9BgPMhjU9sRPswGKQCg+kBdfP7gbx4MiFSZXh1302LhCT0IjGUJP34NQHCSDvYcjj|g|psdjNEjUk9QPoAlEG4AJgApiA9QMoi+HQZRLYwwDHfSY1UJGyRIEmD7+hs6GuCMEiLzv6mIHhIhf90EovnVUJMjjAbMUiNTH8kQP|XSIHEdCEAYSQtCC0B2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4040 -s 2963⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\8300.exeC:\Users\Admin\AppData\Local\Temp\8300.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Users\Admin\AppData\Local\Temp\Waeeuireedsay.tmp",Oqahautwaqfe2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Windows\system32\rundll32.exe" "C:\Windows\system32\shell32.dll",#61 189993⤵
- Modifies registry class
- Suspicious use of FindShellTrayWindow
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2444 -s 5442⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 2444 -ip 24441⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 484 -p 4040 -ip 40401⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
132C.exe
132C.exe
693C.exe
693C.exe
6A47.exe
6A47.exe
8300.exe
8300.exe
C64.exe
C64.exe
F82.exe
F82.exe
Waeeuireedsay.tmp
Waeeuireedsay.tmp
nsis_unse57b69e.dll
nsis_unse57b69e.dll
memory/1312-196-0x0000000000C6F000-0x0000000000C81000-memory.dmp
memory/1312-197-0x0000000000F50000-0x0000000000F6D000-memory.dmp
memory/1312-195-0x0000000000400000-0x0000000000431000-memory.dmp
memory/1312-189-0x0000000000F50000-0x0000000000F6D000-memory.dmp
memory/1312-188-0x0000000000C6F000-0x0000000000C81000-memory.dmp
memory/1312-185-0x0000000000400000-0x0000000000431000-memory.dmp
memory/1788-184-0x00000000057E0000-0x0000000005846000-memory.dmp
memory/1788-174-0x00000000053C0000-0x00000000053FC000-memory.dmp
memory/1788-173-0x0000000005360000-0x0000000005372000-memory.dmp
memory/1788-172-0x0000000005470000-0x000000000557A000-memory.dmp
memory/1788-171-0x0000000005980000-0x0000000005F98000-memory.dmp
memory/1788-170-0x0000000000400000-0x0000000000432000-memory.dmp
memory/1788-187-0x0000000008630000-0x0000000008B5C000-memory.dmp
memory/1788-186-0x0000000007F30000-0x00000000080F2000-memory.dmp
memory/2064-155-0x0000000002DF0000-0x0000000002DF9000-memory.dmp
memory/2064-157-0x0000000000400000-0x0000000002B9D000-memory.dmp
memory/2064-156-0x0000000000400000-0x0000000002B9D000-memory.dmp
memory/2064-154-0x0000000002E5D000-0x0000000002E6E000-memory.dmp
memory/2444-178-0x0000000004920000-0x0000000004A08000-memory.dmp
memory/2444-183-0x0000000000400000-0x0000000002C83000-memory.dmp
memory/2444-180-0x0000000004A10000-0x0000000004B3B000-memory.dmp
memory/2536-150-0x0000000140000000-0x000000014061E000-memory.dmp
memory/2876-204-0x0000000004D30000-0x0000000004E70000-memory.dmp
memory/2876-214-0x00000000067B0000-0x0000000007313000-memory.dmp
memory/2876-211-0x0000000004DA9000-0x0000000004DAB000-memory.dmp
memory/2876-207-0x0000000004D30000-0x0000000004E70000-memory.dmp
memory/2876-201-0x0000000004D30000-0x0000000004E70000-memory.dmp
memory/2876-200-0x0000000004D30000-0x0000000004E70000-memory.dmp
memory/2876-199-0x00000000067B0000-0x0000000007313000-memory.dmp
memory/2876-206-0x0000000004D30000-0x0000000004E70000-memory.dmp
memory/2876-198-0x00000000067B0000-0x0000000007313000-memory.dmp
memory/2876-205-0x0000000004D30000-0x0000000004E70000-memory.dmp
memory/2948-165-0x0000000005E60000-0x0000000006404000-memory.dmp
memory/2948-164-0x0000000000D20000-0x0000000000E3A000-memory.dmp
memory/2948-166-0x00000000057E0000-0x0000000005872000-memory.dmp
memory/2948-167-0x0000000005880000-0x000000000588A000-memory.dmp
memory/2948-168-0x0000000006640000-0x0000000006662000-memory.dmp
memory/4040-193-0x0000020E7B170000-0x0000020E7B177000-memory.dmp
memory/4040-194-0x00007FF4AFDF0000-0x00007FF4AFEEA000-memory.dmp
memory/4040-203-0x00007FFD12EB0000-0x00007FFD12EC2000-memory.dmp
memory/4040-202-0x00007FF4AFDF0000-0x00007FF4AFEEA000-memory.dmp
memory/4332-132-0x0000000002C2E000-0x0000000002C3E000-memory.dmp
memory/4332-133-0x0000000002BF0000-0x0000000002BF9000-memory.dmp
memory/4332-134-0x0000000000400000-0x0000000002BAB000-memory.dmp
memory/4332-135-0x0000000000400000-0x0000000002BAB000-memory.dmp
memory/4332-136-0x0000000002C2E000-0x0000000002C3E000-memory.dmp
memory/4572-209-0x000002B28A030000-0x000002B28A170000-memory.dmp
memory/4572-210-0x000002B28A030000-0x000002B28A170000-memory.dmp
memory/4572-212-0x0000000000210000-0x00000000004A2000-memory.dmp
memory/4572-213-0x000002B2885E0000-0x000002B288883000-memory.dmp
memory/5112-143-0x0000000140000000-0x000000014061E000-memory.dmp