Analysis
- max time kernel
145s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
19/01/2023, 14:36
General
- Target 9ff0d3a6d7c3983c9f6b3356848567ed.exe
- Size 175KB
- Sample230119-rykvcsgc48
- SHA256 cc79cf72d90edccbc4fda4e80ac4a9ea04962bfab100f03165066c4f04008176
Malware Config
Extracted
-
redline
-
test3
-
104.234.239.119:4986
-
auth_value
1bff3660d51d63e897338f2859fd6773
Extracted
-
redline
-
test
-
179.43.155.187:29771
-
auth_value
5280e932f4edb49ec694375fda12b68a
Signatures
- Detect rhadamanthys stealer shellcode 3 IoCs
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Blocklisted process makes network request 1 IoCs
- Executes dropped EXE 6 IoCs
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 6 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 4 IoCs
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 42 IoCs
- Suspicious use of WriteProcessMemory 37 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\9ff0d3a6d7c3983c9f6b3356848567ed.exe"C:\Users\Admin\AppData\Local\Temp\9ff0d3a6d7c3983c9f6b3356848567ed.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5F37.exeC:\Users\Admin\AppData\Local\Temp\5F37.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\rundll32.exe"C:\Users\Admin\AppData\Roaming\nsis_unse57ad09.dll",PrintUIEntry |5CQkOhmAAAA|1TKr5GsMwYD|67sDqg8OAAl|xYmwxC0TNSO|1k8B3tZkgiyf2sAZQByAG4XAP9sADMAMgAuAKVkHwBs8|AtBQPz8DD+JwAyAEQASwA3qwBoIwBqIQA5OwBo|EUALQFZSIPsKOj|BAIAAEiDxCj|w8zMzEyJRCT|GEiJVCQQSIn3TCQIXQFIi0Qk3zBIiQQkgQE4SH5vAAhIx0QkEC0B++sOgQEQSIPAAbqPARCBAUBIOZYAc|0lnwOLDCRIA8i|SIvBSItMqwFU|nsAA9FIi8qKCe+ICOvBZgVlSIv3BCVg8|AzyUiL|1AYSDvRdDZI|4PCIEiLAkg7|8J0KmaDeEgY|3UaTItAUGZB34M4a3QHERFLdf0IERB4EC50BUh|iwDr1UiLSP0A|cFqAEBTVVZXQX9UQVVBVkFXXQH|ZoE5TVpNi|j|TIvySIvZD4X9|PPwTGNJPEGB|zwJUEUAAA+Fferz8EGLhAmI8|D|hcBIjTwBD4S91moRg7wJjC0BD|uEx|PwRItnIET|i18ci3ckRIv|TxhMA+FMA9n|SAPxM8lFhcn3D4Sk8|BNi8RB|4sQRTPSSAPT|4oChMB0HUHB38oND77A+gABRPsD0L8RdexBgfr|qvwNfHQOg8H|AUmDwARBO8n|c2nrxovBD7f|DE5FiyyLTAPf63RYM+2qEHRR90GLFMEA0zPJiv8CTIvC6w|ByfbIEQPI5RABQYoA|tUQ7TPAM|ZBO|MMtuAQpgCDxgGD||gIcu7rCkiL|8tB|9VJiQT3+4PF5BDEBDtvGPtyr2YBQV9BXkF|XUFcX15dWzMX30iB7GABZACL6f|oZv7||0iFwLcPhJh1IEyNrwGLvisQyDP|6Jt9II3|XwRMjUVGM9K|i8v|VCRogCBMX4vgD4RrdSBFqBDvM8CL05EgSIl86yQgpiBwgCBIi|DnD4RLdSCmIFBIjf9WCESNR0BIjfuMJIURSIvY6Hxd|X4gjVZI3iAQ4iHtzPPw6GfvIESLBqeNVwhBIKYgWMohideEJICHEt7z8IsOHtogWImMJHERBzCRINvoMe8gi5wtMkyLf106SIP7bEiKIP8wTIlkJDhMi92kGjJMiVyEAYQkbdyHEYaSjRGNR0sw94wk8PPwSYvU6Nvp|AUwipx4MkiN|YR4MkGA8yGNT+9sRDAYpAKD6QHvdfOBvHgyIVJlf3h1TYuEJPQiMfeUJPg1AcJIO9j|cjiD+mx2M0T3jUlA+gCUQbgA9JgApiBAyiL4dBlEfLYwwDFJjVQkbJEgv0mD6Gzoa4IwSPuLzqYgeEiF|3SfEotVQkyOMBsxSP+NTCRA|9dIgQHEdCFhJC0ILQE=2⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Checks processor information in registry
- outlook_office_path
- outlook_win_path
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3432 -s 5923⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\6003.exeC:\Users\Admin\AppData\Local\Temp\6003.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\6003.exeC:\Users\Admin\AppData\Local\Temp\6003.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\60BF.exeC:\Users\Admin\AppData\Local\Temp\60BF.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4184 -s 10402⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\6312.exeC:\Users\Admin\AppData\Local\Temp\6312.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 12842⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 12322⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4708 -ip 47081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 532 -p 4708 -ip 47081⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4184 -ip 41841⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 184 -p 3432 -ip 34321⤵
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
6003.exe.log
240611687.dll
5F37.exe
5F37.exe
6003.exe
6003.exe
6003.exe
60BF.exe
60BF.exe
6312.exe
6312.exe
svcupdater.exe
svcupdater.exe
nsis_unse57ad09.dll
nsis_unse57ad09.dll
memory/204-215-0x0000000002E7D000-0x0000000002EA7000-memory.dmp
memory/3060-183-0x0000000002AF0000-0x0000000003AF0000-memory.dmp
memory/3060-185-0x0000000000750000-0x0000000000785000-memory.dmp
memory/3060-180-0x0000000000F95000-0x0000000000F97000-memory.dmp
memory/3060-181-0x0000000000C50000-0x0000000000C6D000-memory.dmp
memory/3060-174-0x0000000000F95000-0x0000000000F97000-memory.dmp
memory/3060-172-0x0000000000750000-0x0000000000785000-memory.dmp
memory/3060-170-0x0000000000750000-0x0000000000785000-memory.dmp
memory/3136-193-0x0000000006AD0000-0x0000000006B20000-memory.dmp
memory/3136-165-0x0000000005780000-0x0000000005792000-memory.dmp
memory/3136-160-0x0000000000400000-0x0000000000432000-memory.dmp
memory/3136-192-0x0000000006A50000-0x0000000006AC6000-memory.dmp
memory/3136-162-0x0000000005CD0000-0x00000000062E8000-memory.dmp
memory/3136-187-0x0000000007160000-0x0000000007322000-memory.dmp
memory/3136-164-0x0000000005850000-0x000000000595A000-memory.dmp
memory/3136-166-0x00000000057E0000-0x000000000581C000-memory.dmp
memory/3136-158-0x0000000000400000-0x0000000000432000-memory.dmp
memory/3136-188-0x0000000007860000-0x0000000007D8C000-memory.dmp
memory/3432-212-0x00007FF986200000-0x00007FF986212000-memory.dmp
memory/3432-197-0x000001E1A1A10000-0x000001E1A1A17000-memory.dmp
memory/3432-211-0x00007FF456C00000-0x00007FF456CFA000-memory.dmp
memory/3432-199-0x00007FF456C00000-0x00007FF456CFA000-memory.dmp
memory/3664-150-0x0000000005010000-0x00000000050A2000-memory.dmp
memory/3664-146-0x0000000005520000-0x0000000005AC4000-memory.dmp
memory/3664-145-0x0000000000640000-0x0000000000648000-memory.dmp
memory/3664-151-0x00000000051A0000-0x00000000051AA000-memory.dmp
memory/3664-155-0x0000000006A20000-0x0000000006A42000-memory.dmp
memory/3736-132-0x0000000002C0E000-0x0000000002C1E000-memory.dmp
memory/3736-133-0x0000000002D50000-0x0000000002D59000-memory.dmp
memory/3736-134-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/3736-135-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/4048-208-0x0000000000400000-0x0000000000432000-memory.dmp
memory/4184-203-0x0000000000400000-0x0000000002BB0000-memory.dmp
memory/4184-198-0x0000000002C3D000-0x0000000002C67000-memory.dmp
memory/4184-205-0x0000000000400000-0x0000000002BB0000-memory.dmp
memory/4184-179-0x0000000000400000-0x0000000002BB0000-memory.dmp
memory/4184-178-0x00000000046D0000-0x0000000004718000-memory.dmp
memory/4184-177-0x0000000002C3D000-0x0000000002C67000-memory.dmp
memory/4184-206-0x0000000002C3D000-0x0000000002C67000-memory.dmp
memory/4528-201-0x000000000095F000-0x0000000000971000-memory.dmp
memory/4528-190-0x0000000002530000-0x000000000254D000-memory.dmp
memory/4528-189-0x000000000095F000-0x0000000000971000-memory.dmp
memory/4528-186-0x0000000000560000-0x0000000000591000-memory.dmp
memory/4528-202-0x0000000002530000-0x000000000254D000-memory.dmp
memory/4528-200-0x0000000000560000-0x0000000000591000-memory.dmp
memory/4708-191-0x0000000002290000-0x00000000023FC000-memory.dmp
memory/4708-153-0x000000000AF20000-0x000000000B063000-memory.dmp
memory/4708-184-0x000000000AF20000-0x000000000B063000-memory.dmp
memory/4708-182-0x0000000002290000-0x00000000023FC000-memory.dmp
memory/4708-152-0x0000000002290000-0x00000000023FC000-memory.dmp
memory/4708-154-0x000000000AF20000-0x000000000B063000-memory.dmp
memory/5008-173-0x00000000066C0000-0x00000000066DE000-memory.dmp
memory/5008-175-0x0000000007FB0000-0x000000000862A000-memory.dmp
memory/5008-176-0x0000000006C30000-0x0000000006C4A000-memory.dmp
memory/5008-169-0x0000000006120000-0x0000000006186000-memory.dmp
memory/5008-168-0x0000000006040000-0x00000000060A6000-memory.dmp
memory/5008-163-0x00000000058C0000-0x0000000005EE8000-memory.dmp
memory/5008-161-0x0000000003170000-0x00000000031A6000-memory.dmp