Analysis
- max time kernel
148s - max time network
142s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
22/01/2023, 08:31
General
- Target file.exe
- Size 195KB
- Sample230122-kep7eahd81
- SHA256 d4d1da40ca14ab6d573663c35c934a04f45a204b8a7ffc3b69db72b20a168907
Malware Config
Extracted
-
redline
-
test4
-
104.234.239.119:4986
-
auth_value
a4a22a62027e23c4fae2a8ef8ec10a0a
Extracted
-
redline
-
anydesk-usa
-
89.163.146.82:25313
-
auth_value
3048255396a3eb3d3aa36222e7cab88d
Signatures
- Detect rhadamanthys stealer shellcode 3 IoCs
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
- Executes dropped EXE 10 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops desktop.ini file(s) 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 3 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 46 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 64 IoCs
Processes
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SysWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\3D76.exeC:\Users\Admin\AppData\Local\Temp\3D76.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\3E52.exeC:\Users\Admin\AppData\Local\Temp\3E52.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\3F7C.exeC:\Users\Admin\AppData\Local\Temp\3F7C.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SETUP_17394\Engine.exeC:\Users\Admin\AppData\Local\Temp\SETUP_17394\Engine.exe /TH_ID=_4656 /OriginExe="C:\Users\Admin\AppData\Local\Temp\3F7C.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CmD.exeC:\Windows\system32\CmD.exe /c cmd < 193⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avgui5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode 8 8fXDat5⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^CJMRhqLonMpPtqttXbStBKQHMgyjkobFJmzZkwjOwioVHihRIVWBQcCSTytYVnWdfEyFHyTVltrxBVqFwgEdkVOgWAuu$" 8fXDat5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\hql1put4.xax\8950\Books.exe.pif8950\\Books.exe.pif 8950\\b5⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe6⤵
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 85⤵
- Runs ping.exe
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\4142.exeC:\Users\Admin\AppData\Local\Temp\4142.exe1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 12162⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4172 -s 11562⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\4431.exeC:\Users\Admin\AppData\Local\Temp\4431.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\4431.exeC:\Users\Admin\AppData\Local\Temp\4431.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\4431.exeC:\Users\Admin\AppData\Local\Temp\4431.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 448 -p 4172 -ip 41721⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 516 -p 4172 -ip 41721⤵
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
4431.exe.log
powershell.exe.log
StartupProfileData-NonInteractive
240604843.dll
3D76.exe
3D76.exe
3E52.exe
3E52.exe
3F7C.exe
3F7C.exe
4142.exe
4142.exe
4431.exe
4431.exe
4431.exe
4431.exe
00000#0
00001#19
00002#8
Engine.exe
Engine.exe
Modern_Icon.bmp
Setup.txt
Books.exe.pif
Books.exe.pif
8fXDat
svcupdater.exe
svcupdater.exe
memory/1084-156-0x00000000068B0000-0x0000000006DDC000-memory.dmp
memory/1084-155-0x00000000056F0000-0x0000000005782000-memory.dmp
memory/1084-154-0x0000000005DD0000-0x0000000006374000-memory.dmp
memory/1084-152-0x0000000000C20000-0x0000000000D0E000-memory.dmp
memory/1908-194-0x0000000002AE0000-0x0000000002B16000-memory.dmp
memory/1908-200-0x0000000005D70000-0x0000000005DD6000-memory.dmp
memory/1908-198-0x0000000005560000-0x0000000005B88000-memory.dmp
memory/1908-199-0x0000000005CC0000-0x0000000005CE2000-memory.dmp
memory/1908-213-0x00000000074D0000-0x00000000074F2000-memory.dmp
memory/1908-212-0x0000000007480000-0x000000000749A000-memory.dmp
memory/1908-211-0x0000000007500000-0x0000000007596000-memory.dmp
memory/1908-203-0x0000000006450000-0x000000000646E000-memory.dmp
memory/2256-230-0x0000000000400000-0x000000000046B000-memory.dmp
memory/2256-232-0x00000000006DB000-0x0000000000705000-memory.dmp
memory/2256-229-0x00000000006DB000-0x0000000000705000-memory.dmp
memory/3632-197-0x0000000000400000-0x000000000046B000-memory.dmp
memory/3632-196-0x00000000007CC000-0x00000000007F6000-memory.dmp
memory/3632-182-0x00000000007CC000-0x00000000007F6000-memory.dmp
memory/3632-183-0x0000000000710000-0x0000000000757000-memory.dmp
memory/3632-184-0x0000000000400000-0x000000000046B000-memory.dmp
memory/3828-132-0x0000000002E6F000-0x0000000002E82000-memory.dmp
memory/3828-133-0x0000000002E30000-0x0000000002E39000-memory.dmp
memory/3828-134-0x0000000000400000-0x0000000002B9B000-memory.dmp
memory/3908-231-0x0000000000400000-0x0000000000558000-memory.dmp
memory/3908-202-0x0000000000400000-0x0000000000558000-memory.dmp
memory/3908-163-0x0000000000400000-0x0000000000558000-memory.dmp
memory/4108-205-0x0000000008E80000-0x0000000008EF6000-memory.dmp
memory/4108-201-0x0000000006530000-0x0000000006596000-memory.dmp
memory/4108-206-0x0000000007C00000-0x0000000007C50000-memory.dmp
memory/4108-186-0x0000000000400000-0x000000000043A000-memory.dmp
memory/4152-177-0x0000000005560000-0x0000000005572000-memory.dmp
memory/4152-175-0x0000000005630000-0x000000000573A000-memory.dmp
memory/4152-204-0x0000000006C80000-0x0000000006E42000-memory.dmp
memory/4152-179-0x00000000055C0000-0x00000000055FC000-memory.dmp
memory/4152-169-0x0000000000400000-0x0000000000432000-memory.dmp
memory/4152-172-0x0000000005B00000-0x0000000006118000-memory.dmp
memory/4152-171-0x0000000000400000-0x0000000000432000-memory.dmp
memory/4172-147-0x0000000002780000-0x00000000028CB000-memory.dmp
memory/4172-190-0x0000000002780000-0x00000000028CB000-memory.dmp
memory/4172-192-0x000000000B560000-0x000000000B6A3000-memory.dmp
memory/4172-218-0x0000000002780000-0x00000000028CB000-memory.dmp
memory/4172-151-0x000000000B560000-0x000000000B6A3000-memory.dmp
memory/4172-153-0x000000000B560000-0x000000000B6A3000-memory.dmp
memory/4572-209-0x0000000000C00000-0x0000000000C1D000-memory.dmp
memory/4572-208-0x0000000000400000-0x0000000000431000-memory.dmp
memory/4596-180-0x00000000007C0000-0x00000000007F5000-memory.dmp
memory/4596-189-0x00000000024E0000-0x00000000024FD000-memory.dmp
memory/4596-174-0x00000000007C0000-0x00000000007F5000-memory.dmp
memory/4596-214-0x00000000024E0000-0x00000000024FD000-memory.dmp
memory/4596-187-0x0000000000B13000-0x0000000000B16000-memory.dmp
memory/4596-210-0x00000000007C0000-0x00000000007F5000-memory.dmp
memory/4596-191-0x0000000002AE0000-0x0000000003AE0000-memory.dmp