Analysis
- max time kernel
151s - max time network
154s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
24/01/2023, 13:09
General
- Target file.exe
- Size 175KB
- Sample230124-qdr79sbe34
- SHA256 7eeaa1acd2bb4b5162923958339812e3e2c84f682891c8424b7818f6cf20d068
Malware Config
Extracted
-
vidar
-
2.2
-
237
-
https://t.me/litlebey
-
https://steamcommunity.com/profiles/76561199472399815
-
profile_id
237
Extracted
-
redline
-
anydesk-usa2
-
89.163.146.82:25313
-
auth_value
e3c3767f7d9f3ac06dd9be67e6ea17c0
Signatures
- Detects Smokeloader packer 2 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Executes dropped EXE 7 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Drops desktop.ini file(s) 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Modifies Internet Explorer settings 1 TTPs 4 IoCs
- Modifies registry class 3 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 2 IoCs
- Suspicious use of AdjustPrivilegeToken 45 IoCs
- Suspicious use of FindShellTrayWindow 7 IoCs
- Suspicious use of SendNotifyMessage 3 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 44 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\C4DB.exeC:\Users\Admin\AppData\Local\Temp\C4DB.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn "svcupdater" /tr "C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe" /st 00:00 /du 9999:59 /sc once /ri 1 /f2⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4700 -s 10282⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\C7AB.exeC:\Users\Admin\AppData\Local\Temp\C7AB.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4448 -s 18882⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\C9A0.exeC:\Users\Admin\AppData\Local\Temp\C9A0.exe1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SETUP_28979\Engine.exeC:\Users\Admin\AppData\Local\Temp\SETUP_28979\Engine.exe /TH_ID=_3300 /OriginExe="C:\Users\Admin\AppData\Local\Temp\C9A0.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\CmD.exeC:\Windows\system32\CmD.exe /c cmd < 413⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avastui5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell get-process avgui5⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\certutil.execertutil -decode 7 7JkSB5⤵
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^McNZguVzMAVMcaKBMuiboIAzlxCLPYBWVnkTamWIVDZgkhwKXHhleSstUzPUDlEOZYQXuRpjpmBFIkiWaROiLdUriuYYJeyLYkgjvrDyn$" 7JkSB5⤵
-
-
C:\Users\Admin\AppData\Local\Temp\zurk3hgf.jnl\16880\Private.exe.pif16880\\Private.exe.pif 16880\\D5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe6⤵
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\PING.EXEping localhost -n 85⤵
- Runs ping.exe
-
-
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Drops desktop.ini file(s)
- Checks processor information in registry
- Modifies registry class
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4700 -ip 47001⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 548 -p 4448 -ip 44481⤵
-
C:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exeC:\Users\Admin\AppData\Roaming\Win32Sync\svcupdater.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\ahsifidC:\Users\Admin\AppData\Roaming\ahsifid1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k BcastDVRUserService -s BcastDVRUserService1⤵
- Checks processor information in registry
- Modifies registry class
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
mozglue.dll
nss3.dll
powershell.exe.log
StartupProfileData-NonInteractive
C4DB.exe
C4DB.exe
C7AB.exe
C7AB.exe
C9A0.exe
C9A0.exe
00000#07
00001#41
00002#7
Engine.exe
Engine.exe
Modern_Icon.bmp
Setup.txt
Private.exe.pif
Private.exe.pif
7JkSB
svcupdater.exe
svcupdater.exe
ahsifid
ahsifid
memory/1748-235-0x0000000000D20000-0x0000000000D5A000-memory.dmp
memory/1748-237-0x0000000005E90000-0x00000000064A8000-memory.dmp
memory/1748-238-0x0000000007820000-0x000000000792A000-memory.dmp
memory/1748-239-0x0000000007750000-0x0000000007762000-memory.dmp
memory/1748-240-0x00000000077B0000-0x00000000077EC000-memory.dmp
memory/1748-241-0x0000000007C40000-0x0000000007CD2000-memory.dmp
memory/1748-242-0x0000000008FF0000-0x00000000091B2000-memory.dmp
memory/1748-243-0x00000000096F0000-0x0000000009C1C000-memory.dmp
memory/1748-244-0x0000000008700000-0x0000000008776000-memory.dmp
memory/1748-245-0x0000000005800000-0x0000000005850000-memory.dmp
memory/1804-178-0x00000000058E0000-0x0000000005946000-memory.dmp
memory/1804-176-0x0000000005780000-0x00000000057A2000-memory.dmp
memory/1804-207-0x00000000070D0000-0x0000000007166000-memory.dmp
memory/1804-181-0x0000000005F00000-0x0000000005F1E000-memory.dmp
memory/1804-174-0x0000000004950000-0x0000000004986000-memory.dmp
memory/1804-175-0x00000000050A0000-0x00000000056C8000-memory.dmp
memory/1804-210-0x0000000007720000-0x0000000007CC4000-memory.dmp
memory/1804-177-0x0000000005870000-0x00000000058D6000-memory.dmp
memory/1804-208-0x00000000063F0000-0x000000000640A000-memory.dmp
memory/1804-209-0x0000000006450000-0x0000000006472000-memory.dmp
memory/1932-231-0x00000000005DC000-0x0000000000606000-memory.dmp
memory/1932-232-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4448-206-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-215-0x0000000077340000-0x00000000774E3000-memory.dmp
memory/4448-149-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-148-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-151-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-201-0x0000000077340000-0x00000000774E3000-memory.dmp
memory/4448-158-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-157-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-214-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-152-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-150-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-182-0x0000000060900000-0x0000000060992000-memory.dmp
memory/4448-180-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-153-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-156-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-144-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-155-0x0000000000BF0000-0x0000000001079000-memory.dmp
memory/4448-154-0x0000000077340000-0x00000000774E3000-memory.dmp
memory/4700-165-0x00000000006CD000-0x00000000006F7000-memory.dmp
memory/4700-205-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4700-167-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4700-166-0x00000000005B0000-0x00000000005F7000-memory.dmp
memory/4700-204-0x00000000006CD000-0x00000000006F7000-memory.dmp
memory/5080-216-0x0000000000400000-0x0000000000558000-memory.dmp
memory/5080-164-0x0000000000400000-0x0000000000558000-memory.dmp
memory/5080-228-0x0000000000400000-0x0000000000558000-memory.dmp
memory/5096-233-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/5096-230-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/5096-132-0x0000000002D0D000-0x0000000002D20000-memory.dmp
memory/5096-229-0x0000000002C5D000-0x0000000002C70000-memory.dmp
memory/5096-137-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/5096-136-0x00000000048D0000-0x00000000048D9000-memory.dmp
memory/5096-135-0x0000000002D0D000-0x0000000002D20000-memory.dmp
memory/5096-134-0x0000000000400000-0x0000000002B96000-memory.dmp
memory/5096-133-0x00000000048D0000-0x00000000048D9000-memory.dmp