Analysis
- max time kernel
150s - max time network
141s - platform
windows10-2004_x64 - resource
win10v2004-20221111-en - resource tags
- submitted
26/01/2023, 13:26
General
- Target ad7ad9ea4165831a7da49fca41b53007.exe
- Size 327KB
- Sample230126-qph4qsdg39
- SHA256 050c2acd0f467ab6089c32fa9b0921bb1685ef697b6ef2ed7509db4e18eaff9e
Malware Config
Extracted
-
redline
-
89.22.232.230:5354
-
auth_value
07d01b32b2ff529d6407981274d9acf7
Signatures
- Detect rhadamanthys stealer shellcode 3 IoCs
- Detects Smokeloader packer 1 IoCs
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Rhadamanthys
Rhadamanthys is an info stealer written in C++ first seen in August 2022.
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
- Suspicious use of SetThreadContext 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 8 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 19 IoCs
- Suspicious use of AdjustPrivilegeToken 17 IoCs
- Suspicious use of WriteProcessMemory 54 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad7ad9ea4165831a7da49fca41b53007.exe"C:\Users\Admin\AppData\Local\Temp\ad7ad9ea4165831a7da49fca41b53007.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\F457.exeC:\Users\Admin\AppData\Local\Temp\F457.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\FD9F.exeC:\Users\Admin\AppData\Local\Temp\FD9F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FD9F.exe"C:\Users\Admin\AppData\Local\Temp\FD9F.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\198.exeC:\Users\Admin\AppData\Local\Temp\198.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks SCSI registry key(s)
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
FD9F.exe.log
198.exe
198.exe
F457.exe
F457.exe
FD9F.exe
FD9F.exe
FD9F.exe
memory/544-197-0x0000000000430000-0x0000000000437000-memory.dmp
memory/544-185-0x0000000000420000-0x000000000042D000-memory.dmp
memory/544-184-0x0000000000430000-0x0000000000437000-memory.dmp
memory/1124-193-0x0000000000E80000-0x0000000000E86000-memory.dmp
memory/1124-173-0x0000000000E80000-0x0000000000E86000-memory.dmp
memory/1124-174-0x0000000000BF0000-0x0000000000BFC000-memory.dmp
memory/1384-192-0x0000000000200000-0x0000000000205000-memory.dmp
memory/1384-168-0x00000000001F0000-0x00000000001F9000-memory.dmp
memory/1384-167-0x0000000000200000-0x0000000000205000-memory.dmp
memory/1392-195-0x00000000012E0000-0x00000000012E5000-memory.dmp
memory/1392-179-0x00000000012D0000-0x00000000012D9000-memory.dmp
memory/1392-178-0x00000000012E0000-0x00000000012E5000-memory.dmp
memory/1576-177-0x0000000000A00000-0x0000000000A22000-memory.dmp
memory/1576-175-0x00000000007D0000-0x00000000007F7000-memory.dmp
memory/1576-194-0x0000000000A00000-0x0000000000A22000-memory.dmp
memory/2716-204-0x0000000005DC0000-0x00000000063D8000-memory.dmp
memory/2716-209-0x0000000006A50000-0x0000000006C12000-memory.dmp
memory/2716-210-0x00000000077F0000-0x0000000007D1C000-memory.dmp
memory/2716-205-0x00000000058B0000-0x00000000059BA000-memory.dmp
memory/2716-211-0x0000000006C20000-0x0000000006C96000-memory.dmp
memory/2716-201-0x0000000000400000-0x0000000000432000-memory.dmp
memory/2716-208-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/2716-212-0x0000000006990000-0x00000000069E0000-memory.dmp
memory/2716-207-0x0000000005800000-0x000000000583C000-memory.dmp
memory/2716-206-0x00000000057A0000-0x00000000057B2000-memory.dmp
memory/3140-162-0x0000000000400000-0x0000000000437000-memory.dmp
memory/3140-169-0x0000000000FD0000-0x0000000000FED000-memory.dmp
memory/3140-166-0x0000000001065000-0x0000000001068000-memory.dmp
memory/3140-157-0x0000000000400000-0x0000000000437000-memory.dmp
memory/3140-172-0x0000000002C90000-0x0000000003C90000-memory.dmp
memory/3140-189-0x0000000000FD0000-0x0000000000FED000-memory.dmp
memory/3420-152-0x0000000000BE1000-0x0000000000BE3000-memory.dmp
memory/3500-196-0x0000000000E20000-0x0000000000E26000-memory.dmp
memory/3500-182-0x0000000000E10000-0x0000000000E1B000-memory.dmp
memory/3500-181-0x0000000000E20000-0x0000000000E26000-memory.dmp
memory/3668-154-0x0000000000AC0000-0x0000000000ACB000-memory.dmp
memory/3668-153-0x0000000000AD0000-0x0000000000AD7000-memory.dmp
memory/3668-190-0x0000000000AD0000-0x0000000000AD7000-memory.dmp
memory/3724-199-0x0000000005860000-0x00000000058FC000-memory.dmp
memory/3724-150-0x0000000004C80000-0x0000000004C8A000-memory.dmp
memory/3724-146-0x0000000004D00000-0x0000000004D92000-memory.dmp
memory/3724-145-0x0000000005210000-0x00000000057B4000-memory.dmp
memory/3724-144-0x00000000001F0000-0x00000000002CA000-memory.dmp
memory/3780-198-0x0000000000A70000-0x0000000000A78000-memory.dmp
memory/3780-188-0x0000000000A60000-0x0000000000A6B000-memory.dmp
memory/3780-187-0x0000000000A70000-0x0000000000A78000-memory.dmp
memory/4048-163-0x0000000000190000-0x0000000000199000-memory.dmp
memory/4048-164-0x0000000000180000-0x000000000018F000-memory.dmp
memory/4048-191-0x0000000000190000-0x0000000000199000-memory.dmp
memory/4680-140-0x00007FF9C61E0000-0x00007FF9C6CA1000-memory.dmp
memory/4680-139-0x0000000000420000-0x0000000000428000-memory.dmp
memory/4708-135-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4708-133-0x0000000002190000-0x0000000002199000-memory.dmp
memory/4708-134-0x0000000000400000-0x0000000000459000-memory.dmp
memory/4708-132-0x000000000051E000-0x0000000000534000-memory.dmp