Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
18-06-2023 11:07
Static task
static1
Behavioral task
behavioral1
Sample
06549799.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
06549799.exe
Resource
win10v2004-20230220-en
General
-
Target
06549799.exe
-
Size
241KB
-
MD5
7d726c8be35f9e9f010363c050ee86b3
-
SHA1
13d73cea5b8d05b338f347cdfc4088cc4f38fcac
-
SHA256
b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027
-
SHA512
a99fd000bf852276d2722e7e75b9577dbac669a12c7db9e52965808aabc7710bfa3956de993f14154143db45ad124f4ed90255332171bb4df57c30707e0a042b
-
SSDEEP
3072:O98WPLTgdxkBH8ZQYTr6DQ6v+UT4i0JKIMuFes7P:XWzcdxkFhCwQC8bMuF
Malware Config
Extracted
smokeloader
summ
Extracted
smokeloader
2022
http://stalagmijesarl.com/
http://ukdantist-sarl.com/
http://cpcorprotationltd.com/
Extracted
redline
Private CLOUD
176.123.9.85:16482
-
auth_value
cf18ee275aee7449ba89afcffb586f89
Extracted
systembc
admex1955x.xyz:4044
servx2785x.xyz:4044
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
1722.exe1D9B.exetccsgdwpid process 2232 1722.exe 1796 1D9B.exe 3908 tccsgdw -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
tccsgdw06549799.exedescription ioc process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tccsgdw Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tccsgdw Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06549799.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06549799.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 06549799.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI tccsgdw -
Modifies registry class 2 IoCs
Processes:
description ioc process Key created \REGISTRY\USER\S-1-5-21-2548970870-3691742953-3895070203-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
06549799.exepid process 1908 06549799.exe 1908 06549799.exe 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3152 -
Suspicious behavior: MapViewOfSection 20 IoCs
Processes:
06549799.exetccsgdwpid process 1908 06549799.exe 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3152 3908 tccsgdw -
Suspicious use of AdjustPrivilegeToken 17 IoCs
Processes:
1722.exedescription pid process Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeDebugPrivilege 2232 1722.exe Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 Token: SeShutdownPrivilege 3152 Token: SeCreatePagefilePrivilege 3152 -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
description pid process target process PID 3152 wrote to memory of 2232 3152 1722.exe PID 3152 wrote to memory of 2232 3152 1722.exe PID 3152 wrote to memory of 2232 3152 1722.exe PID 3152 wrote to memory of 1796 3152 1D9B.exe PID 3152 wrote to memory of 1796 3152 1D9B.exe PID 3152 wrote to memory of 1796 3152 1D9B.exe PID 3152 wrote to memory of 696 3152 explorer.exe PID 3152 wrote to memory of 696 3152 explorer.exe PID 3152 wrote to memory of 696 3152 explorer.exe PID 3152 wrote to memory of 696 3152 explorer.exe PID 3152 wrote to memory of 5088 3152 explorer.exe PID 3152 wrote to memory of 5088 3152 explorer.exe PID 3152 wrote to memory of 5088 3152 explorer.exe PID 3152 wrote to memory of 4404 3152 explorer.exe PID 3152 wrote to memory of 4404 3152 explorer.exe PID 3152 wrote to memory of 4404 3152 explorer.exe PID 3152 wrote to memory of 4404 3152 explorer.exe PID 3152 wrote to memory of 396 3152 explorer.exe PID 3152 wrote to memory of 396 3152 explorer.exe PID 3152 wrote to memory of 396 3152 explorer.exe PID 3152 wrote to memory of 4116 3152 explorer.exe PID 3152 wrote to memory of 4116 3152 explorer.exe PID 3152 wrote to memory of 4116 3152 explorer.exe PID 3152 wrote to memory of 4116 3152 explorer.exe PID 3152 wrote to memory of 3608 3152 explorer.exe PID 3152 wrote to memory of 3608 3152 explorer.exe PID 3152 wrote to memory of 3608 3152 explorer.exe PID 3152 wrote to memory of 3608 3152 explorer.exe PID 3152 wrote to memory of 708 3152 explorer.exe PID 3152 wrote to memory of 708 3152 explorer.exe PID 3152 wrote to memory of 708 3152 explorer.exe PID 3152 wrote to memory of 708 3152 explorer.exe PID 3152 wrote to memory of 4832 3152 explorer.exe PID 3152 wrote to memory of 4832 3152 explorer.exe PID 3152 wrote to memory of 4832 3152 explorer.exe PID 3152 wrote to memory of 5052 3152 explorer.exe PID 3152 wrote to memory of 5052 3152 explorer.exe PID 3152 wrote to memory of 5052 3152 explorer.exe PID 3152 wrote to memory of 5052 3152 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\06549799.exe"C:\Users\Admin\AppData\Local\Temp\06549799.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\1722.exeC:\Users\Admin\AppData\Local\Temp\1722.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1D9B.exeC:\Users\Admin\AppData\Local\Temp\1D9B.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Users\Admin\AppData\Roaming\tccsgdwC:\Users\Admin\AppData\Roaming\tccsgdw1⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\1722.exeFilesize
292KB
MD51ee151e540fb8a6d493508cc8fc3f01e
SHA19e4e5abda0d8bdfa5bbe665090d1439b18444d3b
SHA256989a523988a932ceeb8bdf419d97bdca303da7f23ddcd4d14539e607d03020cb
SHA51236c201fc02ab6ffd2ef2ae79a00f0c482768209e0caa6ef4516a0489d782f781c688967f47ea1dbc7f1a675d0e3119108c867fdeba31418c6239b4b312db4466
-
C:\Users\Admin\AppData\Local\Temp\1722.exeFilesize
292KB
MD51ee151e540fb8a6d493508cc8fc3f01e
SHA19e4e5abda0d8bdfa5bbe665090d1439b18444d3b
SHA256989a523988a932ceeb8bdf419d97bdca303da7f23ddcd4d14539e607d03020cb
SHA51236c201fc02ab6ffd2ef2ae79a00f0c482768209e0caa6ef4516a0489d782f781c688967f47ea1dbc7f1a675d0e3119108c867fdeba31418c6239b4b312db4466
-
C:\Users\Admin\AppData\Local\Temp\1D9B.exeFilesize
248KB
MD5aba61284cec3036dae80ece91256cf35
SHA11ccbcd2605d623ada8ecbcace5c1ff1f082c9e2d
SHA256835089cc52af94cdcdf26ab335f8a4fe4719071746539acf472579fa2fc8e4f9
SHA5128f57b93b11df6d5aa2686afeb156310bea2f65ed6e17f6b27d1a5089a0d729057f255c9169d797f62c72263ccd4a90fa7203708ebaf3c13521825e1f65a42331
-
C:\Users\Admin\AppData\Local\Temp\1D9B.exeFilesize
248KB
MD5aba61284cec3036dae80ece91256cf35
SHA11ccbcd2605d623ada8ecbcace5c1ff1f082c9e2d
SHA256835089cc52af94cdcdf26ab335f8a4fe4719071746539acf472579fa2fc8e4f9
SHA5128f57b93b11df6d5aa2686afeb156310bea2f65ed6e17f6b27d1a5089a0d729057f255c9169d797f62c72263ccd4a90fa7203708ebaf3c13521825e1f65a42331
-
C:\Users\Admin\AppData\Roaming\tccsgdwFilesize
241KB
MD57d726c8be35f9e9f010363c050ee86b3
SHA113d73cea5b8d05b338f347cdfc4088cc4f38fcac
SHA256b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027
SHA512a99fd000bf852276d2722e7e75b9577dbac669a12c7db9e52965808aabc7710bfa3956de993f14154143db45ad124f4ed90255332171bb4df57c30707e0a042b
-
C:\Users\Admin\AppData\Roaming\tccsgdwFilesize
241KB
MD57d726c8be35f9e9f010363c050ee86b3
SHA113d73cea5b8d05b338f347cdfc4088cc4f38fcac
SHA256b2c3517bb90933390df4eb01c6ba36f2a519a69b5bcee703f4889b8336cb7027
SHA512a99fd000bf852276d2722e7e75b9577dbac669a12c7db9e52965808aabc7710bfa3956de993f14154143db45ad124f4ed90255332171bb4df57c30707e0a042b
-
memory/396-182-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/396-183-0x0000000000D90000-0x0000000000D9C000-memory.dmpFilesize
48KB
-
memory/396-206-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/396-181-0x0000000000D90000-0x0000000000D9C000-memory.dmpFilesize
48KB
-
memory/696-166-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB
-
memory/696-169-0x0000000000BA0000-0x0000000000BA5000-memory.dmpFilesize
20KB
-
memory/696-170-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB
-
memory/708-193-0x0000000000E70000-0x0000000000E7B000-memory.dmpFilesize
44KB
-
memory/708-194-0x0000000000E70000-0x0000000000E7B000-memory.dmpFilesize
44KB
-
memory/1796-167-0x0000000000BA0000-0x0000000000BA5000-memory.dmpFilesize
20KB
-
memory/1796-162-0x0000000000B80000-0x0000000000B95000-memory.dmpFilesize
84KB
-
memory/1796-201-0x0000000000400000-0x0000000000924000-memory.dmpFilesize
5.1MB
-
memory/1908-136-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/1908-134-0x0000000000530000-0x0000000000539000-memory.dmpFilesize
36KB
-
memory/2232-189-0x0000000007720000-0x000000000773E000-memory.dmpFilesize
120KB
-
memory/2232-177-0x0000000005FB0000-0x0000000006026000-memory.dmpFilesize
472KB
-
memory/2232-155-0x00000000049F0000-0x0000000005008000-memory.dmpFilesize
6.1MB
-
memory/2232-174-0x0000000005870000-0x0000000005E14000-memory.dmpFilesize
5.6MB
-
memory/2232-175-0x0000000005E90000-0x0000000005F22000-memory.dmpFilesize
584KB
-
memory/2232-176-0x0000000005F50000-0x0000000005FA0000-memory.dmpFilesize
320KB
-
memory/2232-150-0x0000000000400000-0x0000000000448000-memory.dmpFilesize
288KB
-
memory/2232-202-0x0000000005290000-0x00000000052A0000-memory.dmpFilesize
64KB
-
memory/2232-165-0x0000000005290000-0x00000000052A0000-memory.dmpFilesize
64KB
-
memory/2232-151-0x00000000006A0000-0x00000000006C6000-memory.dmpFilesize
152KB
-
memory/2232-173-0x0000000005360000-0x00000000053C6000-memory.dmpFilesize
408KB
-
memory/2232-157-0x0000000005050000-0x000000000515A000-memory.dmpFilesize
1.0MB
-
memory/2232-156-0x0000000005010000-0x0000000005022000-memory.dmpFilesize
72KB
-
memory/2232-163-0x0000000005160000-0x000000000519C000-memory.dmpFilesize
240KB
-
memory/2232-188-0x0000000007130000-0x000000000765C000-memory.dmpFilesize
5.2MB
-
memory/2232-187-0x0000000006F60000-0x0000000007122000-memory.dmpFilesize
1.8MB
-
memory/3152-220-0x0000000003170000-0x0000000003186000-memory.dmpFilesize
88KB
-
memory/3152-135-0x0000000003000000-0x0000000003016000-memory.dmpFilesize
88KB
-
memory/3608-190-0x0000000000DA0000-0x0000000000DA9000-memory.dmpFilesize
36KB
-
memory/3608-191-0x0000000000860000-0x0000000000887000-memory.dmpFilesize
156KB
-
memory/3608-208-0x0000000000860000-0x0000000000887000-memory.dmpFilesize
156KB
-
memory/3608-192-0x0000000000DA0000-0x0000000000DA9000-memory.dmpFilesize
36KB
-
memory/3908-221-0x0000000000400000-0x00000000004B2000-memory.dmpFilesize
712KB
-
memory/4116-207-0x0000000000D90000-0x0000000000D9C000-memory.dmpFilesize
48KB
-
memory/4116-186-0x0000000000860000-0x0000000000887000-memory.dmpFilesize
156KB
-
memory/4116-185-0x0000000000D90000-0x0000000000D9C000-memory.dmpFilesize
48KB
-
memory/4116-184-0x0000000000860000-0x0000000000887000-memory.dmpFilesize
156KB
-
memory/4404-180-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/4404-179-0x00000000003D0000-0x00000000003DF000-memory.dmpFilesize
60KB
-
memory/4404-178-0x0000000000800000-0x0000000000809000-memory.dmpFilesize
36KB
-
memory/4832-196-0x0000000000E70000-0x0000000000E7B000-memory.dmpFilesize
44KB
-
memory/4832-197-0x0000000000EC0000-0x0000000000ECD000-memory.dmpFilesize
52KB
-
memory/4832-209-0x0000000000E70000-0x0000000000E7B000-memory.dmpFilesize
44KB
-
memory/4832-195-0x0000000000EC0000-0x0000000000ECD000-memory.dmpFilesize
52KB
-
memory/5052-200-0x0000000000A30000-0x0000000000A3B000-memory.dmpFilesize
44KB
-
memory/5052-210-0x0000000000EC0000-0x0000000000ECD000-memory.dmpFilesize
52KB
-
memory/5052-198-0x0000000000A30000-0x0000000000A3B000-memory.dmpFilesize
44KB
-
memory/5052-199-0x0000000000EC0000-0x0000000000ECD000-memory.dmpFilesize
52KB
-
memory/5088-172-0x00000000003D0000-0x00000000003DF000-memory.dmpFilesize
60KB
-
memory/5088-205-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB
-
memory/5088-168-0x00000000003D0000-0x00000000003DF000-memory.dmpFilesize
60KB
-
memory/5088-171-0x00000000009A0000-0x00000000009AB000-memory.dmpFilesize
44KB