Analysis
-
max time kernel
300s -
max time network
308s -
platform
windows10-1703_x64 -
resource
win10-20230831-en -
resource tags
arch:x64arch:x86image:win10-20230831-enlocale:en-usos:windows10-1703-x64system -
submitted
03-09-2023 22:00
Static task
static1
Behavioral task
behavioral1
Sample
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe
Resource
win10-20230831-en
General
-
Target
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe
-
Size
207KB
-
MD5
29f9c469d2695d3d90204fd2f7226efd
-
SHA1
4ec4b5892bbeac6e37e8c609b54648bf40a123bb
-
SHA256
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4
-
SHA512
b29421b982a1801ecb957c2868c9987c187979258f16e3493f2456e8ffaa0cee78da4129aba2b2e726351ba807ec813eaa5a375b36c24f2035a6eb0cd503f7cc
-
SSDEEP
3072:rDVjvYR+L4xC/yx9J2pJgZwl36OkjfWVEEcoTyYR:fCR+L4CMqBN6Ok6VeM9
Malware Config
Extracted
smokeloader
summ
Extracted
smokeloader
2022
http://stalagmijesarl.com/
http://ukdantist-sarl.com/
http://cpcorprotationltd.com/
Extracted
redline
installs
162.55.189.218:26952
-
auth_value
4bdfa4191a2826ff2af143a4691bab78
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
Processes:
pid process 3228 -
Executes dropped EXE 3 IoCs
Processes:
56C6.exe7B85.exe9FB8.exepid process 2088 56C6.exe 2124 7B85.exe 2676 9FB8.exe -
Uses the VBS compiler for execution 1 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
56C6.exe7B85.exe9FB8.exedescription pid process target process PID 2088 set thread context of 2084 2088 56C6.exe AppLaunch.exe PID 2124 set thread context of 4844 2124 7B85.exe vbc.exe PID 2676 set thread context of 3364 2676 9FB8.exe vbc.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exepid process 2920 75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe 2920 75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3228 -
Suspicious behavior: MapViewOfSection 19 IoCs
Processes:
75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exepid process 2920 75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 3228 -
Suspicious use of AdjustPrivilegeToken 14 IoCs
Processes:
description pid process Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 Token: SeShutdownPrivilege 3228 Token: SeCreatePagefilePrivilege 3228 -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
56C6.exe7B85.exe9FB8.exedescription pid process target process PID 3228 wrote to memory of 2088 3228 56C6.exe PID 3228 wrote to memory of 2088 3228 56C6.exe PID 3228 wrote to memory of 2088 3228 56C6.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 2088 wrote to memory of 2084 2088 56C6.exe AppLaunch.exe PID 3228 wrote to memory of 2124 3228 7B85.exe PID 3228 wrote to memory of 2124 3228 7B85.exe PID 3228 wrote to memory of 2124 3228 7B85.exe PID 2124 wrote to memory of 4844 2124 7B85.exe vbc.exe PID 2124 wrote to memory of 4844 2124 7B85.exe vbc.exe PID 2124 wrote to memory of 4844 2124 7B85.exe vbc.exe PID 2124 wrote to memory of 4844 2124 7B85.exe vbc.exe PID 2124 wrote to memory of 4844 2124 7B85.exe vbc.exe PID 3228 wrote to memory of 2676 3228 9FB8.exe PID 3228 wrote to memory of 2676 3228 9FB8.exe PID 3228 wrote to memory of 2676 3228 9FB8.exe PID 2676 wrote to memory of 3364 2676 9FB8.exe vbc.exe PID 2676 wrote to memory of 3364 2676 9FB8.exe vbc.exe PID 2676 wrote to memory of 3364 2676 9FB8.exe vbc.exe PID 2676 wrote to memory of 3364 2676 9FB8.exe vbc.exe PID 2676 wrote to memory of 3364 2676 9FB8.exe vbc.exe PID 3228 wrote to memory of 2532 3228 explorer.exe PID 3228 wrote to memory of 2532 3228 explorer.exe PID 3228 wrote to memory of 2532 3228 explorer.exe PID 3228 wrote to memory of 2532 3228 explorer.exe PID 3228 wrote to memory of 4128 3228 explorer.exe PID 3228 wrote to memory of 4128 3228 explorer.exe PID 3228 wrote to memory of 4128 3228 explorer.exe PID 3228 wrote to memory of 4916 3228 explorer.exe PID 3228 wrote to memory of 4916 3228 explorer.exe PID 3228 wrote to memory of 4916 3228 explorer.exe PID 3228 wrote to memory of 4916 3228 explorer.exe PID 3228 wrote to memory of 4944 3228 explorer.exe PID 3228 wrote to memory of 4944 3228 explorer.exe PID 3228 wrote to memory of 4944 3228 explorer.exe PID 3228 wrote to memory of 4220 3228 explorer.exe PID 3228 wrote to memory of 4220 3228 explorer.exe PID 3228 wrote to memory of 4220 3228 explorer.exe PID 3228 wrote to memory of 4220 3228 explorer.exe PID 3228 wrote to memory of 2968 3228 explorer.exe PID 3228 wrote to memory of 2968 3228 explorer.exe PID 3228 wrote to memory of 2968 3228 explorer.exe PID 3228 wrote to memory of 2968 3228 explorer.exe PID 3228 wrote to memory of 1524 3228 explorer.exe PID 3228 wrote to memory of 1524 3228 explorer.exe PID 3228 wrote to memory of 1524 3228 explorer.exe PID 3228 wrote to memory of 1524 3228 explorer.exe PID 3228 wrote to memory of 2920 3228 explorer.exe PID 3228 wrote to memory of 2920 3228 explorer.exe PID 3228 wrote to memory of 2920 3228 explorer.exe PID 3228 wrote to memory of 4428 3228 explorer.exe PID 3228 wrote to memory of 4428 3228 explorer.exe PID 3228 wrote to memory of 4428 3228 explorer.exe PID 3228 wrote to memory of 4428 3228 explorer.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe"C:\Users\Admin\AppData\Local\Temp\75f1b83365dc9f8867aae86d9b8234f544d0b193743bfb012d31a258652d2bc4.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\56C6.exeC:\Users\Admin\AppData\Local\Temp\56C6.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\7B85.exeC:\Users\Admin\AppData\Local\Temp\7B85.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\9FB8.exeC:\Users\Admin\AppData\Local\Temp\9FB8.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\56C6.exeFilesize
380KB
MD580c339b9cfb70abfcb04639c45ed43cd
SHA18528245af0095d13719df2d074783e7e3e3b7b9c
SHA25675dd991971cab83f49b214ca6e3dca575395db63514e334f8b0065478af6f077
SHA5124a54f03886aed7af2ff71e7f36e9193194c11ebf1d924922bdb8d5a0b70a73d001db3c263dbb193c188c6fe52070435da2771a6ecdba8310b40f7a5ef7f80c4e
-
C:\Users\Admin\AppData\Local\Temp\56C6.exeFilesize
380KB
MD580c339b9cfb70abfcb04639c45ed43cd
SHA18528245af0095d13719df2d074783e7e3e3b7b9c
SHA25675dd991971cab83f49b214ca6e3dca575395db63514e334f8b0065478af6f077
SHA5124a54f03886aed7af2ff71e7f36e9193194c11ebf1d924922bdb8d5a0b70a73d001db3c263dbb193c188c6fe52070435da2771a6ecdba8310b40f7a5ef7f80c4e
-
C:\Users\Admin\AppData\Local\Temp\7B85.exeFilesize
1.9MB
MD5d9109db79ab552695a226bd2bde10c92
SHA1b8c11f99a04dee0ce953bcd2190dbca955924110
SHA2561405601f7d6dde64021d6ee307c7fbf7b7f00d62a90404bbd685c225b49fdbc3
SHA5129dc1c49ebd74a0fc7fada4aaacb703f0ffc03780b658e0a5d422694b562b4fb9d7dc9ddfadc9083855bbefae4f7c65ca45a116a1250e17f7f3f6a7f3cbd344a3
-
C:\Users\Admin\AppData\Local\Temp\7B85.exeFilesize
1.9MB
MD5d9109db79ab552695a226bd2bde10c92
SHA1b8c11f99a04dee0ce953bcd2190dbca955924110
SHA2561405601f7d6dde64021d6ee307c7fbf7b7f00d62a90404bbd685c225b49fdbc3
SHA5129dc1c49ebd74a0fc7fada4aaacb703f0ffc03780b658e0a5d422694b562b4fb9d7dc9ddfadc9083855bbefae4f7c65ca45a116a1250e17f7f3f6a7f3cbd344a3
-
C:\Users\Admin\AppData\Local\Temp\9FB8.exeFilesize
1.9MB
MD5d9109db79ab552695a226bd2bde10c92
SHA1b8c11f99a04dee0ce953bcd2190dbca955924110
SHA2561405601f7d6dde64021d6ee307c7fbf7b7f00d62a90404bbd685c225b49fdbc3
SHA5129dc1c49ebd74a0fc7fada4aaacb703f0ffc03780b658e0a5d422694b562b4fb9d7dc9ddfadc9083855bbefae4f7c65ca45a116a1250e17f7f3f6a7f3cbd344a3
-
C:\Users\Admin\AppData\Local\Temp\9FB8.exeFilesize
1.9MB
MD5d9109db79ab552695a226bd2bde10c92
SHA1b8c11f99a04dee0ce953bcd2190dbca955924110
SHA2561405601f7d6dde64021d6ee307c7fbf7b7f00d62a90404bbd685c225b49fdbc3
SHA5129dc1c49ebd74a0fc7fada4aaacb703f0ffc03780b658e0a5d422694b562b4fb9d7dc9ddfadc9083855bbefae4f7c65ca45a116a1250e17f7f3f6a7f3cbd344a3
-
memory/1524-370-0x0000000000F50000-0x0000000000F59000-memory.dmpFilesize
36KB
-
memory/1524-320-0x0000000000F50000-0x0000000000F59000-memory.dmpFilesize
36KB
-
memory/1524-321-0x0000000000940000-0x000000000094B000-memory.dmpFilesize
44KB
-
memory/1524-318-0x0000000000940000-0x000000000094B000-memory.dmpFilesize
44KB
-
memory/2084-25-0x000000000F0E0000-0x000000000F6E6000-memory.dmpFilesize
6.0MB
-
memory/2084-26-0x000000000EC10000-0x000000000ED1A000-memory.dmpFilesize
1.0MB
-
memory/2084-28-0x000000000EB40000-0x000000000EB52000-memory.dmpFilesize
72KB
-
memory/2084-27-0x0000000009740000-0x0000000009750000-memory.dmpFilesize
64KB
-
memory/2084-29-0x000000000EBA0000-0x000000000EBDE000-memory.dmpFilesize
248KB
-
memory/2084-30-0x000000000ED20000-0x000000000ED6B000-memory.dmpFilesize
300KB
-
memory/2084-51-0x0000000009740000-0x0000000009750000-memory.dmpFilesize
64KB
-
memory/2084-24-0x0000000006FE0000-0x0000000006FE6000-memory.dmpFilesize
24KB
-
memory/2084-23-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/2084-49-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/2084-19-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/2124-39-0x0000000001010000-0x00000000011FF000-memory.dmpFilesize
1.9MB
-
memory/2124-48-0x0000000001010000-0x00000000011FF000-memory.dmpFilesize
1.9MB
-
memory/2532-281-0x0000000000120000-0x000000000012B000-memory.dmpFilesize
44KB
-
memory/2532-280-0x0000000000130000-0x0000000000137000-memory.dmpFilesize
28KB
-
memory/2532-316-0x0000000000120000-0x000000000012B000-memory.dmpFilesize
44KB
-
memory/2532-282-0x0000000000120000-0x000000000012B000-memory.dmpFilesize
44KB
-
memory/2532-312-0x0000000000130000-0x0000000000137000-memory.dmpFilesize
28KB
-
memory/2676-112-0x00000000001C0000-0x00000000003AF000-memory.dmpFilesize
1.9MB
-
memory/2676-109-0x00000000001C0000-0x00000000003AF000-memory.dmpFilesize
1.9MB
-
memory/2920-324-0x00000000008F0000-0x00000000008FD000-memory.dmpFilesize
52KB
-
memory/2920-325-0x00000000008F0000-0x00000000008FD000-memory.dmpFilesize
52KB
-
memory/2920-3-0x00000000014E0000-0x00000000014E9000-memory.dmpFilesize
36KB
-
memory/2920-5-0x0000000000400000-0x0000000001399000-memory.dmpFilesize
15.6MB
-
memory/2920-323-0x0000000000900000-0x0000000000907000-memory.dmpFilesize
28KB
-
memory/2920-2-0x0000000000400000-0x0000000001399000-memory.dmpFilesize
15.6MB
-
memory/2920-383-0x00000000008F0000-0x00000000008FD000-memory.dmpFilesize
52KB
-
memory/2920-1-0x0000000001540000-0x0000000001640000-memory.dmpFilesize
1024KB
-
memory/2968-315-0x0000000000F50000-0x0000000000F59000-memory.dmpFilesize
36KB
-
memory/2968-357-0x0000000000F60000-0x0000000000F65000-memory.dmpFilesize
20KB
-
memory/2968-313-0x0000000000F50000-0x0000000000F59000-memory.dmpFilesize
36KB
-
memory/2968-314-0x0000000000F60000-0x0000000000F65000-memory.dmpFilesize
20KB
-
memory/3228-4-0x0000000000FE0000-0x0000000000FF6000-memory.dmpFilesize
88KB
-
memory/3364-115-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/3364-120-0x000000000B290000-0x000000000B2A0000-memory.dmpFilesize
64KB
-
memory/3364-103-0x0000000000550000-0x0000000000578000-memory.dmpFilesize
160KB
-
memory/3364-211-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/3364-224-0x000000000B290000-0x000000000B2A0000-memory.dmpFilesize
64KB
-
memory/4128-317-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/4128-319-0x0000000000490000-0x000000000049F000-memory.dmpFilesize
60KB
-
memory/4128-291-0x0000000000490000-0x000000000049F000-memory.dmpFilesize
60KB
-
memory/4128-289-0x00000000004A0000-0x00000000004A9000-memory.dmpFilesize
36KB
-
memory/4220-309-0x00000000008E0000-0x0000000000902000-memory.dmpFilesize
136KB
-
memory/4220-350-0x00000000008B0000-0x00000000008D7000-memory.dmpFilesize
156KB
-
memory/4220-311-0x00000000008B0000-0x00000000008D7000-memory.dmpFilesize
156KB
-
memory/4220-337-0x00000000008E0000-0x0000000000902000-memory.dmpFilesize
136KB
-
memory/4428-330-0x0000000000C90000-0x0000000000C9B000-memory.dmpFilesize
44KB
-
memory/4428-327-0x0000000000C90000-0x0000000000C9B000-memory.dmpFilesize
44KB
-
memory/4428-329-0x00000000008F0000-0x00000000008FD000-memory.dmpFilesize
52KB
-
memory/4844-52-0x000000000B310000-0x000000000B320000-memory.dmpFilesize
64KB
-
memory/4844-50-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/4844-40-0x0000000000610000-0x0000000000638000-memory.dmpFilesize
160KB
-
memory/4844-114-0x000000000B310000-0x000000000B320000-memory.dmpFilesize
64KB
-
memory/4844-107-0x0000000074010000-0x00000000746FE000-memory.dmpFilesize
6.9MB
-
memory/4916-322-0x0000000000450000-0x0000000000455000-memory.dmpFilesize
20KB
-
memory/4916-326-0x0000000000440000-0x0000000000449000-memory.dmpFilesize
36KB
-
memory/4916-298-0x0000000000450000-0x0000000000455000-memory.dmpFilesize
20KB
-
memory/4916-299-0x0000000000440000-0x0000000000449000-memory.dmpFilesize
36KB
-
memory/4944-328-0x0000000000A00000-0x0000000000A0C000-memory.dmpFilesize
48KB
-
memory/4944-306-0x0000000000A10000-0x0000000000A16000-memory.dmpFilesize
24KB
-
memory/4944-308-0x0000000000A00000-0x0000000000A0C000-memory.dmpFilesize
48KB
-
memory/4944-307-0x0000000000A00000-0x0000000000A0C000-memory.dmpFilesize
48KB