Analysis

  • max time kernel
    150s
  • max time network
    145s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2023, 21:39

General

  • Target

    SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.22433.13822.exe

  • Size

    267KB

  • MD5

    24dbebd26b029b6304bed121b5af43c4

  • SHA1

    6657d33ab6958b155c67cc12d55647b1b0bc28ad

  • SHA256

    9e7c8aea93412acc8d8de3a956e8485a86caf40c626b2abd491bd5404df1bfbb

  • SHA512

    470559b9db03a1b3c10a6e91a1e03c6b15979a3d754c9f2a5684a06e87a9722bd7929872fa8cb15b8c5f183fead77272e57966095b493a1b608e93130db4ddf8

  • SSDEEP

    3072:QXUMeUgFUvuQ+qOsW8gPwI0eNcCOdvriM5vVos1lRLootRbrNpm:OUMeAvuQ+qOsWttcpRriMMIS

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Checks SCSI registry key(s) 3 TTPs 6 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 17 IoCs
  • Suspicious use of WriteProcessMemory 59 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.22433.13822.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.W32.Kryptik.KMY.gen.Eldorado.22433.13822.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2088
  • C:\Users\Admin\AppData\Local\Temp\5242.exe
    C:\Users\Admin\AppData\Local\Temp\5242.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1660
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1188
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        PID:572
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
        PID:408
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
        2⤵
          PID:3344
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          2⤵
            PID:2488
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
            2⤵
              PID:3620
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
              2⤵
                PID:1356
            • C:\Users\Admin\AppData\Roaming\uhugjdv
              C:\Users\Admin\AppData\Roaming\uhugjdv
              1⤵
              • Executes dropped EXE
              • Checks SCSI registry key(s)
              • Suspicious behavior: MapViewOfSection
              PID:3852

            Network

                  MITRE ATT&CK Enterprise v15

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\5242.exe

                    Filesize

                    505KB

                    MD5

                    3082e7832f7a31397990d4d3ae4c75c9

                    SHA1

                    769b150e219c7e8d7221f7a0f0ba6ef617fd036d

                    SHA256

                    716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

                    SHA512

                    8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

                  • C:\Users\Admin\AppData\Local\Temp\5242.exe

                    Filesize

                    505KB

                    MD5

                    3082e7832f7a31397990d4d3ae4c75c9

                    SHA1

                    769b150e219c7e8d7221f7a0f0ba6ef617fd036d

                    SHA256

                    716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

                    SHA512

                    8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

                  • C:\Users\Admin\AppData\Roaming\uhugjdv

                    Filesize

                    267KB

                    MD5

                    24dbebd26b029b6304bed121b5af43c4

                    SHA1

                    6657d33ab6958b155c67cc12d55647b1b0bc28ad

                    SHA256

                    9e7c8aea93412acc8d8de3a956e8485a86caf40c626b2abd491bd5404df1bfbb

                    SHA512

                    470559b9db03a1b3c10a6e91a1e03c6b15979a3d754c9f2a5684a06e87a9722bd7929872fa8cb15b8c5f183fead77272e57966095b493a1b608e93130db4ddf8

                  • C:\Users\Admin\AppData\Roaming\uhugjdv

                    Filesize

                    267KB

                    MD5

                    24dbebd26b029b6304bed121b5af43c4

                    SHA1

                    6657d33ab6958b155c67cc12d55647b1b0bc28ad

                    SHA256

                    9e7c8aea93412acc8d8de3a956e8485a86caf40c626b2abd491bd5404df1bfbb

                    SHA512

                    470559b9db03a1b3c10a6e91a1e03c6b15979a3d754c9f2a5684a06e87a9722bd7929872fa8cb15b8c5f183fead77272e57966095b493a1b608e93130db4ddf8

                  • memory/572-54-0x0000000009500000-0x0000000009B18000-memory.dmp

                    Filesize

                    6.1MB

                  • memory/572-64-0x00000000071B0000-0x0000000007200000-memory.dmp

                    Filesize

                    320KB

                  • memory/572-63-0x000000000AD00000-0x000000000AD1E000-memory.dmp

                    Filesize

                    120KB

                  • memory/572-61-0x000000000ADF0000-0x000000000AFB2000-memory.dmp

                    Filesize

                    1.8MB

                  • memory/572-60-0x000000000ABA0000-0x000000000AC16000-memory.dmp

                    Filesize

                    472KB

                  • memory/572-59-0x0000000008F90000-0x0000000008FF6000-memory.dmp

                    Filesize

                    408KB

                  • memory/572-58-0x0000000008700000-0x000000000874C000-memory.dmp

                    Filesize

                    304KB

                  • memory/572-57-0x00000000086C0000-0x00000000086FC000-memory.dmp

                    Filesize

                    240KB

                  • memory/572-56-0x0000000008790000-0x000000000889A000-memory.dmp

                    Filesize

                    1.0MB

                  • memory/572-55-0x0000000008660000-0x0000000008672000-memory.dmp

                    Filesize

                    72KB

                  • memory/572-49-0x0000000000400000-0x000000000045A000-memory.dmp

                    Filesize

                    360KB

                  • memory/572-62-0x000000000BCC0000-0x000000000C1EC000-memory.dmp

                    Filesize

                    5.2MB

                  • memory/572-66-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/572-53-0x00000000085B0000-0x00000000085C0000-memory.dmp

                    Filesize

                    64KB

                  • memory/572-51-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1188-52-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1188-41-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1188-48-0x00000000050E0000-0x00000000050F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1188-45-0x00000000050E0000-0x00000000050F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1188-44-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1188-43-0x00000000050E0000-0x00000000050F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1188-42-0x00000000050E0000-0x00000000050F0000-memory.dmp

                    Filesize

                    64KB

                  • memory/1188-39-0x0000000000400000-0x000000000044A000-memory.dmp

                    Filesize

                    296KB

                  • memory/1188-40-0x0000000000400000-0x000000000044A000-memory.dmp

                    Filesize

                    296KB

                  • memory/1660-20-0x0000000005630000-0x000000000563A000-memory.dmp

                    Filesize

                    40KB

                  • memory/1660-22-0x0000000003000000-0x0000000003040000-memory.dmp

                    Filesize

                    256KB

                  • memory/1660-16-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1660-15-0x0000000000A20000-0x0000000000AA2000-memory.dmp

                    Filesize

                    520KB

                  • memory/1660-17-0x0000000005B60000-0x0000000006104000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/1660-47-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1660-29-0x0000000005880000-0x0000000005890000-memory.dmp

                    Filesize

                    64KB

                  • memory/1660-28-0x0000000074E10000-0x00000000755C0000-memory.dmp

                    Filesize

                    7.7MB

                  • memory/1660-27-0x0000000011A10000-0x0000000011A16000-memory.dmp

                    Filesize

                    24KB

                  • memory/1660-26-0x000000000F9E0000-0x000000000F9FA000-memory.dmp

                    Filesize

                    104KB

                  • memory/1660-25-0x0000000005880000-0x0000000005890000-memory.dmp

                    Filesize

                    64KB

                  • memory/1660-18-0x0000000005650000-0x00000000056E2000-memory.dmp

                    Filesize

                    584KB

                  • memory/1660-21-0x0000000008210000-0x00000000082AC000-memory.dmp

                    Filesize

                    624KB

                  • memory/1660-19-0x0000000005880000-0x0000000005890000-memory.dmp

                    Filesize

                    64KB

                  • memory/2088-1-0x00000000009B0000-0x0000000000AB0000-memory.dmp

                    Filesize

                    1024KB

                  • memory/2088-5-0x0000000000400000-0x0000000000711000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2088-3-0x0000000002460000-0x0000000002469000-memory.dmp

                    Filesize

                    36KB

                  • memory/2088-2-0x0000000000400000-0x0000000000711000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/2540-33-0x0000000008120000-0x0000000008136000-memory.dmp

                    Filesize

                    88KB

                  • memory/2540-4-0x0000000002A20000-0x0000000002A36000-memory.dmp

                    Filesize

                    88KB

                  • memory/3852-36-0x0000000000400000-0x0000000000711000-memory.dmp

                    Filesize

                    3.1MB

                  • memory/3852-31-0x0000000000A50000-0x0000000000B50000-memory.dmp

                    Filesize

                    1024KB

                  • memory/3852-32-0x0000000000400000-0x0000000000711000-memory.dmp

                    Filesize

                    3.1MB