Analysis

  • max time kernel
    149s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2023, 22:41

General

  • Target

    SecuriteInfo.com.Win32.BotX-gen.4091.exe

  • Size

    267KB

  • MD5

    6cf01c815d1489b617c05fcd4640fffd

  • SHA1

    2ad52ebfc86e11c71cc901f18e6c4f80eac55079

  • SHA256

    56be912ce754d75f3385dab925ee34d9a0a1e07fe841c6a2e9adafa8021c99bc

  • SHA512

    33f2dab46769d6d88b953b7b3972f2561fde10998c1aebbb88bc5366d035b5c706ab4c5209868919b3f01f4e4501da5e06cfe468168dd1be0edea398dd5d28f6

  • SSDEEP

    3072:SEI3+gesvpzB4jtXebGwIBsCTZDAIpzNxU4YDG9DZINLgJNZqMG:XI3JvpzB4jtXlB3TvhNxU4YDCdINLj

Malware Config

Extracted

Family

smokeloader

Botnet

pub1

Extracted

Family

smokeloader

Version

2022

C2

http://gudintas.at/tmp/

http://pik96.ru/tmp/

http://rosatiauto.com/tmp/

http://kingpirate.ru/tmp/

rc4.i32
rc4.i32

Extracted

Family

stealc

C2

http://85.209.11.51

Attributes
  • url_path

    /fefb4a458e1dc58b.php

rc4.plain

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Stealc

    Stealc is an infostealer written in C++.

  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 5 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Checks processor information in registry 2 TTPs 4 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 28 IoCs
  • Suspicious use of WriteProcessMemory 62 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BotX-gen.4091.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.BotX-gen.4091.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:2132
  • C:\Users\Admin\AppData\Local\Temp\5EE4.exe
    C:\Users\Admin\AppData\Local\Temp\5EE4.exe
    1⤵
    • Executes dropped EXE
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2200
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4800
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
        3⤵
          PID:5116
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
          3⤵
            PID:3380
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          2⤵
          • Checks processor information in registry
          PID:3604
      • C:\Users\Admin\AppData\Local\Temp\6BD5.exe
        C:\Users\Admin\AppData\Local\Temp\6BD5.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:32
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
          2⤵
          • Suspicious use of SetThreadContext
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:3840
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\ilasm.exe"
            3⤵
              PID:396
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe"
            2⤵
            • Loads dropped DLL
            • Checks processor information in registry
            PID:5072

        Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\ProgramData\JDBFIIEB

                Filesize

                92KB

                MD5

                6e98ae51f6cacb49a7830bede7ab9920

                SHA1

                1b7e9e375bd48cae50343e67ecc376cf5016d4ee

                SHA256

                192cd04b9a4d80701bb672cc3678912d1df8f6b987c2b4991d9b6bfbe8f011fd

                SHA512

                3e7cdda870cbde0655cc30c2f7bd3afee96fdfbe420987ae6ea2709089c0a8cbc8bb9187ef3b4ec3f6a019a9a8b465588b61029869f5934e0820b2461c4a9b2b

              • C:\ProgramData\JKJECBAA

                Filesize

                116KB

                MD5

                f70aa3fa04f0536280f872ad17973c3d

                SHA1

                50a7b889329a92de1b272d0ecf5fce87395d3123

                SHA256

                8d782aa65de6db3538a14da82216e96d5e0a3c60496726e3541a8165bccc65f8

                SHA512

                30675c5c610d9aa32a4c4a4d9c3af7570823cd197f8d2a709222c78e2cd15304bbed80e233e3674ec2f6e33d1961c67fd6a46dc8ba8b1a301cd0722932c03c84

              • C:\ProgramData\mozglue.dll

                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

              • C:\ProgramData\mozglue.dll

                Filesize

                148KB

                MD5

                ba25e6f018cc3be0067e27534065afd9

                SHA1

                d210b2582751eaf95e39f477d17bee57bc704a8e

                SHA256

                684e380e52fb6c94c2c5515faeaa5bcf66f861fc41da29b435c38dd1416d1a9d

                SHA512

                8076f2ad7b548cfe50caccdd93a0cbb8222f957d9b7475ac475fd8bca2247372aaf7e13d52c7ec90e1d1be0b422c03c9cb8e4e0ee6fb3e43a862cf1dc239f8ae

              • C:\ProgramData\mozglue.dll

                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

              • C:\ProgramData\mozglue.dll

                Filesize

                593KB

                MD5

                c8fd9be83bc728cc04beffafc2907fe9

                SHA1

                95ab9f701e0024cedfbd312bcfe4e726744c4f2e

                SHA256

                ba06a6ee0b15f5be5c4e67782eec8b521e36c107a329093ec400fe0404eb196a

                SHA512

                fbb446f4a27ef510e616caad52945d6c9cc1fd063812c41947e579ec2b54df57c6dc46237ded80fca5847f38cbe1747a6c66a13e2c8c19c664a72be35eb8b040

              • C:\ProgramData\nss3.dll

                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

              • C:\ProgramData\nss3.dll

                Filesize

                5KB

                MD5

                fff8bb74ff31eb63f0386737a00b6d0a

                SHA1

                eaf6b3268e69a783aee4f97c4a2daa9bd153d6fe

                SHA256

                fdbb1e867d9aff33fa30c8e2d1f0cf18faa97c27851767720035b05e67100cc6

                SHA512

                dc77574ca6d10edc96901776022b1d10bd2b0295647c61ea97dd806b744a217d807edbea13af13fbd458a3f3c8553924df46d4ebff829a02f191c63142f6699a

              • C:\ProgramData\nss3.dll

                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

              • C:\ProgramData\softokn3.dll

                Filesize

                87KB

                MD5

                842ccb3e9856570ec670bd0fd5adae21

                SHA1

                08de064c41f237c0502bc71849a8654cd2ab3272

                SHA256

                945bad97952b8789cccea0cf0a62b6e96dfd517de2dc81e4142b849462cf6e05

                SHA512

                475f8850962c66e717382aa0454fcd49b6430e2e1ea4dcd62192a0b783a9942b69d3f959491f02cd52ad148058c5ded5921c47e0971a74253d22dd58a4c3e79a

              • C:\ProgramData\vcruntime140.dll

                Filesize

                78KB

                MD5

                a37ee36b536409056a86f50e67777dd7

                SHA1

                1cafa159292aa736fc595fc04e16325b27cd6750

                SHA256

                8934aaeb65b6e6d253dfe72dea5d65856bd871e989d5d3a2a35edfe867bb4825

                SHA512

                3a7c260646315cf8c01f44b2ec60974017496bd0d80dd055c7e43b707cadba2d63aab5e0efd435670aa77886ed86368390d42c4017fc433c3c4b9d1c47d0f356

              • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\MRL3SWXH\nss3[1].dll

                Filesize

                2.0MB

                MD5

                1cc453cdf74f31e4d913ff9c10acdde2

                SHA1

                6e85eae544d6e965f15fa5c39700fa7202f3aafe

                SHA256

                ac5c92fe6c51cfa742e475215b83b3e11a4379820043263bf50d4068686c6fa5

                SHA512

                dd9ff4e06b00dc831439bab11c10e9b2ae864ea6e780d3835ea7468818f35439f352ef137da111efcdf2bb6465f6ca486719451bf6cf32c6a4420a56b1d64571

              • C:\Users\Admin\AppData\Local\Temp\5EE4.exe

                Filesize

                505KB

                MD5

                3082e7832f7a31397990d4d3ae4c75c9

                SHA1

                769b150e219c7e8d7221f7a0f0ba6ef617fd036d

                SHA256

                716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

                SHA512

                8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

              • C:\Users\Admin\AppData\Local\Temp\5EE4.exe

                Filesize

                505KB

                MD5

                3082e7832f7a31397990d4d3ae4c75c9

                SHA1

                769b150e219c7e8d7221f7a0f0ba6ef617fd036d

                SHA256

                716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

                SHA512

                8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

              • C:\Users\Admin\AppData\Local\Temp\6BD5.exe

                Filesize

                505KB

                MD5

                3082e7832f7a31397990d4d3ae4c75c9

                SHA1

                769b150e219c7e8d7221f7a0f0ba6ef617fd036d

                SHA256

                716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

                SHA512

                8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

              • C:\Users\Admin\AppData\Local\Temp\6BD5.exe

                Filesize

                505KB

                MD5

                3082e7832f7a31397990d4d3ae4c75c9

                SHA1

                769b150e219c7e8d7221f7a0f0ba6ef617fd036d

                SHA256

                716f6379cc32afb03ef2639b14e32b4df5538b99b84dafe355b39f8934e7c740

                SHA512

                8e371f4b075070daf8efb449ab87d923eb4d3cad74d7c9c3d3cef76f43f268c0e4aabe6fa1f801e20ac49e25f9bac70338044fbe9bd408883429ca34fb98ade4

              • memory/32-23-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/32-29-0x0000000007780000-0x000000000781C000-memory.dmp

                Filesize

                624KB

              • memory/32-30-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/32-31-0x00000000024C0000-0x0000000002500000-memory.dmp

                Filesize

                256KB

              • memory/32-32-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                Filesize

                64KB

              • memory/32-34-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                Filesize

                64KB

              • memory/32-60-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/32-35-0x000000000B5B0000-0x000000000B5CA000-memory.dmp

                Filesize

                104KB

              • memory/32-36-0x000000000E5E0000-0x000000000E5E6000-memory.dmp

                Filesize

                24KB

              • memory/32-37-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                Filesize

                64KB

              • memory/32-27-0x0000000004BF0000-0x0000000004C00000-memory.dmp

                Filesize

                64KB

              • memory/32-22-0x0000000000280000-0x0000000000302000-memory.dmp

                Filesize

                520KB

              • memory/396-192-0x0000000009460000-0x0000000009A78000-memory.dmp

                Filesize

                6.1MB

              • memory/396-184-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/396-183-0x0000000000400000-0x000000000045A000-memory.dmp

                Filesize

                360KB

              • memory/396-196-0x00000000084B0000-0x00000000084C2000-memory.dmp

                Filesize

                72KB

              • memory/396-190-0x0000000008540000-0x0000000008550000-memory.dmp

                Filesize

                64KB

              • memory/396-201-0x0000000008660000-0x000000000876A000-memory.dmp

                Filesize

                1.0MB

              • memory/396-210-0x0000000008550000-0x000000000858C000-memory.dmp

                Filesize

                240KB

              • memory/396-212-0x00000000084F0000-0x000000000853C000-memory.dmp

                Filesize

                304KB

              • memory/2132-1-0x0000000000910000-0x0000000000A10000-memory.dmp

                Filesize

                1024KB

              • memory/2132-5-0x0000000000400000-0x0000000000711000-memory.dmp

                Filesize

                3.1MB

              • memory/2132-3-0x00000000008C0000-0x00000000008C9000-memory.dmp

                Filesize

                36KB

              • memory/2132-2-0x0000000000400000-0x0000000000711000-memory.dmp

                Filesize

                3.1MB

              • memory/2200-26-0x0000000005960000-0x0000000005970000-memory.dmp

                Filesize

                64KB

              • memory/2200-38-0x0000000005960000-0x0000000005970000-memory.dmp

                Filesize

                64KB

              • memory/2200-15-0x0000000000A90000-0x0000000000B12000-memory.dmp

                Filesize

                520KB

              • memory/2200-62-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/2200-16-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/2200-21-0x0000000005CD0000-0x0000000006274000-memory.dmp

                Filesize

                5.6MB

              • memory/2200-24-0x0000000005720000-0x00000000057B2000-memory.dmp

                Filesize

                584KB

              • memory/2200-25-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/2200-28-0x00000000056E0000-0x00000000056EA000-memory.dmp

                Filesize

                40KB

              • memory/2200-33-0x0000000005960000-0x0000000005970000-memory.dmp

                Filesize

                64KB

              • memory/3204-4-0x0000000003160000-0x0000000003176000-memory.dmp

                Filesize

                88KB

              • memory/3840-51-0x00000000051E0000-0x00000000051F0000-memory.dmp

                Filesize

                64KB

              • memory/3840-47-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/3840-54-0x00000000051E0000-0x00000000051F0000-memory.dmp

                Filesize

                64KB

              • memory/3840-45-0x00000000051E0000-0x00000000051F0000-memory.dmp

                Filesize

                64KB

              • memory/3840-50-0x00000000051E0000-0x00000000051F0000-memory.dmp

                Filesize

                64KB

              • memory/3840-43-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/3840-186-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/3840-41-0x0000000000400000-0x000000000044A000-memory.dmp

                Filesize

                296KB

              • memory/3840-39-0x0000000000400000-0x000000000044A000-memory.dmp

                Filesize

                296KB

              • memory/4800-48-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/4800-49-0x0000000005020000-0x0000000005030000-memory.dmp

                Filesize

                64KB

              • memory/4800-44-0x0000000074CC0000-0x0000000075470000-memory.dmp

                Filesize

                7.7MB

              • memory/4800-52-0x0000000005020000-0x0000000005030000-memory.dmp

                Filesize

                64KB

              • memory/4800-53-0x0000000005020000-0x0000000005030000-memory.dmp

                Filesize

                64KB

              • memory/4800-46-0x0000000005020000-0x0000000005030000-memory.dmp

                Filesize

                64KB

              • memory/5072-55-0x0000000000400000-0x000000000062D000-memory.dmp

                Filesize

                2.2MB

              • memory/5072-63-0x0000000061E00000-0x0000000061EF3000-memory.dmp

                Filesize

                972KB

              • memory/5072-56-0x0000000000400000-0x000000000062D000-memory.dmp

                Filesize

                2.2MB