Analysis

  • max time kernel
    146s
  • max time network
    155s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230915-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system
  • submitted
    15/09/2023, 12:27

General

  • Target

    110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe

  • Size

    196KB

  • MD5

    d246b71e5df1eb4c2a7e617404aee3d4

  • SHA1

    57ae3ea47c9b3ac954a69ea0272d0b311e97c129

  • SHA256

    110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6

  • SHA512

    c1cf471a2e3c80ccd51d1b91f931008a660ccf9566340d31426a800c31db79c6dc0978f2a19b9131380e3c8a7d5cc2162775e13db5cef992e5e9fb6a4dacd731

  • SSDEEP

    3072:TOhzzLL/JYhibm2wUgur/U5f0vgbqu8FlpO56VpPT3R49:GzzLzOh6VwxuzU5fbbp8fbvPTh4

Malware Config

Extracted

Family

smokeloader

Version

2022

C2

http://potunulit.org/

http://hutnilior.net/

http://bulimu55t.net/

http://soryytlic4.net/

http://novanosa5org.org/

http://nuljjjnuli.org/

http://tolilolihul.net/

http://somatoka51hub.net/

http://hujukui3.net/

http://bukubuka1.net/

http://golilopaster.org/

http://newzelannd66.org/

http://otriluyttn.org/

rc4.i32
rc4.i32

Extracted

Family

redline

Botnet

lux3

C2

176.123.9.142:14845

Attributes
  • auth_value

    e94dff9a76da90d6b000642c4a52574b

Extracted

Family

redline

C2

38.181.25.43:3325

Attributes
  • auth_value

    082cde17c5630749ecb0376734fe99c9

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • SmokeLoader

    Modular backdoor trojan in use since 2014.

  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe
    "C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe"
    1⤵
    • Checks SCSI registry key(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    PID:4116
  • C:\Users\Admin\AppData\Local\Temp\F53.exe
    C:\Users\Admin\AppData\Local\Temp\F53.exe
    1⤵
      PID:2184
    • C:\Users\Admin\AppData\Local\Temp\10AC.exe
      C:\Users\Admin\AppData\Local\Temp\10AC.exe
      1⤵
        PID:2864
      • C:\Users\Admin\AppData\Local\Temp\1456.exe
        C:\Users\Admin\AppData\Local\Temp\1456.exe
        1⤵
          PID:1836
        • C:\Windows\system32\regsvr32.exe
          regsvr32 /s C:\Users\Admin\AppData\Local\Temp\188D.dll
          1⤵
            PID:4284
            • C:\Windows\SysWOW64\regsvr32.exe
              /s C:\Users\Admin\AppData\Local\Temp\188D.dll
              2⤵
                PID:3772
            • C:\Users\Admin\AppData\Local\Temp\1B3E.exe
              C:\Users\Admin\AppData\Local\Temp\1B3E.exe
              1⤵
                PID:2504

              Network

              MITRE ATT&CK Enterprise v15

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • C:\Users\Admin\AppData\Local\Temp\10AC.exe

                Filesize

                273KB

                MD5

                ed6778e6fe0c07587f4892c807d7f883

                SHA1

                3a94caa9336934ca2b12173b24fa815ea963edcb

                SHA256

                a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898

                SHA512

                b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544

              • C:\Users\Admin\AppData\Local\Temp\10AC.exe

                Filesize

                273KB

                MD5

                ed6778e6fe0c07587f4892c807d7f883

                SHA1

                3a94caa9336934ca2b12173b24fa815ea963edcb

                SHA256

                a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898

                SHA512

                b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544

              • C:\Users\Admin\AppData\Local\Temp\1456.exe

                Filesize

                1.8MB

                MD5

                c7b34cc95676afe2b43fce196202d3fa

                SHA1

                92eb09a6883ef684d3d175ece6599a61266bada9

                SHA256

                8d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060

                SHA512

                0e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16

              • C:\Users\Admin\AppData\Local\Temp\1456.exe

                Filesize

                1.8MB

                MD5

                c7b34cc95676afe2b43fce196202d3fa

                SHA1

                92eb09a6883ef684d3d175ece6599a61266bada9

                SHA256

                8d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060

                SHA512

                0e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16

              • C:\Users\Admin\AppData\Local\Temp\188D.dll

                Filesize

                2.3MB

                MD5

                e0286fab4e36e2523d461e6294395e22

                SHA1

                f0a6ac98bb771e720ac3683a75f7ec3af7ad75cd

                SHA256

                a03129d4c88ef87b55f37dcc126c02ffb9231800655eb0885936b2764577d919

                SHA512

                7d637411a7566053b2bf37b75e907052af66b8a404499afa9b23477bfc318952bb94837b8aa9c14e16156afa080cba0ca91663e068a482953b3576daf8c4f467

              • C:\Users\Admin\AppData\Local\Temp\1B3E.exe

                Filesize

                806KB

                MD5

                d27125ae65af3a6ce086eeae8fa41521

                SHA1

                70209d54e90908fc10f99af3cb38620bd744f93b

                SHA256

                4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

                SHA512

                93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

              • C:\Users\Admin\AppData\Local\Temp\1B3E.exe

                Filesize

                806KB

                MD5

                d27125ae65af3a6ce086eeae8fa41521

                SHA1

                70209d54e90908fc10f99af3cb38620bd744f93b

                SHA256

                4745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea

                SHA512

                93f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e

              • C:\Users\Admin\AppData\Local\Temp\F53.exe

                Filesize

                273KB

                MD5

                fc55462468d1a34e514d01aa30c0a5cd

                SHA1

                168e4cd58a14f9e4591d49877ab5cb08e9a142a0

                SHA256

                74ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b

                SHA512

                e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d

              • C:\Users\Admin\AppData\Local\Temp\F53.exe

                Filesize

                273KB

                MD5

                fc55462468d1a34e514d01aa30c0a5cd

                SHA1

                168e4cd58a14f9e4591d49877ab5cb08e9a142a0

                SHA256

                74ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b

                SHA512

                e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d

              • memory/2184-59-0x00000000008B0000-0x00000000008E0000-memory.dmp

                Filesize

                192KB

              • memory/2184-57-0x0000000000400000-0x0000000000445000-memory.dmp

                Filesize

                276KB

              • memory/2184-76-0x0000000074B60000-0x0000000075310000-memory.dmp

                Filesize

                7.7MB

              • memory/2184-78-0x0000000002380000-0x0000000002386000-memory.dmp

                Filesize

                24KB

              • memory/2864-63-0x0000000000400000-0x0000000000445000-memory.dmp

                Filesize

                276KB

              • memory/2864-77-0x00000000024B0000-0x00000000024B6000-memory.dmp

                Filesize

                24KB

              • memory/2864-61-0x0000000002070000-0x00000000020A0000-memory.dmp

                Filesize

                192KB

              • memory/2864-79-0x0000000074B60000-0x0000000075310000-memory.dmp

                Filesize

                7.7MB

              • memory/3136-21-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-54-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-25-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-33-0x0000000003230000-0x0000000003240000-memory.dmp

                Filesize

                64KB

              • memory/3136-31-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-28-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-36-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-37-0x00000000083D0000-0x00000000083E0000-memory.dmp

                Filesize

                64KB

              • memory/3136-35-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-38-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-40-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-43-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-44-0x0000000003220000-0x0000000003230000-memory.dmp

                Filesize

                64KB

              • memory/3136-52-0x0000000008BA0000-0x0000000008BB0000-memory.dmp

                Filesize

                64KB

              • memory/3136-48-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-23-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-42-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-20-0x0000000003220000-0x0000000003230000-memory.dmp

                Filesize

                64KB

              • memory/3136-50-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-22-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-55-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-80-0x0000000003230000-0x0000000003240000-memory.dmp

                Filesize

                64KB

              • memory/3136-19-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-58-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-65-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-14-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-56-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-16-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-15-0x0000000001300000-0x0000000001310000-memory.dmp

                Filesize

                64KB

              • memory/3136-4-0x00000000031E0000-0x00000000031F6000-memory.dmp

                Filesize

                88KB

              • memory/4116-8-0x0000000000620000-0x0000000000635000-memory.dmp

                Filesize

                84KB

              • memory/4116-9-0x00000000001C0000-0x00000000001C9000-memory.dmp

                Filesize

                36KB

              • memory/4116-5-0x0000000000400000-0x0000000000480000-memory.dmp

                Filesize

                512KB

              • memory/4116-3-0x0000000000400000-0x0000000000480000-memory.dmp

                Filesize

                512KB

              • memory/4116-2-0x0000000000400000-0x0000000000480000-memory.dmp

                Filesize

                512KB

              • memory/4116-0-0x0000000000620000-0x0000000000635000-memory.dmp

                Filesize

                84KB

              • memory/4116-1-0x00000000001C0000-0x00000000001C9000-memory.dmp

                Filesize

                36KB