Analysis
-
max time kernel
146s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
15/09/2023, 12:27
Static task
static1
Behavioral task
behavioral1
Sample
110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe
Resource
win10v2004-20230915-en
General
-
Target
110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe
-
Size
196KB
-
MD5
d246b71e5df1eb4c2a7e617404aee3d4
-
SHA1
57ae3ea47c9b3ac954a69ea0272d0b311e97c129
-
SHA256
110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6
-
SHA512
c1cf471a2e3c80ccd51d1b91f931008a660ccf9566340d31426a800c31db79c6dc0978f2a19b9131380e3c8a7d5cc2162775e13db5cef992e5e9fb6a4dacd731
-
SSDEEP
3072:TOhzzLL/JYhibm2wUgur/U5f0vgbqu8FlpO56VpPT3R49:GzzLzOh6VwxuzU5fbbp8fbvPTh4
Malware Config
Extracted
smokeloader
2022
http://potunulit.org/
http://hutnilior.net/
http://bulimu55t.net/
http://soryytlic4.net/
http://novanosa5org.org/
http://nuljjjnuli.org/
http://tolilolihul.net/
http://somatoka51hub.net/
http://hujukui3.net/
http://bukubuka1.net/
http://golilopaster.org/
http://newzelannd66.org/
http://otriluyttn.org/
Extracted
redline
lux3
176.123.9.142:14845
-
auth_value
e94dff9a76da90d6b000642c4a52574b
Extracted
redline
38.181.25.43:3325
-
auth_value
082cde17c5630749ecb0376734fe99c9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4116 110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe 4116 110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found 3136 Process not Found -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 4116 110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe"C:\Users\Admin\AppData\Local\Temp\110ca627ec28db642faf112f5ff6d36694b68b3616510dca552a04c05cfa1cc6_JC.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4116
-
C:\Users\Admin\AppData\Local\Temp\F53.exeC:\Users\Admin\AppData\Local\Temp\F53.exe1⤵PID:2184
-
C:\Users\Admin\AppData\Local\Temp\10AC.exeC:\Users\Admin\AppData\Local\Temp\10AC.exe1⤵PID:2864
-
C:\Users\Admin\AppData\Local\Temp\1456.exeC:\Users\Admin\AppData\Local\Temp\1456.exe1⤵PID:1836
-
C:\Windows\system32\regsvr32.exeregsvr32 /s C:\Users\Admin\AppData\Local\Temp\188D.dll1⤵PID:4284
-
C:\Windows\SysWOW64\regsvr32.exe/s C:\Users\Admin\AppData\Local\Temp\188D.dll2⤵PID:3772
-
-
C:\Users\Admin\AppData\Local\Temp\1B3E.exeC:\Users\Admin\AppData\Local\Temp\1B3E.exe1⤵PID:2504
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
273KB
MD5ed6778e6fe0c07587f4892c807d7f883
SHA13a94caa9336934ca2b12173b24fa815ea963edcb
SHA256a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898
SHA512b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544
-
Filesize
273KB
MD5ed6778e6fe0c07587f4892c807d7f883
SHA13a94caa9336934ca2b12173b24fa815ea963edcb
SHA256a9f19ec6eec891e21b885a04030995a5c996f0b673c6425ee28b0ef6c70d2898
SHA512b3fffd8485429cbe7c87a6eda24af95d2f497d3d3b47656ea3930c2ced6344f9b13099d419503f0c3dc40661111dac8df1d91eed66f448d58e0880c766859544
-
Filesize
1.8MB
MD5c7b34cc95676afe2b43fce196202d3fa
SHA192eb09a6883ef684d3d175ece6599a61266bada9
SHA2568d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060
SHA5120e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16
-
Filesize
1.8MB
MD5c7b34cc95676afe2b43fce196202d3fa
SHA192eb09a6883ef684d3d175ece6599a61266bada9
SHA2568d5bfbac46cfe1f428ba5905fbb0252b08e71d7061b32c3a90d20f451df72060
SHA5120e581a66baba515995b3513698cdf5bd8c6119ea4ce3c3b0f9b7bcf58cbef4eb27188ef976f8f2aaef7b5cd673fb2718df6d4133fc891ccc207d136babbeaa16
-
Filesize
2.3MB
MD5e0286fab4e36e2523d461e6294395e22
SHA1f0a6ac98bb771e720ac3683a75f7ec3af7ad75cd
SHA256a03129d4c88ef87b55f37dcc126c02ffb9231800655eb0885936b2764577d919
SHA5127d637411a7566053b2bf37b75e907052af66b8a404499afa9b23477bfc318952bb94837b8aa9c14e16156afa080cba0ca91663e068a482953b3576daf8c4f467
-
Filesize
806KB
MD5d27125ae65af3a6ce086eeae8fa41521
SHA170209d54e90908fc10f99af3cb38620bd744f93b
SHA2564745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea
SHA51293f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e
-
Filesize
806KB
MD5d27125ae65af3a6ce086eeae8fa41521
SHA170209d54e90908fc10f99af3cb38620bd744f93b
SHA2564745aee336bf0a92efae4475d6a541fbd9cc91b65532a26a1810b49ad5f8dbea
SHA51293f941a68d8eaea98d146520f786773e688bf5673ab37110efe065e05f9af6f81c43e050e90b20348b92888abc519e2094bcce37e22ab9a4a0e439c8dd88b68e
-
Filesize
273KB
MD5fc55462468d1a34e514d01aa30c0a5cd
SHA1168e4cd58a14f9e4591d49877ab5cb08e9a142a0
SHA25674ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b
SHA512e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d
-
Filesize
273KB
MD5fc55462468d1a34e514d01aa30c0a5cd
SHA1168e4cd58a14f9e4591d49877ab5cb08e9a142a0
SHA25674ccc20216ebd15c3f9c937b7b40653a8c04537a15c95bb46f381c40e0ff194b
SHA512e2ba1facb596a2e54284b6556bb6a485cc213deae1b270f71e283412c4ba58aff78cff349ab329e110c09455c531f2d1b65b1cbb1c23ed0cd74647bfba7f4b6d