Overview

overview

10

Static

static

3

A8A0F8C4DD...A0.exe

windows7-x64

10

A8A0F8C4DD...A0.exe

windows10-2004-x64

10

Sharing

Copy URL
Twitter E-mail

General

  • Target

    A8A0F8C4DD8185883448DA9635D50AA0.exe

  • Size

    1.7MB

  • Sample

    231009-m1nxksed64

  • MD5

    a8a0f8c4dd8185883448da9635d50aa0

  • SHA1

    f14ff1f212fa9d58ae1f65c8749b14c3c2a618bb

  • SHA256

    753d16f4ea232a594788e94ed50cac8cf6ff1bde28fafaf97e65f243a37b7d5b

  • SHA512

    b51907b9a0cd6dc4719b9368db1767e1d59cd93bac02cd169bc1b2c9ce434f3c663f7c0ecd1bd6e09922ddcc27158b489524474d872c67ce9d6e6edd36e9b751

  • SSDEEP

    24576:Fy7gVq3vdHp+4yBfJ4jP9EWWHE0UQ3XeRxni3Rh1Keqeoo9S:gKqFJVimeZk0b3ddKrBo

Score
10/10
mysticredlinesmokeloaderfrantbackdoorevasioninfostealerpersistencestealertrojan

Malware Config

Extracted

Family

redline

Botnet

frant

C2

77.91.124.55:19071

Extracted

Family

smokeloader

Version

2022

C2

http://77.91.68.29/fks/

rc4.i32
rc4.i32

Targets

    • Target

      A8A0F8C4DD8185883448DA9635D50AA0.exe

    • Size

      1.7MB

    • MD5

      a8a0f8c4dd8185883448da9635d50aa0

    • SHA1

      f14ff1f212fa9d58ae1f65c8749b14c3c2a618bb

    • SHA256

      753d16f4ea232a594788e94ed50cac8cf6ff1bde28fafaf97e65f243a37b7d5b

    • SHA512

      b51907b9a0cd6dc4719b9368db1767e1d59cd93bac02cd169bc1b2c9ce434f3c663f7c0ecd1bd6e09922ddcc27158b489524474d872c67ce9d6e6edd36e9b751

    • SSDEEP

      24576:Fy7gVq3vdHp+4yBfJ4jP9EWWHE0UQ3XeRxni3Rh1Keqeoo9S:gKqFJVimeZk0b3ddKrBo

    Score
    10/10
    evasionpersistencetrojanmysticredlinesmokeloaderfrantbackdoorinfostealerstealer

    • Detect Mystic stealer payload

    • Modifies Windows Defender Real-time Protection settings

      evasiontrojan

    • Mystic

      Mystic is an infostealer written in C++.

      stealermystic

    • RedLine

      RedLine Stealer is a malware family written in C#, first appearing in early 2020.

      infostealerredline

    • RedLine payload

    • SmokeLoader

      Modular backdoor trojan in use since 2014.

      trojanbackdoorsmokeloader

    • Executes dropped EXE

    • Loads dropped DLL

    • Adds Run key to start application

      persistence

    • Suspicious use of SetThreadContext

    behavioral1behavioral2

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Persistence

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Create or Modify System Process

1
T1543

Windows Service

1
T1543.003

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

2
T1112

Impair Defenses

1
T1562

Disable or Modify Tools

1
T1562.001

Credential Access

Discovery

Query Registry

2
T1012

Peripheral Device Discovery

1
T1120

System Information Discovery

1
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Tasks