Analysis
-
max time kernel
158s -
max time network
162s -
platform
windows10-2004_x64 -
resource
win10v2004-20231023-en -
resource tags
arch:x64arch:x86image:win10v2004-20231023-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2023 03:06
Static task
static1
Behavioral task
behavioral1
Sample
ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe
Resource
win10v2004-20231023-en
General
-
Target
ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe
-
Size
1.1MB
-
MD5
c5ba83f3b662560019f464ff43773b68
-
SHA1
e4b1ec9a5f65771c82311dee0902cef934bb7e3f
-
SHA256
ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f
-
SHA512
b2a23bcffd8789b648e909c5830a76a5f0112330c66fd8da26179ec7ce8b006bf914e0db21d3fa2ecacbdd543e05cb8eb4cce9285331d087daaebd96dc67235a
-
SSDEEP
24576:jyI4C8bsrl4bQ4+1TBhkU3PHcybRmFqlfUBuZaz7tov:26hl4bQ9dfPHcFCLZad
Malware Config
Extracted
smokeloader
2022
http://77.91.68.29/fks/
Extracted
redline
grome
77.91.124.86:19084
Signatures
-
Processes:
AppLaunch.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableBehaviorMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableIOAVProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableOnAccessProtection = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableRealtimeMonitoring = "1" AppLaunch.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Policies\Microsoft\Windows Defender\Real-Time Protection\DisableScanOnRealtimeEnable = "1" AppLaunch.exe -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1788-38-0x0000000000400000-0x000000000043E000-memory.dmp family_redline -
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Executes dropped EXE 6 IoCs
Processes:
qa8OV16.exeUJ5tw58.exe1VU41qR3.exe2Mi1470.exe3Nf04gW.exe4tW613JN.exepid process 2160 qa8OV16.exe 2648 UJ5tw58.exe 3064 1VU41qR3.exe 4632 2Mi1470.exe 2060 3Nf04gW.exe 4600 4tW613JN.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
qa8OV16.exeUJ5tw58.exeae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" qa8OV16.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" UJ5tw58.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1VU41qR3.exe4tW613JN.exedescription pid process target process PID 3064 set thread context of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 4600 set thread context of 1788 4600 4tW613JN.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4016 4632 WerFault.exe 2Mi1470.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
3Nf04gW.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3Nf04gW.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3Nf04gW.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 3Nf04gW.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3Nf04gW.exeAppLaunch.exepid process 2060 3Nf04gW.exe 2060 3Nf04gW.exe 4920 AppLaunch.exe 4920 AppLaunch.exe 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 3288 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 3288 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
3Nf04gW.exepid process 2060 3Nf04gW.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 4920 AppLaunch.exe Token: SeShutdownPrivilege 3288 Token: SeCreatePagefilePrivilege 3288 Token: SeShutdownPrivilege 3288 Token: SeCreatePagefilePrivilege 3288 Token: SeShutdownPrivilege 3288 Token: SeCreatePagefilePrivilege 3288 Token: SeShutdownPrivilege 3288 Token: SeCreatePagefilePrivilege 3288 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 3288 3288 -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exeqa8OV16.exeUJ5tw58.exe1VU41qR3.exe4tW613JN.exedescription pid process target process PID 4032 wrote to memory of 2160 4032 ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe qa8OV16.exe PID 4032 wrote to memory of 2160 4032 ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe qa8OV16.exe PID 4032 wrote to memory of 2160 4032 ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe qa8OV16.exe PID 2160 wrote to memory of 2648 2160 qa8OV16.exe UJ5tw58.exe PID 2160 wrote to memory of 2648 2160 qa8OV16.exe UJ5tw58.exe PID 2160 wrote to memory of 2648 2160 qa8OV16.exe UJ5tw58.exe PID 2648 wrote to memory of 3064 2648 UJ5tw58.exe 1VU41qR3.exe PID 2648 wrote to memory of 3064 2648 UJ5tw58.exe 1VU41qR3.exe PID 2648 wrote to memory of 3064 2648 UJ5tw58.exe 1VU41qR3.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 3064 wrote to memory of 4920 3064 1VU41qR3.exe AppLaunch.exe PID 2648 wrote to memory of 4632 2648 UJ5tw58.exe 2Mi1470.exe PID 2648 wrote to memory of 4632 2648 UJ5tw58.exe 2Mi1470.exe PID 2648 wrote to memory of 4632 2648 UJ5tw58.exe 2Mi1470.exe PID 2160 wrote to memory of 2060 2160 qa8OV16.exe 3Nf04gW.exe PID 2160 wrote to memory of 2060 2160 qa8OV16.exe 3Nf04gW.exe PID 2160 wrote to memory of 2060 2160 qa8OV16.exe 3Nf04gW.exe PID 4032 wrote to memory of 4600 4032 ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe 4tW613JN.exe PID 4032 wrote to memory of 4600 4032 ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe 4tW613JN.exe PID 4032 wrote to memory of 4600 4032 ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe 4tW613JN.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe PID 4600 wrote to memory of 1788 4600 4tW613JN.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe"C:\Users\Admin\AppData\Local\Temp\ae93b377aa4aeb6d1c1dd333d951b62febb1e7717f43a4d6a6a33352c01f186f.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4032 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qa8OV16.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qa8OV16.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UJ5tw58.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UJ5tw58.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2648 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1VU41qR3.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1VU41qR3.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3064 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"5⤵
- Modifies Windows Defender Real-time Protection settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920 -
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Mi1470.exeC:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Mi1470.exe4⤵
- Executes dropped EXE
PID:4632 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4632 -s 2045⤵
- Program crash
PID:4016 -
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Nf04gW.exeC:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Nf04gW.exe3⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:2060 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4tW613JN.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4tW613JN.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4600 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵PID:1788
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 440 -p 4632 -ip 46321⤵PID:3548
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4tW613JN.exeFilesize
1.1MB
MD5d746028d9b92cf0a82f036da5cebbca6
SHA161632dd78fa963729d60291ffab4c055d593f737
SHA256939d122f1414bcd490262a60a323bfabc30d84169d24fd80846cca54614ca637
SHA512f030f4687e4b2401944409d0ac67d5e22e1adb6c44c3765e657952c257b2eeb7b4e2a855b4d05f2fc6f28ecd5c5f30745ada40d1725084e485e04ab49055c08c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\4tW613JN.exeFilesize
1.1MB
MD5d746028d9b92cf0a82f036da5cebbca6
SHA161632dd78fa963729d60291ffab4c055d593f737
SHA256939d122f1414bcd490262a60a323bfabc30d84169d24fd80846cca54614ca637
SHA512f030f4687e4b2401944409d0ac67d5e22e1adb6c44c3765e657952c257b2eeb7b4e2a855b4d05f2fc6f28ecd5c5f30745ada40d1725084e485e04ab49055c08c
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qa8OV16.exeFilesize
667KB
MD50cc15174b75e5f8b741ae6f7e6f94e51
SHA12f85286b931ab04bb1a664fcdd794d2aeb5057e9
SHA256408bbac3f6257dfeba47b4a7bfe7fc01297df930e624b9c10f952e91f0487cb6
SHA5124b2b103d876f79cad600f9a2c53da4fb702b246c0e3c7c52decd3a581bde18a8e346ebd72c433152fe629a9094f340a70eb9d55a3cae38c7f9d18248652c36c1
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\qa8OV16.exeFilesize
667KB
MD50cc15174b75e5f8b741ae6f7e6f94e51
SHA12f85286b931ab04bb1a664fcdd794d2aeb5057e9
SHA256408bbac3f6257dfeba47b4a7bfe7fc01297df930e624b9c10f952e91f0487cb6
SHA5124b2b103d876f79cad600f9a2c53da4fb702b246c0e3c7c52decd3a581bde18a8e346ebd72c433152fe629a9094f340a70eb9d55a3cae38c7f9d18248652c36c1
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Nf04gW.exeFilesize
30KB
MD524202fc89d7119cd91fb8fc48d2f0660
SHA1522aaa348175a556ae331adc615f0fa1f7b0e801
SHA256d57b4be2f01acad7655b13b8138eb88d77a454353fbd5eb58cb148bcc18450d5
SHA512d4aec65900de2378c64f59cb0526982f668b9214ea9e481d3d1620816f68255acdee1116e25104cb0b974906041178f0c9ef657157c1a5bb97798b4783b9c991
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\3Nf04gW.exeFilesize
30KB
MD524202fc89d7119cd91fb8fc48d2f0660
SHA1522aaa348175a556ae331adc615f0fa1f7b0e801
SHA256d57b4be2f01acad7655b13b8138eb88d77a454353fbd5eb58cb148bcc18450d5
SHA512d4aec65900de2378c64f59cb0526982f668b9214ea9e481d3d1620816f68255acdee1116e25104cb0b974906041178f0c9ef657157c1a5bb97798b4783b9c991
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UJ5tw58.exeFilesize
543KB
MD5f0392fe09b629cf1f9b8363445e5bd02
SHA1ea1d97d9cad661e647d8f7a14d2ac4a1bbfe8834
SHA256f1a7a324db3d1a40d3fef738b8c02766ed1c9f3d67af6dcd5c9e54343a89a9b6
SHA5123ff74c2747f805e19a869b1cc4e333e08a23e6f0093d4c4f5c66590937b8f5387b5d28bef5bdd8634b1cd3569c7f65ab95d565c50be70c86e310da9c1479ed48
-
C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\UJ5tw58.exeFilesize
543KB
MD5f0392fe09b629cf1f9b8363445e5bd02
SHA1ea1d97d9cad661e647d8f7a14d2ac4a1bbfe8834
SHA256f1a7a324db3d1a40d3fef738b8c02766ed1c9f3d67af6dcd5c9e54343a89a9b6
SHA5123ff74c2747f805e19a869b1cc4e333e08a23e6f0093d4c4f5c66590937b8f5387b5d28bef5bdd8634b1cd3569c7f65ab95d565c50be70c86e310da9c1479ed48
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1VU41qR3.exeFilesize
886KB
MD5ee591188b7b4f2a6dd3b82c9d404bc10
SHA18b3c63d74bfeb037f03b21781676ec5560ace12c
SHA256984a6c16bb0364edbe79296317fdd76c355d36ad67fb1190f6d854fa4bf4dccb
SHA512bd651dc7de9cce917ef9ff83f8e91860167d8d758f2bd301ec1adfea40118214fb220d712bfeb7801af7b30ad182a52d46986e84a5642e1993a7c41a49b6071d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\1VU41qR3.exeFilesize
886KB
MD5ee591188b7b4f2a6dd3b82c9d404bc10
SHA18b3c63d74bfeb037f03b21781676ec5560ace12c
SHA256984a6c16bb0364edbe79296317fdd76c355d36ad67fb1190f6d854fa4bf4dccb
SHA512bd651dc7de9cce917ef9ff83f8e91860167d8d758f2bd301ec1adfea40118214fb220d712bfeb7801af7b30ad182a52d46986e84a5642e1993a7c41a49b6071d
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Mi1470.exeFilesize
1.1MB
MD5fecd2da3b62d2c85f21b43402c26a418
SHA18c770c8aa4e049d4f7b164292fc6d8b42522fc7f
SHA256e67070133d12660528abc2337209494c5b37733b8946375505fbfe3ee32bc62a
SHA512216ef8e331e206ba27d590d776ee93bef380682394d73aaf2be305255cbc6b4d692fbde45c28719a3975d1fffb63686b6bd789f35909d0592d13a78e229ebb78
-
C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\2Mi1470.exeFilesize
1.1MB
MD5fecd2da3b62d2c85f21b43402c26a418
SHA18c770c8aa4e049d4f7b164292fc6d8b42522fc7f
SHA256e67070133d12660528abc2337209494c5b37733b8946375505fbfe3ee32bc62a
SHA512216ef8e331e206ba27d590d776ee93bef380682394d73aaf2be305255cbc6b4d692fbde45c28719a3975d1fffb63686b6bd789f35909d0592d13a78e229ebb78
-
memory/1788-48-0x0000000007F90000-0x0000000007FA2000-memory.dmpFilesize
72KB
-
memory/1788-46-0x0000000008DA0000-0x00000000093B8000-memory.dmpFilesize
6.1MB
-
memory/1788-40-0x00000000081D0000-0x0000000008774000-memory.dmpFilesize
5.6MB
-
memory/1788-51-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/1788-41-0x0000000007D00000-0x0000000007D92000-memory.dmpFilesize
584KB
-
memory/1788-49-0x0000000007FF0000-0x000000000802C000-memory.dmpFilesize
240KB
-
memory/1788-38-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1788-42-0x0000000007F20000-0x0000000007F30000-memory.dmpFilesize
64KB
-
memory/1788-52-0x0000000007F20000-0x0000000007F30000-memory.dmpFilesize
64KB
-
memory/1788-50-0x0000000008170000-0x00000000081BC000-memory.dmpFilesize
304KB
-
memory/1788-39-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/1788-43-0x0000000007EA0000-0x0000000007EAA000-memory.dmpFilesize
40KB
-
memory/1788-47-0x0000000008060000-0x000000000816A000-memory.dmpFilesize
1.0MB
-
memory/2060-28-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/2060-32-0x0000000000400000-0x0000000000409000-memory.dmpFilesize
36KB
-
memory/3288-30-0x0000000002ED0000-0x0000000002EE6000-memory.dmpFilesize
88KB
-
memory/4920-45-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4920-21-0x0000000000400000-0x000000000040A000-memory.dmpFilesize
40KB
-
memory/4920-25-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB
-
memory/4920-34-0x0000000074AB0000-0x0000000075260000-memory.dmpFilesize
7.7MB