Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231201-en -
resource tags
-
submitted
11-12-2023 00:11
General
-
Target
11ba26c3e43e06c31802a613807bc0aa.exe
-
Size
37KB
-
MD5
11ba26c3e43e06c31802a613807bc0aa
-
SHA1
7f4b52473575f1b58a158fdb2c4adc5cdb40a338
-
SHA256
8fa6f659cc7a07a1769348ce2cea171dd5d9877f26167bae676a951a9275c87a
-
SHA512
f1ff3be21973b5cee9012ebe4b95118edb1c7e601450730dc83f513aa85bddc9ede7a2a2aadb5fb678b7336366b5308a9fb272b7752af36c41dd152da943cc7f
-
SSDEEP
768:d8n3N4JRqwg8UTB+8zx70f0PSuopLwlFFWO7:dmN4JRrg8ypxSKFFX
Malware Config
Extracted
smokeloader
2022
http://81.19.131.34/fks/index.php
Extracted
redline
LiveTraffic
77.105.132.87:6731
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
-
SmokeLoader
Modular backdoor trojan in use since 2014.
-
Downloads MZ/PE file
-
Deletes itself 1 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: MapViewOfSection 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of SendNotifyMessage 2 IoCs
-
Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\11ba26c3e43e06c31802a613807bc0aa.exe"C:\Users\Admin\AppData\Local\Temp\11ba26c3e43e06c31802a613807bc0aa.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\6900.exeC:\Users\Admin\AppData\Local\Temp\6900.exe1⤵
- Executes dropped EXE
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
276KB
MD591ae5a610a79fa0ad62a8d875b12e8a9
SHA11423999646545c24d3e5f3f0457a77775fa13833
SHA2565f18d389b975280ea0f8e402bc42c8e19646858c4b534a9de31287a16a5c896a
SHA512da96d2830b041d53a0354f7baa7fb86ab3e98eb1126bd7d4d7e4f2c7f0f00cce4a392375619c7542049da1f0ba784db4c8735db658514d40ae05553ef7277930
-
Filesize
135KB
MD5dc0a9d35e3c7128e74bae6068f91487d
SHA120b9cb4776d87e6e22e2709443fe8cf50ab74768
SHA25679daa04610c776290d5d5690ab903a3e5c3e9a4c2cfb66800ba03817abb2857c
SHA51241bfc1c863e7769415e9a0fd031aea939b03623e8f90c7f0d119c2d6423eeb82767c9cc22ac5ff94ca688aa8b58ce13c876c923bbeedf6c6c7ea47fa40fbd196
-
Filesize
88KB
-
Filesize
240KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
6.9MB
-
Filesize
256KB
-
Filesize
44KB
-
Filesize
44KB