Analysis
- max time kernel
151s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
16/12/2023, 01:56
General
- Target 8b8b26e8bfb7b546d6298536f47b4020.exe
- Size 452KB
- Sample231216-ccn8bsbdf7
- SHA256 38b996babe91a3ea4fac1e349e0723d40621107dfd34f14bd2d4764fbb695b31
Malware Config
Extracted
-
smokeloader
-
2022
-
http://185.215.113.68/fks/index.php
Extracted
-
redline
-
@oleh_ps
-
176.123.7.190:32927
Signatures
- Detect Lumma Stealer payload V4 4 IoCs
- Lumma Stealer
An infostealer written in C++ first seen in August 2022.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- SmokeLoader
Modular backdoor trojan in use since 2014.
- Drops startup file 1 IoCs
- Executes dropped EXE 4 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses Microsoft Outlook profiles 1 TTPs 3 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Program crash 2 IoCs
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
- outlook_office_path 1 IoCs
- outlook_win_path 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b8b26e8bfb7b546d6298536f47b4020.exe"C:\Users\Admin\AppData\Local\Temp\8b8b26e8bfb7b546d6298536f47b4020.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ft6863.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\2ft6863.exe2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Accesses Microsoft Outlook profiles
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- outlook_office_path
- outlook_win_path
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 HR" /sc HOURLY /rl HIGHEST4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c schtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /RU "Admin" /tr "C:\ProgramData\OfficeTrackerNMP131\OfficeTrackerNMP131.exe" /tn "OfficeTrackerNMP131 LG" /sc ONLOGON /rl HIGHEST4⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 548 -s 29683⤵
- Program crash
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5fT3Ut8.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\5fT3Ut8.exe2⤵
- Executes dropped EXE
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 548 -ip 5481⤵
-
C:\Users\Admin\AppData\Local\Temp\5D7D.exeC:\Users\Admin\AppData\Local\Temp\5D7D.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2728 -s 9402⤵
- Program crash
-
-
C:\Users\Admin\AppData\Local\Temp\607B.exeC:\Users\Admin\AppData\Local\Temp\607B.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 500 -p 2728 -ip 27281⤵
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Replay Monitor
Loading Replay Monitor...
Downloads
5D7D.exe
607B.exe
2ft6863.exe
5fT3Ut8.exe
NClboui0vxTiWeb Data
iontOPbgN4O5Web Data
sqlite3.dll
memory/548-10-0x0000000007530000-0x0000000007540000-memory.dmp
memory/548-24-0x0000000008E60000-0x00000000091B4000-memory.dmp
memory/548-23-0x0000000008910000-0x000000000892E000-memory.dmp
memory/548-79-0x0000000005190000-0x00000000051F6000-memory.dmp
memory/548-87-0x0000000073FE0000-0x0000000074790000-memory.dmp
memory/548-88-0x0000000073FE0000-0x0000000074790000-memory.dmp
memory/548-9-0x00000000075C0000-0x0000000007636000-memory.dmp
memory/548-8-0x0000000000760000-0x000000000082E000-memory.dmp
memory/548-7-0x0000000073FE0000-0x0000000074790000-memory.dmp
memory/1532-92-0x0000000000400000-0x000000000040A000-memory.dmp
memory/1532-95-0x0000000000400000-0x000000000040A000-memory.dmp
memory/2728-102-0x0000000000990000-0x0000000000A90000-memory.dmp
memory/2728-103-0x0000000002500000-0x000000000257C000-memory.dmp
memory/2728-108-0x0000000000400000-0x0000000000892000-memory.dmp
memory/2728-121-0x0000000002500000-0x000000000257C000-memory.dmp
memory/2728-120-0x0000000000400000-0x0000000000892000-memory.dmp
memory/3372-93-0x0000000001470000-0x0000000001486000-memory.dmp
memory/4928-114-0x0000000007620000-0x000000000762A000-memory.dmp
memory/4928-112-0x0000000007660000-0x00000000076F2000-memory.dmp
memory/4928-113-0x0000000007800000-0x0000000007810000-memory.dmp
memory/4928-111-0x0000000007B70000-0x0000000008114000-memory.dmp
memory/4928-115-0x0000000008740000-0x0000000008D58000-memory.dmp
memory/4928-116-0x0000000007960000-0x0000000007A6A000-memory.dmp
memory/4928-117-0x0000000007890000-0x00000000078A2000-memory.dmp
memory/4928-118-0x00000000078F0000-0x000000000792C000-memory.dmp
memory/4928-119-0x0000000007A70000-0x0000000007ABC000-memory.dmp
memory/4928-110-0x0000000000840000-0x000000000087C000-memory.dmp
memory/4928-109-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/4928-122-0x0000000074410000-0x0000000074BC0000-memory.dmp
memory/4928-123-0x0000000007800000-0x0000000007810000-memory.dmp