Analysis
-
max time kernel
301s -
max time network
298s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
27-12-2020 08:29
Static task
static1
Behavioral task
behavioral1
Sample
client.bin.exe
Resource
win10v20201028
Behavioral task
behavioral2
Sample
client.bin.exe
Resource
win10v20201028
Behavioral task
behavioral3
Sample
client.bin.exe
Resource
win10v20201028
Behavioral task
behavioral4
Sample
client.bin.exe
Resource
win10v20201028
General
-
Target
client.bin.exe
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
resource yara_rule behavioral2/memory/2068-79-0x0000000000400000-0x000000000042A000-memory.dmp family_redline behavioral2/memory/2068-80-0x000000000042411A-mapping.dmp family_redline -
Executes dropped EXE 7 IoCs
pid Process 1640 NS-0F794.tmp 2328 dwm.exe 4044 1.exe 2432 WindowsFormsApp1.exe 3932 dwedfwefewfweferferf.exe 3904 2.exe 2068 2.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\International\Geo\Nation dwm.exe -
Loads dropped DLL 9 IoCs
pid Process 1640 NS-0F794.tmp 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\dwm = "C:\\Users\\Admin\\AppData\\Roaming\\DEPLOY~1\\dwm.exe" reg.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Looks up external IP address via web service 4 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 33 api.ipify.org 34 ip-api.com 45 checkip.amazonaws.com 32 api.ipify.org -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3904 set thread context of 2068 3904 2.exe 94 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Enumerates system info in registry 2 TTPs 1 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier xcopy.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 756 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 2328 dwm.exe 3932 dwedfwefewfweferferf.exe 3932 dwedfwefewfweferferf.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2328 dwm.exe Token: SeDebugPrivilege 3932 dwedfwefewfweferferf.exe Token: SeDebugPrivilege 2068 2.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3904 2.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 3904 2.exe -
Suspicious use of WriteProcessMemory 49 IoCs
description pid Process procid_target PID 2604 wrote to memory of 1640 2604 client.bin.exe 74 PID 2604 wrote to memory of 1640 2604 client.bin.exe 74 PID 2604 wrote to memory of 1640 2604 client.bin.exe 74 PID 1640 wrote to memory of 2924 1640 NS-0F794.tmp 76 PID 1640 wrote to memory of 2924 1640 NS-0F794.tmp 76 PID 1640 wrote to memory of 2924 1640 NS-0F794.tmp 76 PID 2924 wrote to memory of 1276 2924 cmd.exe 78 PID 2924 wrote to memory of 1276 2924 cmd.exe 78 PID 2924 wrote to memory of 1276 2924 cmd.exe 78 PID 2924 wrote to memory of 2328 2924 cmd.exe 79 PID 2924 wrote to memory of 2328 2924 cmd.exe 79 PID 2924 wrote to memory of 2328 2924 cmd.exe 79 PID 2328 wrote to memory of 1332 2328 dwm.exe 80 PID 2328 wrote to memory of 1332 2328 dwm.exe 80 PID 2328 wrote to memory of 1332 2328 dwm.exe 80 PID 1332 wrote to memory of 2160 1332 cmd.exe 82 PID 1332 wrote to memory of 2160 1332 cmd.exe 82 PID 1332 wrote to memory of 2160 1332 cmd.exe 82 PID 2328 wrote to memory of 4044 2328 dwm.exe 86 PID 2328 wrote to memory of 4044 2328 dwm.exe 86 PID 2328 wrote to memory of 4044 2328 dwm.exe 86 PID 4044 wrote to memory of 2432 4044 1.exe 87 PID 4044 wrote to memory of 2432 4044 1.exe 87 PID 2432 wrote to memory of 3932 2432 WindowsFormsApp1.exe 89 PID 2432 wrote to memory of 3932 2432 WindowsFormsApp1.exe 89 PID 2432 wrote to memory of 3932 2432 WindowsFormsApp1.exe 89 PID 2328 wrote to memory of 3904 2328 dwm.exe 90 PID 2328 wrote to memory of 3904 2328 dwm.exe 90 PID 2328 wrote to memory of 3904 2328 dwm.exe 90 PID 3932 wrote to memory of 432 3932 dwedfwefewfweferferf.exe 91 PID 3932 wrote to memory of 432 3932 dwedfwefewfweferferf.exe 91 PID 3932 wrote to memory of 432 3932 dwedfwefewfweferferf.exe 91 PID 432 wrote to memory of 740 432 cmd.exe 93 PID 432 wrote to memory of 740 432 cmd.exe 93 PID 432 wrote to memory of 740 432 cmd.exe 93 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 3904 wrote to memory of 2068 3904 2.exe 94 PID 2068 wrote to memory of 2324 2068 2.exe 95 PID 2068 wrote to memory of 2324 2068 2.exe 95 PID 2068 wrote to memory of 2324 2068 2.exe 95 PID 2324 wrote to memory of 756 2324 cmd.exe 97 PID 2324 wrote to memory of 756 2324 cmd.exe 97 PID 2324 wrote to memory of 756 2324 cmd.exe 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\client.bin.exe"C:\Users\Admin\AppData\Local\Temp\client.bin.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2604 -
C:\Users\Admin\AppData\Local\Temp\NS-TQ80C.tmp\NS-0F794.tmp"C:\Users\Admin\AppData\Local\Temp\NS-TQ80C.tmp\NS-0F794.tmp" /et9 $20116 C:\Users\Admin\AppData\Local\Temp\client.bin.exe 4590206 359424 /password=1dwhcbw /verysilent2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /C ""C:\Users\Admin\AppData\Local\Temp\ml2os0lx\lb3od53.bat""3⤵
- Suspicious use of WriteProcessMemory
PID:2924 -
C:\Windows\SysWOW64\xcopy.exexcopy /Y /I /S "C:\Users\Admin\AppData\Local\Temp\ml2os0lx\*" "C:\Users\Admin\AppData\Roaming\Deployment\"4⤵
- Enumerates system info in registry
PID:1276
-
-
C:\Users\Admin\AppData\Roaming\Deployment\dwm.exe"C:\Users\Admin\AppData\Roaming\Deployment\dwm.exe"4⤵
- Executes dropped EXE
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "dwm" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\DEPLOY~1\dwm.exe"5⤵
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\RunOnce" /V "dwm" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\DEPLOY~1\dwm.exe"6⤵
- Adds Run key to start application
PID:2160
-
-
-
C:\Users\Admin\AppData\Local\Temp\1.exeC:\Users\Admin\AppData\Local\Temp\1.exe5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe"C:\Users\Admin\AppData\Local\Temp\WindowsFormsApp1.exe"6⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2432 -
C:\Users\Admin\AppData\Local\dwedfwefewfweferferf.exe"C:\Users\Admin\AppData\Local\dwedfwefewfweferferf.exe"7⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3932 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 3 & Del "dwedfwefewfweferferf.exe"8⤵
- Suspicious use of WriteProcessMemory
PID:432 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 39⤵PID:740
-
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\2.exeC:\Users\Admin\AppData\Local\Temp\2.exe5⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:3904 -
C:\Users\Admin\AppData\Local\Temp\2.exe"{path}"6⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2068 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C ping 127.0.0.1 -n 3 > nul & del "C:\Users\Admin\AppData\Local\Temp\2.exe"7⤵
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 38⤵
- Runs ping.exe
PID:756
-
-
-
-
-
-
-