Analysis
-
max time kernel
93s -
max time network
93s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
11-01-2021 15:41
General
-
Target
Setup Crypto Bot.msi
-
Size
1.1MB
-
MD5
5b222388d5696dd34a1dd9eb2e477e63
-
SHA1
877b72f0aff67981bf96d28515afb843cc500cae
-
SHA256
ba3a59b3ecd24ead1ca238ef12ce987103f88aec7f30becffbad873338ff9eb1
-
SHA512
db6dbf5b505beaf559323301807668baf378a4b91eda98b99728ad500dd9bcfcdbab1824d788ab8bcafed80922ee99b713c424c4ceddcb5bab497b9a5fc1a10a
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 2 IoCs
-
Loads dropped DLL 2 IoCs
-
Enumerates connected drives 3 TTPs 48 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 11 IoCs
-
Checks SCSI registry key(s) 3 TTPs 64 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Modifies data under HKEY_USERS 2 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 54 IoCs
-
Suspicious use of FindShellTrayWindow 2 IoCs
-
Suspicious use of WriteProcessMemory 19 IoCs
Processes
-
C:\Windows\system32\msiexec.exemsiexec.exe /I "C:\Users\Admin\AppData\Local\Temp\Setup Crypto Bot.msi"1⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\srtasks.exeC:\Windows\system32\srtasks.exe ExecuteScopeRestorePoint /WaitForRestorePoint:22⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\syswow64\MsiExec.exeC:\Windows\syswow64\MsiExec.exe -Embedding ECB7F40FB10E742AF55096B935E56D312⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\expand.exe"C:\Windows\System32\expand.exe" -R files.cab -F:* files3⤵
- Drops file in Windows directory
-
C:\Users\Admin\AppData\Local\Temp\MW-4bdccba2-2e51-40d8-b41d-fffe8ba3a7ed\files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\MW-4bdccba2-2e51-40d8-b41d-fffe8ba3a7ed\files\Setup.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\MW-4bdccba2-2e51-40d8-b41d-fffe8ba3a7ed\files\Setup.exe"C:\Users\Admin\AppData\Local\Temp\MW-4bdccba2-2e51-40d8-b41d-fffe8ba3a7ed\files\Setup.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
\??\c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k netsvcs -s DsmSvc1⤵
- Checks SCSI registry key(s)
- Modifies data under HKEY_USERS
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
90acfd72f14a512712b1a7380c0faf60
SHA140ba4accb8faa75887e84fb8e38d598dc8cf0f12
SHA25620806822f0c130b340504132c1461b589261fbbc518e468f4f90733ab514cb86
SHA51229dbf85e14e60868574cb4dc9bda83d3c229fb956733d8d2557f2475ee0e690ac9c2e72f31e02284996da6906ba2dbfa382a29b04c15a2406571d8ee19ad16b9
-
MD5
06b715e266a09d3ef2de069f4c50add4
SHA1c4a60721aa977b8f4ba036a614e2427158749042
SHA256f26fe1c60a7ba7236666609ebdf397dd3ab265ac3b3e9e29c560c3ca42ac3563
SHA512309b0b49d977697202c3d303b7f05ae4fd5744e721239a2667259a51db7fe524117321dc60d993f429edc2b4720dc5fe6316c28f95d2a555f64b4036ba1d85e9
-
MD5
e26037b5d85242c22b0360d19f4dca48
SHA13a76fd483cf554bb4e4979e8f2bdfef4667f4daa
SHA2561432df02340298b46ef42cff5bd0a923fe095c553f85d404f6914b76ca850c5f
SHA512f64a8944a09b141f6254b897391a02c23e73b6fdb8863c23b1d8d8ee8ad6e3ea40fa719940dad843075109f366c6133d1b306de498a1ce64ca4854d6e1e71ad6
-
MD5
e26037b5d85242c22b0360d19f4dca48
SHA13a76fd483cf554bb4e4979e8f2bdfef4667f4daa
SHA2561432df02340298b46ef42cff5bd0a923fe095c553f85d404f6914b76ca850c5f
SHA512f64a8944a09b141f6254b897391a02c23e73b6fdb8863c23b1d8d8ee8ad6e3ea40fa719940dad843075109f366c6133d1b306de498a1ce64ca4854d6e1e71ad6
-
MD5
e26037b5d85242c22b0360d19f4dca48
SHA13a76fd483cf554bb4e4979e8f2bdfef4667f4daa
SHA2561432df02340298b46ef42cff5bd0a923fe095c553f85d404f6914b76ca850c5f
SHA512f64a8944a09b141f6254b897391a02c23e73b6fdb8863c23b1d8d8ee8ad6e3ea40fa719940dad843075109f366c6133d1b306de498a1ce64ca4854d6e1e71ad6
-
MD5
469d8a27c6637a765a5f29ba451d736a
SHA14320ec9aebdab7d50b4be0f72b1b996d5fbe55d3
SHA256f2172cfc44b0194a62036e3185291a0ebbb509a7b22364cf7ecb721d74f519cc
SHA5127bc888a54e54e766d573c5836492788f0ff878813058f43f9565e2aa68d6c59c54fab175476cae46c45681efa3885c1e0406434d133f839e0308ee5094dbf2eb
-
MD5
469d8a27c6637a765a5f29ba451d736a
SHA14320ec9aebdab7d50b4be0f72b1b996d5fbe55d3
SHA256f2172cfc44b0194a62036e3185291a0ebbb509a7b22364cf7ecb721d74f519cc
SHA5127bc888a54e54e766d573c5836492788f0ff878813058f43f9565e2aa68d6c59c54fab175476cae46c45681efa3885c1e0406434d133f839e0308ee5094dbf2eb
-
MD5
1aef0972f1f398281a79ba2b89690fbf
SHA1e4f4c4ebb1076c8d80674cbaf3bfcfd75a95217e
SHA256d9a0ed2733035201bf305f0e127fc8a4d64b113c4764f6b22c88d788731c4a68
SHA512d7ec3e3c03f8d5748484abb661d6d6877d39bfd777f7f108d84d2c7f7781e7eaf2159c219b92f51188739e69b2ebb4139ac0713708cb46705ac025d1b4710a8b
-
MD5
457ca5fadbedd52dfc63c39cb8845e1c
SHA1df486f3a371d189c71e507a2f4dae724e6022820
SHA2565d47a4976e74260b07327a2ada8a9017056e3806f31f82c58057176b72f0f366
SHA512ff41bb818f143545df2bb4e9d027fbe030b2592ecd2e3d0cbd27e6a3fd747abb99956314b4c96a06aaa6e63e6d95703baf3c8588e893f086f2d3cbf3a5533de7
-
MD5
469d8a27c6637a765a5f29ba451d736a
SHA14320ec9aebdab7d50b4be0f72b1b996d5fbe55d3
SHA256f2172cfc44b0194a62036e3185291a0ebbb509a7b22364cf7ecb721d74f519cc
SHA5127bc888a54e54e766d573c5836492788f0ff878813058f43f9565e2aa68d6c59c54fab175476cae46c45681efa3885c1e0406434d133f839e0308ee5094dbf2eb
-
MD5
469d8a27c6637a765a5f29ba451d736a
SHA14320ec9aebdab7d50b4be0f72b1b996d5fbe55d3
SHA256f2172cfc44b0194a62036e3185291a0ebbb509a7b22364cf7ecb721d74f519cc
SHA5127bc888a54e54e766d573c5836492788f0ff878813058f43f9565e2aa68d6c59c54fab175476cae46c45681efa3885c1e0406434d133f839e0308ee5094dbf2eb
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
72KB
-
Filesize
720KB
-
Filesize
4KB
-
Filesize
16KB
-
-
Filesize
152KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
-