Analysis
-
max time kernel
83s -
max time network
22s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
07-03-2021 07:35
Static task
static1
Behavioral task
behavioral1
Sample
9290fe75175367dd6330d504164fb597.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
9290fe75175367dd6330d504164fb597.exe
Resource
win10v20201028
General
-
Target
9290fe75175367dd6330d504164fb597.exe
-
Size
32KB
-
MD5
9290fe75175367dd6330d504164fb597
-
SHA1
d0ef05fc64c35901a6de03daf3a972e760e7876e
-
SHA256
e58ef47a566a73ad01ce7a37c178d1fce2a3282882f814997aab487200cf8005
-
SHA512
b92e1b267d9701a75d6680282c448170696680573a4e25e676747debc4fbd9af6209c9d7edf646a090442f800484b010f5bb2b96088db930c79590a19dd0a97d
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/792-7-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral1/memory/792-8-0x000000000041EFDA-mapping.dmp family_redline behavioral1/memory/792-10-0x0000000000400000-0x0000000000426000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
driver_audio.exeservice.exepid process 1484 driver_audio.exe 1088 service.exe -
Loads dropped DLL 1 IoCs
Processes:
AddInProcess32.exepid process 792 AddInProcess32.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9290fe75175367dd6330d504164fb597.exedescription pid process target process PID 1832 set thread context of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Processes:
9290fe75175367dd6330d504164fb597.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13\Blob = 040000000100000010000000410352dc0ff7501b16f0028eba6f45c50f00000001000000140000005bcaa1c2780f0bcb5a90770451d96f38963f012d0b000000010000001e000000440053005400200052006f006f0074002000430041002000580033000000090000000100000016000000301406082b0601050507030406082b06010505070301140000000100000014000000c4a7b1a47b2c71fadbe14b9075ffc415608589101d00000001000000100000004558d512eecb27464920897de7b66053030000000100000014000000dac9024f54d8f6df94935fb1732638ca6ad77c131900000001000000100000006cf252fec3e8f20996de5d4dd9aef42420000000010000004e0300003082034a30820232a003020102021044afb080d6a327ba893039862ef8406b300d06092a864886f70d0101050500303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f74204341205833301e170d3030303933303231313231395a170d3231303933303134303131355a303f31243022060355040a131b4469676974616c205369676e617475726520547275737420436f2e311730150603550403130e44535420526f6f7420434120583330820122300d06092a864886f70d01010105000382010f003082010a0282010100dfafe99750088357b4cc6265f69082ecc7d32c6b30ca5becd9c37dc740c118148be0e83376492ae33f214993ac4e0eaf3e48cb65eefcd3210f65d22ad9328f8ce5f777b0127bb595c089a3a9baed732e7a0c063283a27e8a1430cd11a0e12a38b9790a31fd50bd8065dfb7516383c8e28861ea4b6181ec526bb9a2e24b1a289f48a39e0cda098e3e172e1edd20df5bc62a8aab2ebd70adc50b1a25907472c57b6aab34d63089ffe568137b540bc8d6aeec5a9c921e3d64b38cc6dfbfc94170ec1672d526ec38553943d0fcfd185c40f197ebd59a9b8d1dbada25b9c6d8dfc115023aabda6ef13e2ef55c089c3cd68369e4109b192ab62957e3e53d9b9ff0025d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e04160414c4a7b1a47b2c71fadbe14b9075ffc41560858910300d06092a864886f70d01010505000382010100a31a2c9b17005ca91eee2866373abf83c73f4bc309a095205de3d95944d23e0d3ebd8a4ba0741fce10829c741a1d7e981addcb134bb32044e491e9ccfc7da5db6ae5fee6fde04eddb7003ab57049aff2e5eb02f1d1028b19cb943a5e48c4181e58195f1e025af00cf1b1ada9dc59868b6ee991f586cafab96633aa595bcee2a7167347cb2bcc99b03748cfe3564bf5cf0f0c723287c6f044bb53726d43f526489a5267b758abfe67767178db0da256141339243185a2a8025a3047e1dd5007bc02099000eb6463609b16bc88c912e6d27d918bf93d328d65b4e97cb15776eac5b62839bf15651cc8f677966a0a8d770bd8910b048e07db29b60aee9d82353510 9290fe75175367dd6330d504164fb597.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\DAC9024F54D8F6DF94935FB1732638CA6AD77C13 9290fe75175367dd6330d504164fb597.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AddInProcess32.exepid process 792 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9290fe75175367dd6330d504164fb597.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 1832 9290fe75175367dd6330d504164fb597.exe Token: SeDebugPrivilege 792 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
9290fe75175367dd6330d504164fb597.exeAddInProcess32.exedriver_audio.execmd.exetaskeng.exeservice.execmd.exedescription pid process target process PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 1832 wrote to memory of 792 1832 9290fe75175367dd6330d504164fb597.exe AddInProcess32.exe PID 792 wrote to memory of 1484 792 AddInProcess32.exe driver_audio.exe PID 792 wrote to memory of 1484 792 AddInProcess32.exe driver_audio.exe PID 792 wrote to memory of 1484 792 AddInProcess32.exe driver_audio.exe PID 792 wrote to memory of 1484 792 AddInProcess32.exe driver_audio.exe PID 1484 wrote to memory of 1000 1484 driver_audio.exe cmd.exe PID 1484 wrote to memory of 1000 1484 driver_audio.exe cmd.exe PID 1484 wrote to memory of 1000 1484 driver_audio.exe cmd.exe PID 1484 wrote to memory of 1000 1484 driver_audio.exe cmd.exe PID 1000 wrote to memory of 668 1000 cmd.exe schtasks.exe PID 1000 wrote to memory of 668 1000 cmd.exe schtasks.exe PID 1000 wrote to memory of 668 1000 cmd.exe schtasks.exe PID 1000 wrote to memory of 668 1000 cmd.exe schtasks.exe PID 1056 wrote to memory of 1088 1056 taskeng.exe service.exe PID 1056 wrote to memory of 1088 1056 taskeng.exe service.exe PID 1056 wrote to memory of 1088 1056 taskeng.exe service.exe PID 1056 wrote to memory of 1088 1056 taskeng.exe service.exe PID 1088 wrote to memory of 1516 1088 service.exe cmd.exe PID 1088 wrote to memory of 1516 1088 service.exe cmd.exe PID 1088 wrote to memory of 1516 1088 service.exe cmd.exe PID 1088 wrote to memory of 1516 1088 service.exe cmd.exe PID 1516 wrote to memory of 1684 1516 cmd.exe schtasks.exe PID 1516 wrote to memory of 1684 1516 cmd.exe schtasks.exe PID 1516 wrote to memory of 1684 1516 cmd.exe schtasks.exe PID 1516 wrote to memory of 1684 1516 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9290fe75175367dd6330d504164fb597.exe"C:\Users\Admin\AppData\Local\Temp\9290fe75175367dd6330d504164fb597.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\driver_audio.exe"C:\Users\Admin\AppData\Local\Temp\driver_audio.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f5⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {C57ADEB7-3B4F-4B7C-B8B6-82AA46FD7666} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\service.exeC:\Users\Admin\AppData\Roaming\service.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C schtasks /create /tn MyApp /tr %APPDATA%\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn MyApp /tr C:\Users\Admin\AppData\Roaming\service.exe /st 00:00 /du 9999:59 /sc daily /ri 1 /f4⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\driver_audio.exeMD5
4b932f40941f6db7383af06d84d21ce1
SHA16bed3b94188e6c1a189e4e01bfab4c6a3c65f585
SHA25620a9cd0868b1b7a6416048bbf924ba4cf4c4b596543f2eb5c8bf24166951b875
SHA512465738cd091b14a0301d15fa4bae3319e5d05a4d135b1f6f49d1eaa78409c8bc44ba0a75e956333ba0a9cc7cada9db99cf5de76c55dec37e77ed2c2d51a3dc8b
-
C:\Users\Admin\AppData\Local\Temp\driver_audio.exeMD5
4b932f40941f6db7383af06d84d21ce1
SHA16bed3b94188e6c1a189e4e01bfab4c6a3c65f585
SHA25620a9cd0868b1b7a6416048bbf924ba4cf4c4b596543f2eb5c8bf24166951b875
SHA512465738cd091b14a0301d15fa4bae3319e5d05a4d135b1f6f49d1eaa78409c8bc44ba0a75e956333ba0a9cc7cada9db99cf5de76c55dec37e77ed2c2d51a3dc8b
-
C:\Users\Admin\AppData\Roaming\service.exeMD5
4b932f40941f6db7383af06d84d21ce1
SHA16bed3b94188e6c1a189e4e01bfab4c6a3c65f585
SHA25620a9cd0868b1b7a6416048bbf924ba4cf4c4b596543f2eb5c8bf24166951b875
SHA512465738cd091b14a0301d15fa4bae3319e5d05a4d135b1f6f49d1eaa78409c8bc44ba0a75e956333ba0a9cc7cada9db99cf5de76c55dec37e77ed2c2d51a3dc8b
-
C:\Users\Admin\AppData\Roaming\service.exeMD5
4b932f40941f6db7383af06d84d21ce1
SHA16bed3b94188e6c1a189e4e01bfab4c6a3c65f585
SHA25620a9cd0868b1b7a6416048bbf924ba4cf4c4b596543f2eb5c8bf24166951b875
SHA512465738cd091b14a0301d15fa4bae3319e5d05a4d135b1f6f49d1eaa78409c8bc44ba0a75e956333ba0a9cc7cada9db99cf5de76c55dec37e77ed2c2d51a3dc8b
-
\Users\Admin\AppData\Local\Temp\driver_audio.exeMD5
4b932f40941f6db7383af06d84d21ce1
SHA16bed3b94188e6c1a189e4e01bfab4c6a3c65f585
SHA25620a9cd0868b1b7a6416048bbf924ba4cf4c4b596543f2eb5c8bf24166951b875
SHA512465738cd091b14a0301d15fa4bae3319e5d05a4d135b1f6f49d1eaa78409c8bc44ba0a75e956333ba0a9cc7cada9db99cf5de76c55dec37e77ed2c2d51a3dc8b
-
memory/668-19-0x0000000000000000-mapping.dmp
-
memory/792-8-0x000000000041EFDA-mapping.dmp
-
memory/792-12-0x00000000049B0000-0x00000000049B1000-memory.dmpFilesize
4KB
-
memory/792-9-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/792-10-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/792-7-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/1000-17-0x0000000000000000-mapping.dmp
-
memory/1088-21-0x0000000000000000-mapping.dmp
-
memory/1484-14-0x0000000000000000-mapping.dmp
-
memory/1516-24-0x0000000000000000-mapping.dmp
-
memory/1684-25-0x0000000000000000-mapping.dmp
-
memory/1832-2-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/1832-6-0x0000000001DF0000-0x0000000001DF1000-memory.dmpFilesize
4KB
-
memory/1832-5-0x0000000075DE1000-0x0000000075DE3000-memory.dmpFilesize
8KB
-
memory/1832-3-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB