Analysis
-
max time kernel
141s -
max time network
143s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
10-03-2021 13:54
Static task
static1
Behavioral task
behavioral1
Sample
1712476341.exe
Resource
win7v20201028
General
-
Target
1712476341.exe
-
Size
256KB
-
MD5
0230b090e69b97194d25a53f2d5514eb
-
SHA1
ac76b29802d240f721fb09adff57950f32989fb7
-
SHA256
1b51a62c1d975227247671411dfa82b3521e82eeaa665e420e81e1f8bf0616f7
-
SHA512
4f907e2624cf9c87c8d5aae709329f20cd59077ba370ba7b581100aa980cb9a92186b4f8436568bb0b8d1ef3551b514c967febdf2f717f3be718a8bc39035907
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/968-15-0x0000000000400000-0x0000000000426000-memory.dmp family_redline behavioral1/memory/968-16-0x000000000041E192-mapping.dmp family_redline behavioral1/memory/968-20-0x0000000000400000-0x0000000000426000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
1712476341.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\1712476341.exe = "0" 1712476341.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions\Paths 1712476341.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows Defender\Exclusions 1712476341.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
1712476341.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 1712476341.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
1712476341.exepid process 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe 1108 1712476341.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1712476341.exedescription pid process target process PID 1108 set thread context of 968 1108 1712476341.exe 1712476341.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1476 1108 WerFault.exe 1712476341.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 816 timeout.exe -
Processes:
1712476341.exedescription ioc process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 04000000010000001000000087ce0b7b2a0e4900e158719b37a893720f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d43190000000100000010000000749966cecc95c1874194ca7203f9b6202000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 0f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa6090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030814000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f0b00000001000000120000004400690067006900430065007200740000001d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d432000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\0563B8630D62D75ABBC8AB1E4BDFB5A899B24D43\Blob = 190000000100000010000000749966cecc95c1874194ca7203f9b6200300000001000000140000000563b8630d62d75abbc8ab1e4bdfb5a899b24d431d00000001000000100000004f5f106930398d09107b40c3c7ca8f1c0b000000010000001200000044006900670069004300650072007400000014000000010000001400000045eba2aff492cb82312d518ba7a7219df36dc80f090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000006dca5bd00dcf1c0f327059d374b29ca6e3c50aa62000000001000000bb030000308203b73082029fa00302010202100ce7e0e517d846fe8fe560fc1bf03039300d06092a864886f70d01010505003065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a3065310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312430220603550403131b4469676943657274204173737572656420494420526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100ad0e15cee443805cb187f3b760f97112a5aedc269488aaf4cef520392858600cf880daa9159532613cb5b128848a8adc9f0a0c83177a8f90ac8ae779535c31842af60f98323676ccdedd3ca8a2ef6afb21f25261df9f20d71fe2b1d9fe1864d2125b5ff9581835bc47cda136f96b7fd4b0383ec11bc38c33d9d82f18fe280fb3a783d6c36e44c061359616fe599c8b766dd7f1a24b0d2bff0b72da9e60d08e9035c678558720a1cfe56d0ac8497c3198336c22e987d0325aa2ba138211ed39179d993a72a1e6faa4d9d5173175ae857d22ae3f014686f62879c8b1dae45717c47e1c0eb0b492a656b3bdb297edaaa7f0b7c5a83f9516d0ffa196eb085f18774f0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e0416041445eba2aff492cb82312d518ba7a7219df36dc80f301f0603551d2304183016801445eba2aff492cb82312d518ba7a7219df36dc80f300d06092a864886f70d01010505000382010100a20ebcdfe2edf0e372737a6494bff77266d832e4427562ae87ebf2d5d9de56b39fccce1428b90d97605c124c58e4d33d834945589735691aa847ea56c679ab12d8678184df7f093c94e6b8262c20bd3db32889f75fff22e297841fe965ef87e0dfc16749b35debb2092aeb26ed78be7d3f2bf3b726356d5f8901b6495b9f01059bab3d25c1ccb67fc2f16f86c6fa6468eb812d94eb42b7fa8c1edd62f1be5067b76cbdf3f11f6b0c3607167f377ca95b6d7af112466083d72704be4bce97bec3672a6811df80e70c3366bf130d146ef37f1f63101efa8d1b256d6c8fa5b76101b1d2a326a110719dade2c3f9c39951b72b0708ce2ee650b2a7fa0a452fa2f0f2 1712476341.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
powershell.exe1712476341.exeWerFault.exe1712476341.exepid process 620 powershell.exe 1108 1712476341.exe 620 powershell.exe 1108 1712476341.exe 1108 1712476341.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 1476 WerFault.exe 968 1712476341.exe 968 1712476341.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1712476341.exepowershell.exeWerFault.exe1712476341.exedescription pid process Token: SeDebugPrivilege 1108 1712476341.exe Token: SeDebugPrivilege 620 powershell.exe Token: SeDebugPrivilege 1476 WerFault.exe Token: SeDebugPrivilege 968 1712476341.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
1712476341.execmd.exedescription pid process target process PID 1108 wrote to memory of 620 1108 1712476341.exe powershell.exe PID 1108 wrote to memory of 620 1108 1712476341.exe powershell.exe PID 1108 wrote to memory of 620 1108 1712476341.exe powershell.exe PID 1108 wrote to memory of 620 1108 1712476341.exe powershell.exe PID 1108 wrote to memory of 756 1108 1712476341.exe cmd.exe PID 1108 wrote to memory of 756 1108 1712476341.exe cmd.exe PID 1108 wrote to memory of 756 1108 1712476341.exe cmd.exe PID 1108 wrote to memory of 756 1108 1712476341.exe cmd.exe PID 756 wrote to memory of 816 756 cmd.exe timeout.exe PID 756 wrote to memory of 816 756 cmd.exe timeout.exe PID 756 wrote to memory of 816 756 cmd.exe timeout.exe PID 756 wrote to memory of 816 756 cmd.exe timeout.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 968 1108 1712476341.exe 1712476341.exe PID 1108 wrote to memory of 1476 1108 1712476341.exe WerFault.exe PID 1108 wrote to memory of 1476 1108 1712476341.exe WerFault.exe PID 1108 wrote to memory of 1476 1108 1712476341.exe WerFault.exe PID 1108 wrote to memory of 1476 1108 1712476341.exe WerFault.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
1712476341.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 1712476341.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\1712476341.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 12⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 13⤵
- Delays execution with timeout.exe
-
C:\Users\Admin\AppData\Local\Temp\1712476341.exe"C:\Users\Admin\AppData\Local\Temp\1712476341.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1108 -s 18082⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/620-11-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/620-57-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/620-12-0x00000000009D0000-0x00000000009D1000-memory.dmpFilesize
4KB
-
memory/620-13-0x00000000048B0000-0x00000000048B1000-memory.dmpFilesize
4KB
-
memory/620-7-0x0000000000000000-mapping.dmp
-
memory/620-8-0x00000000760D1000-0x00000000760D3000-memory.dmpFilesize
8KB
-
memory/620-22-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/620-42-0x0000000005610000-0x0000000005611000-memory.dmpFilesize
4KB
-
memory/620-28-0x0000000006020000-0x0000000006021000-memory.dmpFilesize
4KB
-
memory/620-58-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/620-46-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/620-14-0x0000000002410000-0x0000000002411000-memory.dmpFilesize
4KB
-
memory/620-41-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/620-17-0x0000000004870000-0x0000000004871000-memory.dmpFilesize
4KB
-
memory/620-18-0x0000000004872000-0x0000000004873000-memory.dmpFilesize
4KB
-
memory/620-34-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/620-33-0x0000000006080000-0x0000000006081000-memory.dmpFilesize
4KB
-
memory/756-9-0x0000000000000000-mapping.dmp
-
memory/816-10-0x0000000000000000-mapping.dmp
-
memory/968-20-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/968-19-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/968-16-0x000000000041E192-mapping.dmp
-
memory/968-15-0x0000000000400000-0x0000000000426000-memory.dmpFilesize
152KB
-
memory/968-59-0x0000000004650000-0x0000000004651000-memory.dmpFilesize
4KB
-
memory/1108-2-0x0000000073E00000-0x00000000744EE000-memory.dmpFilesize
6.9MB
-
memory/1108-6-0x0000000000B90000-0x0000000000C26000-memory.dmpFilesize
600KB
-
memory/1108-5-0x0000000004430000-0x0000000004431000-memory.dmpFilesize
4KB
-
memory/1108-3-0x0000000000D90000-0x0000000000D91000-memory.dmpFilesize
4KB
-
memory/1476-23-0x0000000000000000-mapping.dmp
-
memory/1476-24-0x0000000001F70000-0x0000000001F81000-memory.dmpFilesize
68KB
-
memory/1476-25-0x0000000000420000-0x0000000000421000-memory.dmpFilesize
4KB