Analysis
-
max time kernel
61s -
max time network
121s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-03-2021 16:55
Static task
static1
Behavioral task
behavioral1
Sample
29d0bf8a76f51a9ec7d39f90cd7a5f57.exe
Resource
win7v20201028
General
-
Target
29d0bf8a76f51a9ec7d39f90cd7a5f57.exe
-
Size
5.1MB
-
MD5
29d0bf8a76f51a9ec7d39f90cd7a5f57
-
SHA1
d954337798846a9b8fb2609f94f287dbe63a03f8
-
SHA256
7fb4f8f5f89b3fb2a4e9a6605763436ebb679198ee5ebbcde8972bb1e20a8da5
-
SHA512
7020b1b21b27674d7a6d1b4b9708161818eecca8f743a37bcb80371e12d7452d522a65672529e41d392007e94427726ac60a6e6f87cf9f8c5cc1f09bf1a675ea
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1908-7-0x0000000005740000-0x0000000005769000-memory.dmp family_redline behavioral2/memory/1908-9-0x0000000005CB0000-0x0000000005CD8000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
29d0bf8a76f51a9ec7d39f90cd7a5f57.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 29d0bf8a76f51a9ec7d39f90cd7a5f57.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 29d0bf8a76f51a9ec7d39f90cd7a5f57.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral2/memory/1908-2-0x0000000000400000-0x0000000000F1E000-memory.dmp themida -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
29d0bf8a76f51a9ec7d39f90cd7a5f57.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 29d0bf8a76f51a9ec7d39f90cd7a5f57.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
29d0bf8a76f51a9ec7d39f90cd7a5f57.exepid process 1908 29d0bf8a76f51a9ec7d39f90cd7a5f57.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
29d0bf8a76f51a9ec7d39f90cd7a5f57.exepid process 1908 29d0bf8a76f51a9ec7d39f90cd7a5f57.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
29d0bf8a76f51a9ec7d39f90cd7a5f57.exedescription pid process Token: SeDebugPrivilege 1908 29d0bf8a76f51a9ec7d39f90cd7a5f57.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29d0bf8a76f51a9ec7d39f90cd7a5f57.exe"C:\Users\Admin\AppData\Local\Temp\29d0bf8a76f51a9ec7d39f90cd7a5f57.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1908-2-0x0000000000400000-0x0000000000F1E000-memory.dmpFilesize
11.1MB
-
memory/1908-3-0x0000000000401000-0x000000000041B000-memory.dmpFilesize
104KB
-
memory/1908-4-0x0000000003410000-0x0000000003411000-memory.dmpFilesize
4KB
-
memory/1908-6-0x0000000077754000-0x0000000077755000-memory.dmpFilesize
4KB
-
memory/1908-5-0x00000000738B0000-0x0000000073F9E000-memory.dmpFilesize
6.9MB
-
memory/1908-7-0x0000000005740000-0x0000000005769000-memory.dmpFilesize
164KB
-
memory/1908-8-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/1908-9-0x0000000005CB0000-0x0000000005CD8000-memory.dmpFilesize
160KB
-
memory/1908-11-0x00000000012B2000-0x00000000012B3000-memory.dmpFilesize
4KB
-
memory/1908-12-0x00000000012B3000-0x00000000012B4000-memory.dmpFilesize
4KB
-
memory/1908-10-0x00000000012B0000-0x00000000012B1000-memory.dmpFilesize
4KB
-
memory/1908-13-0x0000000005CE0000-0x0000000005CE1000-memory.dmpFilesize
4KB
-
memory/1908-14-0x0000000005DA0000-0x0000000005DA1000-memory.dmpFilesize
4KB
-
memory/1908-15-0x0000000005E20000-0x0000000005E21000-memory.dmpFilesize
4KB
-
memory/1908-16-0x00000000064C0000-0x00000000064C1000-memory.dmpFilesize
4KB
-
memory/1908-17-0x00000000064E0000-0x00000000064E1000-memory.dmpFilesize
4KB
-
memory/1908-18-0x0000000006650000-0x0000000006651000-memory.dmpFilesize
4KB
-
memory/1908-19-0x00000000012B4000-0x00000000012B6000-memory.dmpFilesize
8KB
-
memory/1908-20-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/1908-21-0x00000000073A0000-0x00000000073A1000-memory.dmpFilesize
4KB
-
memory/1908-22-0x0000000007580000-0x0000000007581000-memory.dmpFilesize
4KB
-
memory/1908-23-0x0000000007BC0000-0x0000000007BC1000-memory.dmpFilesize
4KB
-
memory/1908-24-0x0000000007C70000-0x0000000007C71000-memory.dmpFilesize
4KB
-
memory/1908-25-0x00000000083A0000-0x00000000083A1000-memory.dmpFilesize
4KB