Analysis
-
max time kernel
70s -
max time network
127s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
28-04-2021 04:37
Static task
static1
Behavioral task
behavioral1
Sample
skipper.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
skipper.exe
Resource
win10v20210410
General
-
Target
skipper.exe
-
Size
1.1MB
-
MD5
dba8101da0c11a3026fbd7278f28f977
-
SHA1
0f17ce1e24adfe2386e6e25c68100749e5d79dbb
-
SHA256
83b897270a955267f21de7462bdbe05910e48825ef79cc8ae142713f925fb802
-
SHA512
f912e8a79c3a0275b57fd2b652fc92ccd5c7595ef329331f14a0529c109d7e72482ef98929a539b89516a972b8b455484a56d1ca20c5ba5dcea3b49c699b3a21
Malware Config
Extracted
redline
EUU
download3.info:80
Extracted
redline
1414
188.119.112.16:46409
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral2/memory/2120-120-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/2120-121-0x00000000004171EE-mapping.dmp family_redline behavioral2/memory/200-142-0x0000000000400000-0x0000000000430000-memory.dmp family_redline behavioral2/memory/200-143-0x000000000042977E-mapping.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
761647212.exe381717225.exepid process 744 761647212.exe 1760 381717225.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
761647212.exe381717225.exedescription pid process target process PID 744 set thread context of 2120 744 761647212.exe AddInProcess32.exe PID 1760 set thread context of 200 1760 381717225.exe AddInProcess32.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
AddInProcess32.exeAddInProcess32.exepid process 2120 AddInProcess32.exe 2120 AddInProcess32.exe 200 AddInProcess32.exe 200 AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
761647212.exeAddInProcess32.exe381717225.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 744 761647212.exe Token: SeDebugPrivilege 2120 AddInProcess32.exe Token: SeDebugPrivilege 1760 381717225.exe Token: SeDebugPrivilege 200 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
skipper.exe761647212.exe381717225.execmd.exedescription pid process target process PID 2232 wrote to memory of 744 2232 skipper.exe 761647212.exe PID 2232 wrote to memory of 744 2232 skipper.exe 761647212.exe PID 2232 wrote to memory of 744 2232 skipper.exe 761647212.exe PID 744 wrote to memory of 4052 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 4052 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 4052 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 4052 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 744 wrote to memory of 2120 744 761647212.exe AddInProcess32.exe PID 2232 wrote to memory of 1760 2232 skipper.exe 381717225.exe PID 2232 wrote to memory of 1760 2232 skipper.exe 381717225.exe PID 2232 wrote to memory of 1760 2232 skipper.exe 381717225.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 1760 wrote to memory of 200 1760 381717225.exe AddInProcess32.exe PID 2232 wrote to memory of 3116 2232 skipper.exe cmd.exe PID 2232 wrote to memory of 3116 2232 skipper.exe cmd.exe PID 2232 wrote to memory of 3116 2232 skipper.exe cmd.exe PID 3116 wrote to memory of 908 3116 cmd.exe PING.EXE PID 3116 wrote to memory of 908 3116 cmd.exe PING.EXE PID 3116 wrote to memory of 908 3116 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\skipper.exe"C:\Users\Admin\AppData\Local\Temp\skipper.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\761647212.exeC:\Users\Admin\AppData\Local\Temp\761647212.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\381717225.exeC:\Users\Admin\AppData\Local\Temp\381717225.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\skipper.exe & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 03⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\AddInProcess32.exe.logMD5
6fc881dd3bb50496248d57709eb4ef65
SHA1867fd7a0f033c421b5a49b153bbb7f0a2a9f35ad
SHA2566ba63ec508ff5bafd8cbfdf69dae25950fca0cb1294849f416fdfa6760e1bc60
SHA51269f67beb6094ce4c9bf8b9549992c423e0194ac80c8e1742dc57be26e4a885af6cfd7d1d37dd326266918fa71e41ca566e9a6a9c230b4571e17e0d9c7b553d5d
-
C:\Users\Admin\AppData\Local\Temp\381717225.exeMD5
cca6e302974f8ad2cf237cbb402f7db8
SHA182483651f9c152a2ccf0a7f6a348c14daf73ccfc
SHA25612da3023f88f28c58bfa10a19cf70481e263bed0ae9bd393369e6ed9b7971827
SHA512cad0b4afd348085070f4a786bdcd62a5d01ca3413f07315956c09489b3ca92e09a893bc1960d25c9a650eeb3d0c4395a1b47d0562b359285794d9e4c0929ae87
-
C:\Users\Admin\AppData\Local\Temp\381717225.exeMD5
cca6e302974f8ad2cf237cbb402f7db8
SHA182483651f9c152a2ccf0a7f6a348c14daf73ccfc
SHA25612da3023f88f28c58bfa10a19cf70481e263bed0ae9bd393369e6ed9b7971827
SHA512cad0b4afd348085070f4a786bdcd62a5d01ca3413f07315956c09489b3ca92e09a893bc1960d25c9a650eeb3d0c4395a1b47d0562b359285794d9e4c0929ae87
-
C:\Users\Admin\AppData\Local\Temp\761647212.exeMD5
d51901e3386120269c6b08fcaa3816e7
SHA16b0a36ce8cb5390d4d53800e4bf5281fb0eb5d7e
SHA256afd25aff257a6b31a2377b9633a0f4227da3112976c749c34858d85436d0af5a
SHA5125639773bca6fdeefe91ca58776758c1abd2a8a67824365dd0140800ddaa3935dcd4568eeebe8163f564e8d3754bce65b339163a230bd7d17b5c6e16eb5c345f5
-
C:\Users\Admin\AppData\Local\Temp\761647212.exeMD5
d51901e3386120269c6b08fcaa3816e7
SHA16b0a36ce8cb5390d4d53800e4bf5281fb0eb5d7e
SHA256afd25aff257a6b31a2377b9633a0f4227da3112976c749c34858d85436d0af5a
SHA5125639773bca6fdeefe91ca58776758c1abd2a8a67824365dd0140800ddaa3935dcd4568eeebe8163f564e8d3754bce65b339163a230bd7d17b5c6e16eb5c345f5
-
memory/200-142-0x0000000000400000-0x0000000000430000-memory.dmpFilesize
192KB
-
memory/200-143-0x000000000042977E-mapping.dmp
-
memory/200-163-0x0000000008C00000-0x0000000008C01000-memory.dmpFilesize
4KB
-
memory/200-155-0x0000000005E10000-0x0000000005E11000-memory.dmpFilesize
4KB
-
memory/200-151-0x0000000005B10000-0x0000000005B11000-memory.dmpFilesize
4KB
-
memory/200-148-0x0000000003060000-0x0000000003061000-memory.dmpFilesize
4KB
-
memory/200-147-0x00000000055E0000-0x00000000055E1000-memory.dmpFilesize
4KB
-
memory/744-119-0x0000000005590000-0x0000000005591000-memory.dmpFilesize
4KB
-
memory/744-114-0x0000000000000000-mapping.dmp
-
memory/744-117-0x0000000000BD0000-0x0000000000BD1000-memory.dmpFilesize
4KB
-
memory/908-150-0x0000000000000000-mapping.dmp
-
memory/1760-134-0x0000000005830000-0x0000000005831000-memory.dmpFilesize
4KB
-
memory/1760-130-0x0000000000FD0000-0x0000000000FD1000-memory.dmpFilesize
4KB
-
memory/1760-127-0x0000000000000000-mapping.dmp
-
memory/2120-132-0x00000000057A0000-0x00000000057A1000-memory.dmpFilesize
4KB
-
memory/2120-137-0x0000000006C70000-0x0000000006C71000-memory.dmpFilesize
4KB
-
memory/2120-139-0x0000000007870000-0x0000000007871000-memory.dmpFilesize
4KB
-
memory/2120-140-0x0000000006AD0000-0x0000000006AD1000-memory.dmpFilesize
4KB
-
memory/2120-141-0x00000000088A0000-0x00000000088A1000-memory.dmpFilesize
4KB
-
memory/2120-133-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/2120-135-0x0000000005690000-0x0000000005C96000-memory.dmpFilesize
6.0MB
-
memory/2120-138-0x0000000007170000-0x0000000007171000-memory.dmpFilesize
4KB
-
memory/2120-136-0x00000000066D0000-0x00000000066D1000-memory.dmpFilesize
4KB
-
memory/2120-126-0x0000000005760000-0x0000000005761000-memory.dmpFilesize
4KB
-
memory/2120-120-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2120-125-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/2120-124-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/2120-121-0x00000000004171EE-mapping.dmp
-
memory/3116-149-0x0000000000000000-mapping.dmp