Overview

overview

10

Static

static

22F9967C01...F5.exe

windows7_x64

10

22F9967C01...F5.exe

windows10_x64

10

Resubmissions

10-05-2021 10:26

210510-51q2zwvjce 10

Analysis

  • max time kernel
    149s
  • max time network
    144s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    10-05-2021 10:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    22F9967C010BF3B752D56BCDEE846BF5.exe

  • Size

    612KB

  • MD5

    22f9967c010bf3b752d56bcdee846bf5

  • SHA1

    688b82c1eb648ee5eea04042da253d77c706f945

  • SHA256

    d8a12da66c3b95e1f2dc9c7e5667a5baf7dbdbbaff01f342222dc696c07455fa

  • SHA512

    b4dfd895af0f98de30d6446e847e3451c8d8fa7a6571aaac7db3c0fd40febc982e52035af709db3bba68b0e19037ee71443863b25ed3d5dcc13bb0375d69c3c6

Score
10/10
redlinesource1infostealerspyware

Malware Config

Extracted

Family

redline

Botnet

source1

C2

199.195.251.96:43073

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Executes dropped EXE 1 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 12 IoCs
  • Suspicious use of SetWindowsHookEx 3 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\22F9967C010BF3B752D56BCDEE846BF5.exe
    "C:\Users\Admin\AppData\Local\Temp\22F9967C010BF3B752D56BCDEE846BF5.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of WriteProcessMemory
    PID:1808
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
      "C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:640
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        3⤵
          PID:2764
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2784
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:3852
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:3480
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4148
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4220
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4688
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4848
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      PID:4936

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    2
    T1082

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Web Service

    1
    T1102

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
      MD5

      b13e035f8c5c8c30c40033165017508e

      SHA1

      075cc57e58640fdde4cb8ac199d3b5978129ac14

      SHA256

      2a48eaec94fd1d0b2ae2b0d420d2ae8810d5ddd2b43018745725a2fa2c4d5e7b

      SHA512

      4bb837346d85ef16d442b89a77404c22c6654904fb0c839abb8477c99cc628b8bc17d7fa01271b05a53c3407fd596b764f50561543b3ef6bfc0e941488624d85

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\RarSFX0\File.exe
      MD5

      b13e035f8c5c8c30c40033165017508e

      SHA1

      075cc57e58640fdde4cb8ac199d3b5978129ac14

      SHA256

      2a48eaec94fd1d0b2ae2b0d420d2ae8810d5ddd2b43018745725a2fa2c4d5e7b

      SHA512

      4bb837346d85ef16d442b89a77404c22c6654904fb0c839abb8477c99cc628b8bc17d7fa01271b05a53c3407fd596b764f50561543b3ef6bfc0e941488624d85

      Download Submit
    • memory/640-127-0x0000000005FD0000-0x0000000005FD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/640-119-0x0000000000730000-0x0000000000731000-memory.dmp
      Filesize

      4KB

      Download
    • memory/640-121-0x00000000055A0000-0x00000000055A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/640-122-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/640-123-0x00000000050A0000-0x00000000050A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/640-124-0x0000000005210000-0x000000000524B000-memory.dmp
      Filesize

      236KB

      Download
    • memory/640-125-0x0000000005490000-0x00000000054A6000-memory.dmp
      Filesize

      88KB

      Download
    • memory/640-126-0x00000000050A0000-0x000000000559E000-memory.dmp
      Filesize

      5.0MB

      Download
    • memory/640-116-0x0000000000000000-mapping.dmp
      Download
    • memory/2784-128-0x0000000000400000-0x000000000041C000-memory.dmp
      Filesize

      112KB

      Download
    • memory/2784-129-0x00000000004163CE-mapping.dmp
      Download
    • memory/2784-132-0x00000000051D0000-0x00000000051D1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2784-133-0x0000000004C70000-0x0000000004C71000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2784-134-0x0000000004CD0000-0x0000000004CD1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2784-135-0x0000000004D10000-0x0000000004D11000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2784-136-0x0000000004BC0000-0x00000000051C6000-memory.dmp
      Filesize

      6.0MB

      Download
    • memory/2784-137-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2784-141-0x00000000065A0000-0x00000000065A1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/2784-143-0x0000000006770000-0x0000000006771000-memory.dmp
      Filesize

      4KB

      Download