Analysis

  • max time kernel
    144s
  • max time network
    133s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-05-2021 15:52

General

  • Target

    a110ce3f_by_Libranalysis.exe

  • Size

    5.6MB

  • MD5

    a110ce3f7366c6bb12553ea17a793110

  • SHA1

    8e10076496347d6324382f20968f3b7c8516eedf

  • SHA256

    0e63f296fdc309cb1e487cd1a549d029d2a9144b8a050db274901030dc6ec0f3

  • SHA512

    dc9103da71a1143365f3c7f39c4a316a9b9cc6e337b601a95d13d68bba777d2145d79a9d44ac96edce71775819e4d4bb2bb0cf7e49627163237ec3580b25c3cf

Malware Config

Extracted

Family

redline

Botnet

ServLyla2

C2

87.251.71.4:80

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Executes dropped EXE 6 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 16 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 57 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Themes
    1⤵
      PID:1240
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Browser
      1⤵
        PID:2760
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s WpnService
        1⤵
          PID:2688
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
          1⤵
          • Modifies registry class
          PID:2672
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
          1⤵
            PID:2408
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2400
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
              1⤵
                PID:1944
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s SENS
                1⤵
                  PID:1412
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                  1⤵
                    PID:1332
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1108
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:412
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:68
                        • C:\Users\Admin\AppData\Local\Temp\a110ce3f_by_Libranalysis.exe
                          "C:\Users\Admin\AppData\Local\Temp\a110ce3f_by_Libranalysis.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:3876
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2156
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                              3⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:192
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3028
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              3⤵
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1580
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            PID:1288
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:1168
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              PID:804
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3024
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3656
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:4036

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/68-139-0x000001B8B20A0000-0x000001B8B20EB000-memory.dmp

                          Filesize

                          300KB

                        • memory/68-141-0x000001B8B2440000-0x000001B8B24B0000-memory.dmp

                          Filesize

                          448KB

                        • memory/68-241-0x000001B8B2A10000-0x000001B8B2A80000-memory.dmp

                          Filesize

                          448KB

                        • memory/192-145-0x0000000000C90000-0x0000000000CEC000-memory.dmp

                          Filesize

                          368KB

                        • memory/192-134-0x0000000000B13000-0x0000000000C14000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/412-185-0x0000023E837D0000-0x0000023E83840000-memory.dmp

                          Filesize

                          448KB

                        • memory/412-249-0x0000023E83E40000-0x0000023E83EB0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1108-159-0x000001C3CD930000-0x000001C3CD9A0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1108-247-0x000001C3CDE40000-0x000001C3CDEB0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1240-255-0x00000216E85B0000-0x00000216E8620000-memory.dmp

                          Filesize

                          448KB

                        • memory/1240-195-0x00000216E8060000-0x00000216E80D0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1288-203-0x0000000003760000-0x0000000003770000-memory.dmp

                          Filesize

                          64KB

                        • memory/1288-189-0x0000000000400000-0x00000000005DB000-memory.dmp

                          Filesize

                          1.9MB

                        • memory/1288-209-0x0000000003900000-0x0000000003910000-memory.dmp

                          Filesize

                          64KB

                        • memory/1332-197-0x000002186E600000-0x000002186E670000-memory.dmp

                          Filesize

                          448KB

                        • memory/1332-257-0x000002186E9B0000-0x000002186EA20000-memory.dmp

                          Filesize

                          448KB

                        • memory/1412-251-0x0000026D4DE40000-0x0000026D4DEB0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1412-188-0x0000026D4D870000-0x0000026D4D8E0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1580-176-0x0000000000400000-0x000000000041C000-memory.dmp

                          Filesize

                          112KB

                        • memory/1580-193-0x0000000005330000-0x0000000005936000-memory.dmp

                          Filesize

                          6.0MB

                        • memory/1580-184-0x00000000053E0000-0x00000000053E1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1580-180-0x0000000005940000-0x0000000005941000-memory.dmp

                          Filesize

                          4KB

                        • memory/1580-202-0x00000000056F0000-0x00000000056F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/1580-186-0x0000000005440000-0x0000000005441000-memory.dmp

                          Filesize

                          4KB

                        • memory/1580-194-0x0000000005480000-0x0000000005481000-memory.dmp

                          Filesize

                          4KB

                        • memory/1944-191-0x000002222E140000-0x000002222E1B0000-memory.dmp

                          Filesize

                          448KB

                        • memory/1944-167-0x000002222DCD0000-0x000002222DCD2000-memory.dmp

                          Filesize

                          8KB

                        • memory/1944-253-0x000002222E640000-0x000002222E6B0000-memory.dmp

                          Filesize

                          448KB

                        • memory/2400-146-0x00000292008D0000-0x0000029200940000-memory.dmp

                          Filesize

                          448KB

                        • memory/2400-243-0x00000292009A0000-0x0000029200A10000-memory.dmp

                          Filesize

                          448KB

                        • memory/2408-152-0x0000014B19780000-0x0000014B197F0000-memory.dmp

                          Filesize

                          448KB

                        • memory/2408-245-0x0000014B19CB0000-0x0000014B19D20000-memory.dmp

                          Filesize

                          448KB

                        • memory/2672-259-0x000001A620340000-0x000001A6203B0000-memory.dmp

                          Filesize

                          448KB

                        • memory/2672-199-0x000001A61FAD0000-0x000001A61FB40000-memory.dmp

                          Filesize

                          448KB

                        • memory/2688-201-0x000001BF493D0000-0x000001BF49440000-memory.dmp

                          Filesize

                          448KB

                        • memory/2688-261-0x000001BF49440000-0x000001BF494B0000-memory.dmp

                          Filesize

                          448KB

                        • memory/2760-136-0x0000024F94360000-0x0000024F943D0000-memory.dmp

                          Filesize

                          448KB

                        • memory/2760-239-0x0000024F94460000-0x0000024F944D0000-memory.dmp

                          Filesize

                          448KB

                        • memory/3028-127-0x00000000003F0000-0x00000000003F1000-memory.dmp

                          Filesize

                          4KB

                        • memory/3028-137-0x0000000002670000-0x0000000002679000-memory.dmp

                          Filesize

                          36KB

                        • memory/3028-156-0x0000000004D30000-0x0000000004D31000-memory.dmp

                          Filesize

                          4KB

                        • memory/3656-151-0x0000025257050000-0x00000252570C0000-memory.dmp

                          Filesize

                          448KB

                        • memory/4036-233-0x000001970E810000-0x000001970E82B000-memory.dmp

                          Filesize

                          108KB

                        • memory/4036-232-0x000001970F590000-0x000001970F696000-memory.dmp

                          Filesize

                          1.0MB

                        • memory/4036-163-0x000001970D000000-0x000001970D070000-memory.dmp

                          Filesize

                          448KB