Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

win102

windows10_x64

10

win104

windows10_x64

10

win105

windows10_x64

8

win106

windows10_x64

10

win101

windows10_x64

8

win100

windows10_x64

10

Resubmissions

24-05-2021 05:31

210524-b4dx7j71fj 10

21-05-2021 13:30

210521-r42mg8cghe 10

Analysis

  • max time kernel
    1799s
  • max time network
    1759s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-05-2021 05:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    keygen-step-4.exe

  • Size

    5.6MB

  • MD5

    a110ce3f7366c6bb12553ea17a793110

  • SHA1

    8e10076496347d6324382f20968f3b7c8516eedf

  • SHA256

    0e63f296fdc309cb1e487cd1a549d029d2a9144b8a050db274901030dc6ec0f3

  • SHA512

    dc9103da71a1143365f3c7f39c4a316a9b9cc6e337b601a95d13d68bba777d2145d79a9d44ac96edce71775819e4d4bb2bb0cf7e49627163237ec3580b25c3cf

Score
10/10
plugxredlineservlyla2evasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

redline

Botnet

ServLyla2

C2

87.251.71.4:80

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
    1⤵
    • Modifies registry class
    PID:1376
  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
    1⤵
      PID:1964
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
      1⤵
        PID:2540
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2856
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2804
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Suspicious use of AdjustPrivilegeToken
            PID:2796
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2504
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1352
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s Themes
                1⤵
                  PID:1180
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                  1⤵
                    PID:1172
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                    1⤵
                      PID:344
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                      1⤵
                        PID:996
                      • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
                        "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3152
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks computer location settings
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:2076
                          • C:\Windows\SysWOW64\rUNdlL32.eXe
                            "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                            3⤵
                            • Loads dropped DLL
                            • Modifies registry class
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3720
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe"
                          2⤵
                          • Executes dropped EXE
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:1888
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                            C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                            3⤵
                            • Suspicious behavior: EnumeratesProcesses
                            • Suspicious use of AdjustPrivilegeToken
                            PID:4288
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
                          2⤵
                          • Executes dropped EXE
                          • Checks whether UAC is enabled
                          • Suspicious use of AdjustPrivilegeToken
                          PID:4356
                        • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
                          "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
                          2⤵
                          • Executes dropped EXE
                          • Adds Run key to start application
                          • Suspicious use of WriteProcessMemory
                          PID:2568
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            3⤵
                            • Executes dropped EXE
                            PID:5012
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4644
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:5056
                          • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                            C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                            3⤵
                            • Executes dropped EXE
                            • Suspicious behavior: EnumeratesProcesses
                            PID:4144
                      • \??\c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s BITS
                        1⤵
                        • Suspicious use of SetThreadContext
                        • Modifies data under HKEY_USERS
                        • Modifies registry class
                        • Suspicious behavior: EnumeratesProcesses
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious use of WriteProcessMemory
                        PID:3772
                        • C:\Windows\system32\svchost.exe
                          C:\Windows\system32\svchost.exe -k SystemNetworkService
                          2⤵
                          • Drops file in System32 directory
                          • Checks processor information in registry
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious use of WriteProcessMemory
                          PID:1448

                      Network

                      MITRE ATT&CK Enterprise v6

                      Replay Monitor

                      Loading Replay Monitor...

                      Downloads

                      • memory/344-249-0x0000022348170000-0x00000223481E0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/344-161-0x0000022347B50000-0x0000022347BC0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/996-156-0x0000028903C30000-0x0000028903CA0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/996-241-0x0000028903CA0000-0x0000028903D10000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1172-247-0x0000020298E70000-0x0000020298EE0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1172-155-0x0000020298280000-0x00000202982F0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1180-182-0x0000028C5D6B0000-0x0000028C5D720000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1180-255-0x0000028C5D720000-0x0000028C5D790000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1352-178-0x000001F2F2790000-0x000001F2F2800000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1352-251-0x000001F2F2DA0000-0x000001F2F2E10000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1376-186-0x00000186BEA00000-0x00000186BEA70000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1376-257-0x00000186BEDB0000-0x00000186BEE20000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1448-221-0x0000021519500000-0x0000021519606000-memory.dmp

                        Filesize

                        1.0MB

                        Download

                      • memory/1448-223-0x0000021516CE0000-0x0000021516CFB000-memory.dmp

                        Filesize

                        108KB

                        Download

                      • memory/1448-150-0x0000021516ED0000-0x0000021516F40000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1888-142-0x0000000000D60000-0x0000000000D69000-memory.dmp

                        Filesize

                        36KB

                        Download

                      • memory/1888-130-0x00000000004A0000-0x00000000004A1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1888-135-0x0000000004D10000-0x0000000004D11000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/1964-253-0x0000011193640000-0x00000111936B0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/1964-180-0x0000011193180000-0x00000111931F0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2504-243-0x000002978EB20000-0x000002978EB90000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2504-162-0x000002978EA40000-0x000002978EAB0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2540-167-0x0000019891D20000-0x0000019891D90000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2540-245-0x0000019892840000-0x00000198928B0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2796-189-0x000001FE32860000-0x000001FE328D0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2796-259-0x000001FE32C80000-0x000001FE32CF0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2804-193-0x000002603B7A0000-0x000002603B810000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2804-261-0x000002603B880000-0x000002603B8F0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2856-239-0x00000272AB740000-0x00000272AB7B0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/2856-149-0x00000272AB160000-0x00000272AB1D0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/3720-128-0x0000000004C80000-0x0000000004CDC000-memory.dmp

                        Filesize

                        368KB

                        Download

                      • memory/3720-126-0x0000000004CFD000-0x0000000004DFE000-memory.dmp

                        Filesize

                        1.0MB

                        Download

                      • memory/3772-131-0x0000028352AA0000-0x0000028352AEB000-memory.dmp

                        Filesize

                        300KB

                        Download

                      • memory/3772-133-0x0000028352E30000-0x0000028352EA0000-memory.dmp

                        Filesize

                        448KB

                        Download

                      • memory/4288-201-0x0000000004F00000-0x0000000005506000-memory.dmp

                        Filesize

                        6.0MB

                        Download

                      • memory/4288-197-0x0000000004F50000-0x0000000004F51000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-236-0x0000000006320000-0x0000000006321000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-235-0x0000000004E00000-0x0000000004E01000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-183-0x0000000000400000-0x000000000041C000-memory.dmp

                        Filesize

                        112KB

                        Download

                      • memory/4288-194-0x0000000005510000-0x0000000005511000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-214-0x0000000005260000-0x0000000005261000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-237-0x00000000069F0000-0x00000000069F1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-200-0x0000000004FF0000-0x0000000004FF1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4288-199-0x0000000004FB0000-0x0000000004FB1000-memory.dmp

                        Filesize

                        4KB

                        Download

                      • memory/4356-198-0x0000000000400000-0x00000000005DB000-memory.dmp

                        Filesize

                        1.9MB

                        Download

                      • memory/4356-202-0x0000000003780000-0x0000000003790000-memory.dmp

                        Filesize

                        64KB

                        Download

                      • memory/4356-208-0x0000000003920000-0x0000000003930000-memory.dmp

                        Filesize

                        64KB

                        Download