Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

win102

windows10_x64

10

win104

windows10_x64

10

win105

windows10_x64

8

win106

windows10_x64

10

win101

windows10_x64

8

win100

windows10_x64

10

Resubmissions

24-05-2021 05:31

210524-b4dx7j71fj 10

21-05-2021 13:30

210521-r42mg8cghe 10

Analysis

  • max time kernel
    1799s
  • max time network
    1760s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-05-2021 05:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    keygen-step-4.exe

  • Size

    5.6MB

  • MD5

    a110ce3f7366c6bb12553ea17a793110

  • SHA1

    8e10076496347d6324382f20968f3b7c8516eedf

  • SHA256

    0e63f296fdc309cb1e487cd1a549d029d2a9144b8a050db274901030dc6ec0f3

  • SHA512

    dc9103da71a1143365f3c7f39c4a316a9b9cc6e337b601a95d13d68bba777d2145d79a9d44ac96edce71775819e4d4bb2bb0cf7e49627163237ec3580b25c3cf

Score
10/10
plugxredlineservlyla2evasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

redline

Botnet

ServLyla2

C2

87.251.71.4:80

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 13 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s Browser
    1⤵
      PID:2760
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s WpnService
      1⤵
        PID:2688
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
        1⤵
        • Modifies registry class
        • Suspicious use of AdjustPrivilegeToken
        PID:2672
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
        1⤵
          PID:2408
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
          1⤵
            PID:2400
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
            1⤵
              PID:1944
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s SENS
              1⤵
                PID:1412
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                1⤵
                  PID:1332
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s Themes
                  1⤵
                    PID:1240
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                    1⤵
                      PID:1108
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                      1⤵
                        PID:412
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
                        1⤵
                          PID:68
                        • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
                          "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:500
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2720
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                              3⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:3288
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:2712
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:2680
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3860
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:1704
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              PID:4056
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:748
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:1776
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:972
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:3200
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:3772

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/68-164-0x000001B8B2440000-0x000001B8B24B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/68-241-0x000001B8B2A10000-0x000001B8B2A80000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/412-151-0x0000023E837D0000-0x0000023E83840000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/412-249-0x0000023E83E40000-0x0000023E83EB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1108-182-0x000001C3CD930000-0x000001C3CD9A0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1108-247-0x000001C3CDE40000-0x000001C3CDEB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1240-255-0x00000216E85B0000-0x00000216E8620000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1240-169-0x00000216E8060000-0x00000216E80D0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1332-176-0x000002186E600000-0x000002186E670000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1332-257-0x000002186E9B0000-0x000002186EA20000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1412-158-0x0000026D4D870000-0x0000026D4D8E0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1412-251-0x0000026D4DE40000-0x0000026D4DEB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1944-165-0x000002222E140000-0x000002222E1B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1944-253-0x000002222E640000-0x000002222E6B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2400-243-0x00000292009A0000-0x0000029200A10000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2400-171-0x00000292008D0000-0x0000029200940000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2408-177-0x0000014B19780000-0x0000014B197F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2408-245-0x0000014B19CB0000-0x0000014B19D20000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2672-184-0x000001A61FAD0000-0x000001A61FB40000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2672-259-0x000001A620340000-0x000001A6203B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2680-199-0x0000000004D10000-0x0000000004D11000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2680-201-0x0000000004D50000-0x0000000004D51000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2680-187-0x0000000000400000-0x000000000041C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/2680-214-0x0000000004FC0000-0x0000000004FC1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2680-193-0x00000000052E0000-0x00000000052E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2680-197-0x0000000002860000-0x0000000002861000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2680-200-0x0000000004CD0000-0x00000000052D6000-memory.dmp

                          Filesize

                          6.0MB

                          Download

                        • memory/2688-192-0x000001BF493D0000-0x000001BF49440000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2688-261-0x000001BF49440000-0x000001BF494B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2712-140-0x00000000016B0000-0x00000000016B9000-memory.dmp

                          Filesize

                          36KB

                          Download

                        • memory/2712-130-0x0000000000D60000-0x0000000000D61000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2712-152-0x0000000005610000-0x0000000005611000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/2760-239-0x0000024F94460000-0x0000024F944D0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2760-157-0x0000024F94360000-0x0000024F943D0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3200-128-0x000002923B5C0000-0x000002923B60B000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/3200-147-0x000002923B680000-0x000002923B6F0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3288-126-0x0000000000C25000-0x0000000000D26000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/3288-127-0x0000000000BA0000-0x0000000000BFC000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/3772-159-0x00000160433D0000-0x0000016043440000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3772-225-0x0000016045A00000-0x0000016045B06000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/3772-226-0x0000016044C00000-0x0000016044C1B000-memory.dmp

                          Filesize

                          108KB

                          Download

                        • memory/3860-208-0x0000000003920000-0x0000000003930000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3860-202-0x0000000003780000-0x0000000003790000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3860-198-0x0000000000400000-0x00000000005DB000-memory.dmp

                          Filesize

                          1.9MB

                          Download