Overview

overview

10

Static

static

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ฺฺ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

8

ﱞﱞﱞ�...ﱞﱞ

windows10_x64

10

ﱞﱞﱞ�...ﱞﱞ

windows7_x64

10

win102

windows10_x64

10

win104

windows10_x64

10

win105

windows10_x64

8

win106

windows10_x64

10

win101

windows10_x64

8

win100

windows10_x64

10

Resubmissions

24-05-2021 05:31

210524-b4dx7j71fj 10

21-05-2021 13:30

210521-r42mg8cghe 10

Analysis

  • max time kernel
    1797s
  • max time network
    1294s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    24-05-2021 05:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    keygen-step-4.exe

  • Size

    5.6MB

  • MD5

    a110ce3f7366c6bb12553ea17a793110

  • SHA1

    8e10076496347d6324382f20968f3b7c8516eedf

  • SHA256

    0e63f296fdc309cb1e487cd1a549d029d2a9144b8a050db274901030dc6ec0f3

  • SHA512

    dc9103da71a1143365f3c7f39c4a316a9b9cc6e337b601a95d13d68bba777d2145d79a9d44ac96edce71775819e4d4bb2bb0cf7e49627163237ec3580b25c3cf

Score
10/10
plugxredlineservlyla2evasioninfostealerpersistencespywarestealertrojanupxvmprotect

Malware Config

Extracted

Family

redline

Botnet

ServLyla2

C2

87.251.71.4:80

Signatures

  • PlugX

    PlugX is a RAT (Remote Access Trojan) that has been around since 2008.

    trojanplugx
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Executes dropped EXE 8 IoCs
  • UPX packed file 8 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • VMProtect packed file 3 IoCs

    Detects executables packed with VMProtect commercial packer.

    vmprotect
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 15 IoCs
  • Modifies registry class 14 IoCs
  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 63 IoCs

Processes

  • c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k netsvcs -s gpsvc
    1⤵
      PID:1012
    • c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s Themes
      1⤵
        PID:1228
      • c:\windows\system32\svchost.exe
        c:\windows\system32\svchost.exe -k netsvcs -s Browser
        1⤵
          PID:2808
        • c:\windows\system32\svchost.exe
          c:\windows\system32\svchost.exe -k netsvcs -s WpnService
          1⤵
            PID:2688
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s Winmgmt
            1⤵
            • Modifies registry class
            • Suspicious use of AdjustPrivilegeToken
            PID:2676
          • c:\windows\system32\svchost.exe
            c:\windows\system32\svchost.exe -k netsvcs -s IKEEXT
            1⤵
              PID:2476
            • c:\windows\system32\svchost.exe
              c:\windows\system32\svchost.exe -k netsvcs -s LanmanServer
              1⤵
                PID:2448
              • c:\windows\system32\svchost.exe
                c:\windows\system32\svchost.exe -k netsvcs -s ShellHWDetection
                1⤵
                  PID:1880
                • c:\windows\system32\svchost.exe
                  c:\windows\system32\svchost.exe -k netsvcs -s SENS
                  1⤵
                    PID:1424
                  • c:\windows\system32\svchost.exe
                    c:\windows\system32\svchost.exe -k netsvcs -s UserManager
                    1⤵
                      PID:1292
                    • c:\windows\system32\svchost.exe
                      c:\windows\system32\svchost.exe -k netsvcs -s ProfSvc
                      1⤵
                        PID:1108
                      • c:\windows\system32\svchost.exe
                        c:\windows\system32\svchost.exe -k netsvcs -s Schedule
                        1⤵
                          PID:1068
                        • C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe
                          "C:\Users\Admin\AppData\Local\Temp\keygen-step-4.exe"
                          1⤵
                          • Suspicious use of WriteProcessMemory
                          PID:780
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\Crack.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks computer location settings
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:2376
                            • C:\Windows\SysWOW64\rUNdlL32.eXe
                              "C:\Windows\system32\rUNdlL32.eXe" "C:\Users\Admin\AppData\Local\Temp\install.dll",setuser
                              3⤵
                              • Loads dropped DLL
                              • Modifies registry class
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious use of WriteProcessMemory
                              PID:208
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\ABCbrow.exe"
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            • Suspicious use of WriteProcessMemory
                            PID:3196
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
                              3⤵
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3648
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\jg6_6asg.exe"
                            2⤵
                            • Executes dropped EXE
                            • Checks whether UAC is enabled
                            • Suspicious use of AdjustPrivilegeToken
                            PID:3540
                          • C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe
                            "C:\Users\Admin\AppData\Local\Temp\RarSFX0\gaoou.exe"
                            2⤵
                            • Executes dropped EXE
                            • Adds Run key to start application
                            • Suspicious use of WriteProcessMemory
                            PID:1200
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              PID:1916
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3200
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:316
                            • C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe
                              C:\Users\Admin\AppData\Local\Temp\jfiag3g_gg.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
                              3⤵
                              • Executes dropped EXE
                              • Suspicious behavior: EnumeratesProcesses
                              PID:3440
                        • \??\c:\windows\system32\svchost.exe
                          c:\windows\system32\svchost.exe -k netsvcs -s BITS
                          1⤵
                          • Suspicious use of SetThreadContext
                          • Modifies data under HKEY_USERS
                          • Modifies registry class
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious use of WriteProcessMemory
                          PID:2220
                          • C:\Windows\system32\svchost.exe
                            C:\Windows\system32\svchost.exe -k SystemNetworkService
                            2⤵
                            • Drops file in System32 directory
                            • Checks processor information in registry
                            • Modifies data under HKEY_USERS
                            • Modifies registry class
                            • Suspicious use of WriteProcessMemory
                            PID:1344

                        Network

                        MITRE ATT&CK Enterprise v6

                        Replay Monitor

                        Loading Replay Monitor...

                        Downloads

                        • memory/208-134-0x0000000004560000-0x0000000004661000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/208-141-0x0000000000C10000-0x0000000000C6C000-memory.dmp

                          Filesize

                          368KB

                          Download

                        • memory/1012-241-0x0000027139230000-0x00000271392A0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1012-142-0x0000027138B90000-0x0000027138C00000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1068-249-0x00000197E5530000-0x00000197E55A0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1068-176-0x00000197E5400000-0x00000197E5470000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1108-174-0x0000029CE2E70000-0x0000029CE2EE0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1108-247-0x0000029CE2EE0000-0x0000029CE2F50000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1228-255-0x0000026CE1810000-0x0000026CE1880000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1228-182-0x0000026CE1290000-0x0000026CE1300000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1292-257-0x0000021405240000-0x00000214052B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1292-184-0x00000214047E0000-0x0000021404850000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1292-169-0x00000214045D0000-0x00000214045D2000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/1344-225-0x000001AA24400000-0x000001AA24506000-memory.dmp

                          Filesize

                          1.0MB

                          Download

                        • memory/1344-226-0x000001AA236C0000-0x000001AA236DB000-memory.dmp

                          Filesize

                          108KB

                          Download

                        • memory/1344-137-0x000001AA21D80000-0x000001AA21DF0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1424-251-0x00000233CF000000-0x00000233CF070000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1424-178-0x00000233CEDD0000-0x00000233CEE40000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1880-180-0x00000299FFD00000-0x00000299FFD70000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1880-253-0x00000299FFD70000-0x00000299FFDE0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/1880-165-0x00000299FF500000-0x00000299FF502000-memory.dmp

                          Filesize

                          8KB

                          Download

                        • memory/2220-148-0x00000270067C0000-0x0000027006830000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2220-143-0x0000027006430000-0x000002700647B000-memory.dmp

                          Filesize

                          300KB

                          Download

                        • memory/2448-155-0x000001ACC4B40000-0x000001ACC4BB0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2448-245-0x000001ACC5140000-0x000001ACC51B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2476-149-0x000002CF88170000-0x000002CF881E0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2476-243-0x000002CF88240000-0x000002CF882B0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2676-186-0x000001EE98270000-0x000001EE982E0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2676-259-0x000001EE99530000-0x000001EE995A0000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2688-261-0x000001DEE72B0000-0x000001DEE7320000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2688-188-0x000001DEE71D0000-0x000001DEE7240000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2808-239-0x0000017902A20000-0x0000017902A90000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/2808-136-0x0000017902600000-0x0000017902670000-memory.dmp

                          Filesize

                          448KB

                          Download

                        • memory/3196-130-0x0000000000100000-0x0000000000101000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3196-138-0x00000000049E0000-0x00000000049E1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3196-144-0x0000000002230000-0x0000000002239000-memory.dmp

                          Filesize

                          36KB

                          Download

                        • memory/3540-197-0x0000000000400000-0x00000000005DB000-memory.dmp

                          Filesize

                          1.9MB

                          Download

                        • memory/3540-202-0x00000000038C0000-0x00000000038D0000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3540-208-0x0000000003A60000-0x0000000003A70000-memory.dmp

                          Filesize

                          64KB

                          Download

                        • memory/3648-200-0x0000000004F10000-0x0000000004F11000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3648-189-0x0000000000400000-0x000000000041C000-memory.dmp

                          Filesize

                          112KB

                          Download

                        • memory/3648-195-0x0000000005410000-0x0000000005411000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3648-198-0x0000000004E70000-0x0000000004E71000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3648-199-0x0000000004ED0000-0x0000000004ED1000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3648-214-0x0000000005190000-0x0000000005191000-memory.dmp

                          Filesize

                          4KB

                          Download

                        • memory/3648-201-0x0000000004E00000-0x0000000005406000-memory.dmp

                          Filesize

                          6.0MB

                          Download