Analysis
-
max time kernel
130s -
max time network
139s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-05-2021 19:01
Static task
static1
Behavioral task
behavioral1
Sample
omar (1).exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
omar (1).exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
omar (1).exe
-
Size
1.2MB
-
MD5
13db34cab435d9858269c5e823f4b575
-
SHA1
c6e9c301d3cfaf6671490c47c1ed4eb59f343f21
-
SHA256
63ca5cde7141ae503639f3022f4dc4a244e8b19bf320d55a9567789aa632d036
-
SHA512
dfd36c39b35cf1aed2b76e38d4a08c41792611cf886d337d129a19c963878cc53fb7a0d71e078d2d38e61d8341a938869686f62673f080a7182020cd08c2c6a8
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
omar
C2
217.12.209.28:44444
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
resource yara_rule behavioral2/memory/3992-124-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral2/memory/3992-125-0x000000000041654E-mapping.dmp family_redline behavioral2/memory/3992-133-0x0000000005060000-0x0000000005666000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 2 IoCs
description pid Process procid_target PID 4364 created 2140 4364 WerFault.exe 91 PID 4888 created 4656 4888 WerFault.exe 96 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3232 set thread context of 3992 3232 omar (1).exe 81 -
Program crash 2 IoCs
pid pid_target Process procid_target 4364 2140 WerFault.exe 91 4888 4656 WerFault.exe 96 -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions\Cached PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\LowRegistry PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Internet Explorer\LowRegistry\Shell Extensions PaintStudio.View.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CacheLimit = "51200" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Extensible Cache PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CacheLimit = "1" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix PaintStudio.View.exe Set value (int) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CacheLimit = "1" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\History\CachePrefix = "Visited:" PaintStudio.View.exe Key created \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" PaintStudio.View.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoft.mspaint_8wekyb3d8bbwe\Internet Settings\Cache\Content\CachePrefix PaintStudio.View.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
pid Process 2140 PaintStudio.View.exe 4656 PaintStudio.View.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3232 omar (1).exe 3232 omar (1).exe 2724 mspaint.exe 2724 mspaint.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4364 WerFault.exe 4612 mspaint.exe 4612 mspaint.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe 4888 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 3232 omar (1).exe Token: SeDebugPrivilege 3992 omar (1).exe Token: SeDebugPrivilege 2140 PaintStudio.View.exe Token: SeDebugPrivilege 2140 PaintStudio.View.exe Token: SeDebugPrivilege 2140 PaintStudio.View.exe Token: SeDebugPrivilege 4364 WerFault.exe Token: SeDebugPrivilege 4656 PaintStudio.View.exe Token: SeDebugPrivilege 4656 PaintStudio.View.exe Token: SeDebugPrivilege 4888 WerFault.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2724 mspaint.exe 2140 PaintStudio.View.exe 2140 PaintStudio.View.exe 4612 mspaint.exe 4656 PaintStudio.View.exe 4656 PaintStudio.View.exe -
Suspicious use of WriteProcessMemory 11 IoCs
description pid Process procid_target PID 3232 wrote to memory of 3936 3232 omar (1).exe 80 PID 3232 wrote to memory of 3936 3232 omar (1).exe 80 PID 3232 wrote to memory of 3936 3232 omar (1).exe 80 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81 PID 3232 wrote to memory of 3992 3232 omar (1).exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\omar (1).exe"C:\Users\Admin\AppData\Local\Temp\omar (1).exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3232 -
C:\Users\Admin\AppData\Local\Temp\omar (1).exe"{path}"2⤵PID:3936
-
-
C:\Users\Admin\AppData\Local\Temp\omar (1).exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3992
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2224
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\HideUnblock.jpg" /ForceBootstrapPaint3D1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2724
-
C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2140 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2140 -s 42522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4364
-
-
C:\Windows\system32\mspaint.exe"C:\Windows\system32\mspaint.exe" "C:\Users\Admin\Desktop\HideUnblock.jpg" /ForceBootstrapPaint3D1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4612
-
C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe"C:\Program Files\WindowsApps\Microsoft.MSPaint_1.1702.28017.0_x64__8wekyb3d8bbwe\PaintStudio.View.exe" -ServerName:Microsoft.MSPaint.AppX437q68k2qc2asvaagas2prv9tjej6ja9.mca1⤵
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4656 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 4656 -s 41522⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4888
-