Analysis
-
max time kernel
150s -
max time network
182s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
24-05-2021 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Install_Plugin_x64_x86.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Install_Plugin_x64_x86.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Install_Plugin_x64_x86.exe
-
Size
1.1MB
-
MD5
ffe3cce3479bb06607d5056e6dbca530
-
SHA1
5aff7d6fd1aae0a2d66edf5692216749ba31658f
-
SHA256
079e85bcaa57b334fa9b3debe99c9f0402eb01104c9fdf3811e34e17308d64f0
-
SHA512
8b8efc3df750119418c2426f792b13d00b1afa2e05f0df18bcf1a1d90150a5f716fda785ba3752d8a2c9193b8bbd0d8d2c1debc71c027f1011c3378493e2d350
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
10
C2
86.107.197.200:40355
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1836-67-0x0000000000400000-0x0000000000432000-memory.dmp family_redline behavioral1/memory/1836-68-0x000000000042B086-mapping.dmp family_redline behavioral1/memory/1836-69-0x0000000000400000-0x0000000000432000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Install_Plugin_x64_x86.exedescription pid Process procid_target PID 1840 set thread context of 1836 1840 Install_Plugin_x64_x86.exe 30 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 856 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
taskmgr.exeRegSvcs.exedescription pid Process Token: SeDebugPrivilege 856 taskmgr.exe Token: SeDebugPrivilege 1836 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe 856 taskmgr.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
Install_Plugin_x64_x86.exedescription pid Process procid_target PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30 PID 1840 wrote to memory of 1836 1840 Install_Plugin_x64_x86.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install_Plugin_x64_x86.exe"C:\Users\Admin\AppData\Local\Temp\Install_Plugin_x64_x86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1840 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1836
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:856