Analysis
-
max time kernel
149s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
24-05-2021 19:23
Static task
static1
Behavioral task
behavioral1
Sample
Install_Plugin_x64_x86.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Install_Plugin_x64_x86.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
Install_Plugin_x64_x86.exe
-
Size
1.1MB
-
MD5
ffe3cce3479bb06607d5056e6dbca530
-
SHA1
5aff7d6fd1aae0a2d66edf5692216749ba31658f
-
SHA256
079e85bcaa57b334fa9b3debe99c9f0402eb01104c9fdf3811e34e17308d64f0
-
SHA512
8b8efc3df750119418c2426f792b13d00b1afa2e05f0df18bcf1a1d90150a5f716fda785ba3752d8a2c9193b8bbd0d8d2c1debc71c027f1011c3378493e2d350
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
10
C2
86.107.197.200:40355
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1872-124-0x0000000000400000-0x0000000000432000-memory.dmp family_redline behavioral2/memory/1872-125-0x000000000042B086-mapping.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Install_Plugin_x64_x86.exedescription pid Process procid_target PID 4044 set thread context of 1872 4044 Install_Plugin_x64_x86.exe 79 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_&Prod_HeartDisk\4&37ce57ba&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid Process 2404 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
RegSvcs.exetaskmgr.exedescription pid Process Token: SeDebugPrivilege 1872 RegSvcs.exe Token: SeDebugPrivilege 2404 taskmgr.exe Token: SeSystemProfilePrivilege 2404 taskmgr.exe Token: SeCreateGlobalPrivilege 2404 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
taskmgr.exepid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid Process 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe 2404 taskmgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Install_Plugin_x64_x86.exedescription pid Process procid_target PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79 PID 4044 wrote to memory of 1872 4044 Install_Plugin_x64_x86.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\Install_Plugin_x64_x86.exe"C:\Users\Admin\AppData\Local\Temp\Install_Plugin_x64_x86.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1872
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2404