Analysis
-
max time kernel
121s -
max time network
153s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-06-2021 16:06
Static task
static1
Behavioral task
behavioral1
Sample
cf89ccd91a0582286a6d6fbb4721c99a.exe
Resource
win7v20210410
General
-
Target
cf89ccd91a0582286a6d6fbb4721c99a.exe
-
Size
850KB
-
MD5
cf89ccd91a0582286a6d6fbb4721c99a
-
SHA1
8a1d9e9a449f81293e1c861c7fb495f265343d00
-
SHA256
ab1b7bb6e9ab4d236af50fde41238818522f92ea990c2190af88b6514bf5559a
-
SHA512
824f2c0c01d07268634449402a9ce0e9228304081823aa69da73e5e85b27cf04b62a2972ee137967fd6dd2a63ebc7aaaf7da6bb44ec1f9da346a9243da0aba1e
Malware Config
Extracted
redline
3
94.26.248.63:7447
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/456-67-0x0000000000400000-0x000000000041C000-memory.dmp family_redline behavioral1/memory/456-68-0x000000000041730A-mapping.dmp family_redline behavioral1/memory/456-69-0x0000000000400000-0x000000000041C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
cf89ccd91a0582286a6d6fbb4721c99a.exedescription pid process target process PID 736 set thread context of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.execf89ccd91a0582286a6d6fbb4721c99a.exepid process 1148 powershell.exe 1148 powershell.exe 456 cf89ccd91a0582286a6d6fbb4721c99a.exe 456 cf89ccd91a0582286a6d6fbb4721c99a.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.execf89ccd91a0582286a6d6fbb4721c99a.exedescription pid process Token: SeDebugPrivilege 1148 powershell.exe Token: SeDebugPrivilege 456 cf89ccd91a0582286a6d6fbb4721c99a.exe -
Suspicious use of WriteProcessMemory 13 IoCs
Processes:
cf89ccd91a0582286a6d6fbb4721c99a.exedescription pid process target process PID 736 wrote to memory of 1148 736 cf89ccd91a0582286a6d6fbb4721c99a.exe powershell.exe PID 736 wrote to memory of 1148 736 cf89ccd91a0582286a6d6fbb4721c99a.exe powershell.exe PID 736 wrote to memory of 1148 736 cf89ccd91a0582286a6d6fbb4721c99a.exe powershell.exe PID 736 wrote to memory of 1148 736 cf89ccd91a0582286a6d6fbb4721c99a.exe powershell.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe PID 736 wrote to memory of 456 736 cf89ccd91a0582286a6d6fbb4721c99a.exe cf89ccd91a0582286a6d6fbb4721c99a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf89ccd91a0582286a6d6fbb4721c99a.exe"C:\Users\Admin\AppData\Local\Temp\cf89ccd91a0582286a6d6fbb4721c99a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\cf89ccd91a0582286a6d6fbb4721c99a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\cf89ccd91a0582286a6d6fbb4721c99a.exe"C:\Users\Admin\AppData\Local\Temp\cf89ccd91a0582286a6d6fbb4721c99a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/456-74-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/456-67-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/456-68-0x000000000041730A-mapping.dmp
-
memory/456-69-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/736-62-0x0000000004F80000-0x0000000004F81000-memory.dmpFilesize
4KB
-
memory/736-63-0x0000000000570000-0x0000000000584000-memory.dmpFilesize
80KB
-
memory/736-64-0x0000000004A00000-0x0000000004A8F000-memory.dmpFilesize
572KB
-
memory/736-65-0x00000000047B0000-0x00000000047FB000-memory.dmpFilesize
300KB
-
memory/736-60-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1148-96-0x0000000005650000-0x0000000005651000-memory.dmpFilesize
4KB
-
memory/1148-81-0x0000000006020000-0x0000000006021000-memory.dmpFilesize
4KB
-
memory/1148-71-0x00000000757E1000-0x00000000757E3000-memory.dmpFilesize
8KB
-
memory/1148-76-0x0000000002580000-0x0000000002581000-memory.dmpFilesize
4KB
-
memory/1148-75-0x0000000002120000-0x0000000002D6A000-memory.dmpFilesize
12.3MB
-
memory/1148-66-0x0000000000000000-mapping.dmp
-
memory/1148-78-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/1148-111-0x0000000006310000-0x0000000006311000-memory.dmpFilesize
4KB
-
memory/1148-86-0x00000000060C0000-0x00000000060C1000-memory.dmpFilesize
4KB
-
memory/1148-87-0x0000000006120000-0x0000000006121000-memory.dmpFilesize
4KB
-
memory/1148-88-0x000000007EF30000-0x000000007EF31000-memory.dmpFilesize
4KB
-
memory/1148-95-0x0000000006280000-0x0000000006281000-memory.dmpFilesize
4KB
-
memory/1148-73-0x0000000004900000-0x0000000004901000-memory.dmpFilesize
4KB
-
memory/1148-110-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/1148-72-0x0000000000A90000-0x0000000000A91000-memory.dmpFilesize
4KB