Analysis
-
max time kernel
119s -
max time network
20s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
22-07-2021 09:21
Static task
static1
Behavioral task
behavioral1
Sample
a4f4b5daa83bb6dc85ede588ffbfdb34.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
a4f4b5daa83bb6dc85ede588ffbfdb34.exe
Resource
win10v20210408
General
-
Target
a4f4b5daa83bb6dc85ede588ffbfdb34.exe
-
Size
212KB
-
MD5
a4f4b5daa83bb6dc85ede588ffbfdb34
-
SHA1
9bbaac140fa643d30bf25af71561f5ee35874898
-
SHA256
f61201b7b85a410a62c1f1946095b3feabb6e672fb8ddc0c64789a02ae9a06f4
-
SHA512
b4f436bd64384d767109d04eea6f3f5ad192c4f1e71cc31a88ba4ac78ef97da3ef1aaade388dfc9240c38e386993e9dc21803554db8513f0ed7ebe00ee248624
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/732-78-0x0000000001EC0000-0x0000000001EF2000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
3331249.exe7318042.exepid process 788 3331249.exe 732 7318042.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1624 788 WerFault.exe 3331249.exe -
Processes:
a4f4b5daa83bb6dc85ede588ffbfdb34.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349 a4f4b5daa83bb6dc85ede588ffbfdb34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 0f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a4f4b5daa83bb6dc85ede588ffbfdb34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 040000000100000010000000497904b0eb8719ac47b0bc11519b74d0030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e3491d00000001000000100000002e0d6875874a44c820912e85e964cfdb140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b40b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f00000053000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a4f4b5daa83bb6dc85ede588ffbfdb34.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\D1EB23A46D17D68FD92564C2F1F1601764D8E349\Blob = 1900000001000000100000002aa1c05e2ae606f198c2c5e937c97aa20f00000001000000140000003e8e6487f8fd27d322a269a71edaac5d57811286090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b0601050507030853000000010000002600000030243022060c2b06010401b231010201050130123010060a2b0601040182373c0101030200c00b00000001000000180000004300b7004f00b7004d00b7004f00b7004400b7004f000000140000000100000014000000a0110a233e96f107ece2af29ef82a57fd030a4b41d00000001000000100000002e0d6875874a44c820912e85e964cfdb030000000100000014000000d1eb23a46d17d68fd92564c2f1f1601764d8e349040000000100000010000000497904b0eb8719ac47b0bc11519b74d0200000000100000036040000308204323082031aa003020102020101300d06092a864886f70d0101050500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3034303130313030303030305a170d3238313233313233353935395a307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c1841414120436572746966696361746520536572766963657330820122300d06092a864886f70d01010105000382010f003082010a0282010100be409df46ee1ea76871c4d45448ebe46c883069dc12afe181f8ee402faf3ab5d508a16310b9a06d0c57022cd492d5463ccb66e68460b53eacb4c24c0bc724eeaf115aef4549a120ac37ab23360e2da8955f32258f3dedccfef8386a28c944f9f68f29890468427c776bfe3cc352c8b5e07646582c048b0a891f9619f762050a891c766b5eb78620356f08a1a13ea31a31ea099fd38f6f62732586f07f56bb8fb142bafb7aaccd6635f738cda0599a838a8cb17783651ace99ef4783a8dcf0fd942e2980cab2f9f0e01deef9f9949f12ddfac744d1b98b547c5e529d1f99018c7629cbe83c7267b3e8a25c7c0dd9de6356810209d8fd8ded2c3849c0d5ee82fc90203010001a381c03081bd301d0603551d0e04160414a0110a233e96f107ece2af29ef82a57fd030a4b4300e0603551d0f0101ff040403020106300f0603551d130101ff040530030101ff307b0603551d1f047430723038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c3036a034a0328630687474703a2f2f63726c2e636f6d6f646f2e6e65742f414141436572746966696361746553657276696365732e63726c300d06092a864886f70d010105050003820101000856fc02f09be8ffa4fad67bc64480ce4fc4c5f60058cca6b6bc1449680476e8e6ee5dec020f60d68d50184f264e01e3e6b0a5eebfbc745441bffdfc12b8c74f5af48960057f60b7054af3f6f1c2bfc4b97486b62d7d6bccd2f346dd2fc6e06ac3c334032c7d96dd5ac20ea70a99c1058bab0c2ff35c3acf6c37550987de53406c58effcb6ab656e04f61bdc3ce05a15c69ed9f15948302165036cece92173ec9b03a1e037ada015188ffaba02cea72ca910132cd4e50826ab229760f8905e74d4a29a53bdf2a968e0a26ec2d76cb1a30f9ebfeb68e756f2aef2e32b383a0981b56b85d7be2ded3f1ab7b263e2f5622c82d46a004150f139839f95e93696986e a4f4b5daa83bb6dc85ede588ffbfdb34.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
3331249.exeWerFault.exe7318042.exepid process 788 3331249.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 1624 WerFault.exe 732 7318042.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1624 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
a4f4b5daa83bb6dc85ede588ffbfdb34.exe3331249.exe7318042.exeWerFault.exedescription pid process Token: SeDebugPrivilege 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe Token: SeDebugPrivilege 788 3331249.exe Token: SeDebugPrivilege 732 7318042.exe Token: SeDebugPrivilege 1624 WerFault.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
a4f4b5daa83bb6dc85ede588ffbfdb34.exe3331249.exedescription pid process target process PID 1116 wrote to memory of 788 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 3331249.exe PID 1116 wrote to memory of 788 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 3331249.exe PID 1116 wrote to memory of 788 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 3331249.exe PID 1116 wrote to memory of 732 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 7318042.exe PID 1116 wrote to memory of 732 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 7318042.exe PID 1116 wrote to memory of 732 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 7318042.exe PID 1116 wrote to memory of 732 1116 a4f4b5daa83bb6dc85ede588ffbfdb34.exe 7318042.exe PID 788 wrote to memory of 1624 788 3331249.exe WerFault.exe PID 788 wrote to memory of 1624 788 3331249.exe WerFault.exe PID 788 wrote to memory of 1624 788 3331249.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a4f4b5daa83bb6dc85ede588ffbfdb34.exe"C:\Users\Admin\AppData\Local\Temp\a4f4b5daa83bb6dc85ede588ffbfdb34.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Users\Admin\AppData\Roaming\3331249.exe"C:\Users\Admin\AppData\Roaming\3331249.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 788 -s 19483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:1624 -
C:\Users\Admin\AppData\Roaming\7318042.exe"C:\Users\Admin\AppData\Roaming\7318042.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:732
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\3331249.exeMD5
a37b1548c0985ae8a2763cf6d1b39c80
SHA102fc37e10be4d933c05ee52d5363bee65fb914a6
SHA2568c31f3d89d2123272c1167ad1e929aa685d4065a5f334f651d4c09c0e291e986
SHA51289f7b6b7a8f6136854bd217ac6d9170575621a66bf42f51105354ab2419ed4a4df041e94eab64ec171b2c5bbb5dbe13f5f52cb137c38c6c1758508a3fc347bb9
-
C:\Users\Admin\AppData\Roaming\3331249.exeMD5
a37b1548c0985ae8a2763cf6d1b39c80
SHA102fc37e10be4d933c05ee52d5363bee65fb914a6
SHA2568c31f3d89d2123272c1167ad1e929aa685d4065a5f334f651d4c09c0e291e986
SHA51289f7b6b7a8f6136854bd217ac6d9170575621a66bf42f51105354ab2419ed4a4df041e94eab64ec171b2c5bbb5dbe13f5f52cb137c38c6c1758508a3fc347bb9
-
C:\Users\Admin\AppData\Roaming\7318042.exeMD5
52be91bb8576b57551f38cf98bd984cc
SHA1d4b25085ae85e7b4edc2db2f77e4108fd7345fc1
SHA2562eff8b37b39a5384bf9a3732bd7395af3430bd36eafdad4ba5cec6f707cdd680
SHA512f648be8d881ba47b87544327843add140cc4142ab7fac89cd87d3c79bed23524d7b40e35fd0c65a8c50a62c4e4f32d9a1681b3e043ea882bbfc46425891011b1
-
C:\Users\Admin\AppData\Roaming\7318042.exeMD5
52be91bb8576b57551f38cf98bd984cc
SHA1d4b25085ae85e7b4edc2db2f77e4108fd7345fc1
SHA2562eff8b37b39a5384bf9a3732bd7395af3430bd36eafdad4ba5cec6f707cdd680
SHA512f648be8d881ba47b87544327843add140cc4142ab7fac89cd87d3c79bed23524d7b40e35fd0c65a8c50a62c4e4f32d9a1681b3e043ea882bbfc46425891011b1
-
memory/732-80-0x0000000004AB0000-0x0000000004AB1000-memory.dmpFilesize
4KB
-
memory/732-78-0x0000000001EC0000-0x0000000001EF2000-memory.dmpFilesize
200KB
-
memory/732-74-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/732-70-0x0000000000000000-mapping.dmp
-
memory/788-65-0x0000000000000000-mapping.dmp
-
memory/788-77-0x00000000003E0000-0x0000000000430000-memory.dmpFilesize
320KB
-
memory/788-79-0x0000000000430000-0x0000000000431000-memory.dmpFilesize
4KB
-
memory/788-68-0x0000000000DC0000-0x0000000000DC1000-memory.dmpFilesize
4KB
-
memory/788-73-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/788-76-0x000000001ACC0000-0x000000001ACC2000-memory.dmpFilesize
8KB
-
memory/1116-63-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1116-64-0x000000001AC50000-0x000000001AC52000-memory.dmpFilesize
8KB
-
memory/1116-62-0x00000000003D0000-0x00000000003F3000-memory.dmpFilesize
140KB
-
memory/1116-59-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/1116-61-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1624-81-0x0000000000000000-mapping.dmp
-
memory/1624-82-0x000007FEFC301000-0x000007FEFC303000-memory.dmpFilesize
8KB
-
memory/1624-83-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB