redline | d72dd5663947fc7e1bd8903030b3e2fd551d8d938fdc6417d8513a1c4cc49702

Analysis

max time kernel
16s
max time network
184s
platform
windows7_x64
resource
win7v20210408
submitted
30/07/2021, 15:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
E39A5FA4C76264AE7D7343E41675A636.exe
Size 2.6MB
Sample210730-bezpcqbbcn
SHA256 d72dd5663947fc7e1bd8903030b3e2fd551d8d938fdc6417d8513a1c4cc49702
MD5 e39a5fa4c76264ae7d7343e41675a636
SHA1 f32530047d0fa1bbdc009c56b2e24a11866370c9
SHA512 fbcc846582ea34c97d83accfed1f88fb3259d20ca7e61ab46e8da3f08e6d54bff61000919ed0c1b06f484e1109c654ceb7a946c0ec134a0e103677a421deed5b
MD5 SHA1 SHA512

Score

10^/10

redline vidar aspackv2 infostealer stealer suricata

Malware Config

Signatures

Process spawned unexpected child process 1 IoCs

This typically indicates the parent process was compromised via an exploit or macro.

description	pid	pid_target	Process	procid_target
Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process	1220	1728	rUNdlL32.eXe	49

RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral1/memory/2080-210-0x00000000005E0000-0x000000000061A000-memory.dmp	family_redline

Vidar
Vidar is an infostealer based on Arkei stealer.
stealer vidar
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata
suricata: ET MALWARE Suspicious Zipped Filename in Outbound POST Request (Passwords.txt)
suricata
suricata: ET MALWARE Vidar/Arkei Stealer Client Data Upload
suricata

Nirsoft 4 IoCs

resource	yara_rule
behavioral1/files/0x00050000000130d2-163.dat	Nirsoft
behavioral1/memory/1940-165-0x0000000000400000-0x0000000000455000-memory.dmp	Nirsoft
behavioral1/files/0x00050000000130d2-166.dat	Nirsoft
behavioral1/files/0x00050000000130d2-167.dat	Nirsoft

ASPack v2.12-2.42 18 IoCs

Detects executables packed with ASPack v2.12-2.42

aspackv2

resource	yara_rule
behavioral1/files/0x00030000000130c9-69.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-70.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-71.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-73.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c5-74.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c5-75.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c4-76.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c4-77.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c7-82.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c7-83.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-85.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-87.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-88.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-86.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-144.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-143.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-142.dat	aspack_v212_v242
behavioral1/files/0x00030000000130c9-157.dat	aspack_v212_v242

Downloads MZ/PE file

Executes dropped EXE 7 IoCs

pid	Process
1980	setup_installer.exe
1872	setup_install.exe
1840	sonia_2.exe
684	sonia_4.exe
1712	sonia_3.exe
1352	sonia_7.exe
1940	11111.exe

Loads dropped DLL 34 IoCs

pid	Process
1976	E39A5FA4C76264AE7D7343E41675A636.exe
1980	setup_installer.exe
1980	setup_installer.exe
1980	setup_installer.exe
1980	setup_installer.exe
1980	setup_installer.exe
1980	setup_installer.exe
1872	setup_install.exe
1872	setup_install.exe
1872	setup_install.exe
1872	setup_install.exe
1872	setup_install.exe
1872	setup_install.exe
1872	setup_install.exe
1872	setup_install.exe
852	cmd.exe
852	cmd.exe
1108	cmd.exe
1840	sonia_2.exe
1840	sonia_2.exe
1520	cmd.exe
1520	cmd.exe
1712	sonia_3.exe
1712	sonia_3.exe
1700	cmd.exe
1700	cmd.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
1840	sonia_2.exe
388	cmd.exe
388	cmd.exe
1940	11111.exe
1940	11111.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
12	ip-api.com

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Program crash 3 IoCs

pid	pid_target	Process	procid_target
920	1872	WerFault.exe	27
2736	1788	WerFault.exe	57
2764	2120	WerFault.exe	61

Checks SCSI registry key(s) 3 TTPs 3 IoCs

SCSI information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe
Key enumerated	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI	sonia_2.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
2436	timeout.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2360	taskkill.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1840	sonia_2.exe
1840	sonia_2.exe
1228	Process not Found
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
920	WerFault.exe
1228	Process not Found
1228	Process not Found
1228	Process not Found

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
1840	sonia_2.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	684	sonia_4.exe
Token: SeDebugPrivilege	920	WerFault.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1976 wrote to memory of 1980	1976	E39A5FA4C76264AE7D7343E41675A636.exe	26
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1980 wrote to memory of 1872	1980	setup_installer.exe	27
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 388	1872	setup_install.exe	29
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 852	1872	setup_install.exe	40
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1520	1872	setup_install.exe	39
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1108	1872	setup_install.exe	38
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 1872 wrote to memory of 1660	1872	setup_install.exe	36
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 852 wrote to memory of 1840	852	cmd.exe	35
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1872 wrote to memory of 1612	1872	setup_install.exe	34
PID 1108 wrote to memory of 684	1108	cmd.exe	30

C:\Users\Admin\AppData\Local\Temp\E39A5FA4C76264AE7D7343E41675A636.exe
"C:\Users\Admin\AppData\Local\Temp\E39A5FA4C76264AE7D7343E41675A636.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976
- C:\Users\Admin\AppData\Local\Temp\setup_installer.exe
  "C:\Users\Admin\AppData\Local\Temp\setup_installer.exe"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1980
- - C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\setup_install.exe
    "C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\setup_install.exe"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:1872
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_1.exe
      4⤵
      Loads dropped DLL
      PID:388
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_1.exe
        
        sonia_1.exe
        5⤵
        
        PID:1940
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_7.exe
      4⤵
      Loads dropped DLL
      PID:1700
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_7.exe
        
        sonia_7.exe
        5⤵
        Executes dropped EXE
        
        PID:1352
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        Executes dropped EXE
        Loads dropped DLL
        
        PID:1940
      - C:\Users\Admin\AppData\Local\Temp\11111.exe
        
        C:\Users\Admin\AppData\Local\Temp\11111.exe /CookiesFile "C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Profile 2\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:1724
      - C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Default\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2140
      - C:\Users\Admin\AppData\Local\Temp\22222.exe
        
        C:\Users\Admin\AppData\Local\Temp\22222.exe /CookiesFile "C:\Users\Admin\AppData\Local\Microsoft\Edge\User Data\Profile 1\Cookies" /scookiestxt C:\Users\Admin\AppData\Local\Temp\fj4ghga23_fsa.txt
        6⤵
        
        PID:2256
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_6.exe
      4⤵
      PID:1612
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_5.exe
      4⤵
      PID:1660
    - - C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_5.exe
        
        sonia_5.exe
        5⤵
        
        PID:1224
      - C:\Users\Admin\AppData\Roaming\3757619.exe
        
        "C:\Users\Admin\AppData\Roaming\3757619.exe"
        6⤵
        
        PID:1788
        
        C:\Windows\system32\WerFault.exe
        
        C:\Windows\system32\WerFault.exe -u -p 1788 -s 1772
        7⤵
        Program crash
        
        PID:2736
      - C:\Users\Admin\AppData\Roaming\7717996.exe
        
        "C:\Users\Admin\AppData\Roaming\7717996.exe"
        6⤵
        
        PID:2080
      - C:\Users\Admin\AppData\Roaming\6601644.exe
        
        "C:\Users\Admin\AppData\Roaming\6601644.exe"
        6⤵
        
        PID:1416
        
        C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe
        
        "C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"
        7⤵
        
        PID:2480
      - C:\Users\Admin\AppData\Roaming\8807932.exe
        
        "C:\Users\Admin\AppData\Roaming\8807932.exe"
        6⤵
        
        PID:2120
        
        C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2120 -s 1764
        7⤵
        Program crash
        
        PID:2764
  - - C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 1872 -s 412
      4⤵
      Loads dropped DLL
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:920
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_4.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:1108
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_3.exe
      4⤵
      Loads dropped DLL
      PID:1520
  - - C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c sonia_2.exe
      4⤵
      Loads dropped DLL
      Suspicious use of WriteProcessMemory
      PID:852

C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_4.exe
sonia_4.exe
1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:684

C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_3.exe
sonia_3.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
PID:1712
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c taskkill /im sonia_3.exe /f & timeout /t 6 & del /f /q "C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_3.exe" & del C:\ProgramData\*.dll & exit
  2⤵
  PID:2300
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im sonia_3.exe /f
    3⤵
    - Kills process with taskkill
    PID:2360
- - C:\Windows\SysWOW64\timeout.exe
    timeout /t 6
    3⤵
    - Delays execution with timeout.exe
    PID:2436

C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_2.exe
sonia_2.exe
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:1840

C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_1.exe
"C:\Users\Admin\AppData\Local\Temp\7zSCB7B9315\sonia_1.exe" -a
1⤵
PID:1260

C:\Windows\system32\rUNdlL32.eXe
rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
1⤵
- Process spawned unexpected child process
PID:1220
- C:\Windows\SysWOW64\rundll32.exe
  rUNdlL32.eXe "C:\Users\Admin\AppData\Local\Temp\axhub.dll",main
  2⤵
  PID:1720

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:1724

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k SystemNetworkService
1⤵
PID:2568

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/684-123-0x0000000000D70000-0x0000000000D71000-memory.dmp

Download

memory/1224-174-0x0000000001060000-0x0000000001061000-memory.dmp

Download

memory/1224-177-0x0000000000140000-0x0000000000156000-memory.dmp

Download

memory/1352-160-0x000007FEFC2E1000-0x000007FEFC2E3000-memory.dmp

Download

memory/1416-198-0x0000000000AB0000-0x0000000000AB1000-memory.dmp

Download

memory/1416-206-0x0000000000490000-0x0000000000498000-memory.dmp

Download

memory/1788-190-0x00000000001E0000-0x00000000001E1000-memory.dmp

Download

memory/1788-187-0x0000000000670000-0x00000000006A3000-memory.dmp

Download

memory/1788-184-0x00000000001D0000-0x00000000001D1000-memory.dmp

Download

memory/1788-180-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

Download

memory/1872-100-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1872-92-0x0000000000400000-0x000000000051D000-memory.dmp

Download

memory/1872-89-0x000000006B440000-0x000000006B4CF000-memory.dmp

Download

memory/1872-103-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1872-107-0x0000000064940000-0x0000000064959000-memory.dmp

Download

memory/1872-91-0x000000006B280000-0x000000006B2A6000-memory.dmp

Download

memory/1872-90-0x000000006FE40000-0x000000006FFC6000-memory.dmp

Download

memory/1940-165-0x0000000000400000-0x0000000000455000-memory.dmp

Download

memory/1976-60-0x0000000075B31000-0x0000000075B33000-memory.dmp

Download

memory/2080-208-0x0000000000500000-0x0000000000501000-memory.dmp

Download

memory/2080-213-0x0000000000570000-0x0000000000571000-memory.dmp

Download

memory/2080-210-0x00000000005E0000-0x000000000061A000-memory.dmp

Download

memory/2080-199-0x0000000000010000-0x0000000000011000-memory.dmp

Download

memory/2120-214-0x0000000000230000-0x0000000000231000-memory.dmp

Download

memory/2120-197-0x0000000001070000-0x0000000001071000-memory.dmp

Download

memory/2120-207-0x0000000000200000-0x0000000000201000-memory.dmp

Download

memory/2120-212-0x0000000000510000-0x0000000000542000-memory.dmp

Download

memory/2480-217-0x0000000000160000-0x0000000000161000-memory.dmp

Download