Overview

overview

10

Static

static

1CFD3A83D9...3A.exe

windows7_x64

10

1CFD3A83D9...3A.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    151s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    06/08/2021, 07:37

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    1CFD3A83D9CF05E3F35449F9D8D5273A.exe
  • Size 1.4MB
  • Sample210806-9ch912xpra
  • SHA256 275cd3c09afaacc06adbdbcd5c638b5894c81eca008446454864b537f54593bd
  • MD5 SHA1 SHA512
Score
10/10
redlinediscoveryinfostealerspywarestealer

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • Executes dropped EXE 2 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies Internet Explorer settings 1 TTPs 3 IoCs
    adwarespyware
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 11 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 33 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\1CFD3A83D9CF05E3F35449F9D8D5273A.exe
    "C:\Users\Admin\AppData\Local\Temp\1CFD3A83D9CF05E3F35449F9D8D5273A.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:856
    • C:\Users\Admin\AppData\Local\Temp\WH.exe
      "C:\Users\Admin\AppData\Local\Temp\WH.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of NtSetInformationThreadHideFromDebugger
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:2840
    • C:\Users\Admin\AppData\Local\Temp\WALLHACK_28.07.2021.exe
      "C:\Users\Admin\AppData\Local\Temp\WALLHACK_28.07.2021.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:3748
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c start https://cheater.run/csgo_hacks_free/6-cheat-for-csgo-wallhack-wh.html
        3⤵
        • Checks computer location settings
        PID:2856
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c pause
        3⤵
          PID:4196
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdge.exe" -ServerName:MicrosoftEdge.AppXdnhjhccw3zf0j06tkg3jtqr00qdm0khc.mca
      1⤵
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of SetWindowsHookEx
      PID:852
    • C:\Windows\system32\browser_broker.exe
      C:\Windows\system32\browser_broker.exe -Embedding
      1⤵
      • Modifies Internet Explorer settings
      PID:2232
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4236
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies Internet Explorer settings
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4320
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      PID:4716
    • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
      "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
      1⤵
        PID:1108
      • C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe
        "C:\Windows\SystemApps\Microsoft.MicrosoftEdge_8wekyb3d8bbwe\MicrosoftEdgeCP.exe" -ServerName:ContentProcess.AppX6z3cwk4fvgady6zya12j1cw28d228a7k.mca
        1⤵
        • Modifies registry class
        PID:4624

      Network

            MITRE ATT&CK Enterprise v6

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            memory/2840-127-0x00000000052F0000-0x00000000052F1000-memory.dmp
            Download

            memory/2840-135-0x00000000069C0000-0x00000000069C1000-memory.dmp
            Download

            memory/2840-139-0x0000000006E60000-0x0000000006E61000-memory.dmp
            Download

            memory/2840-123-0x0000000000FF0000-0x0000000000FF1000-memory.dmp
            Download

            memory/2840-125-0x00000000058C0000-0x00000000058C1000-memory.dmp
            Download

            memory/2840-126-0x0000000002A00000-0x0000000002A01000-memory.dmp
            Download

            memory/2840-128-0x0000000005330000-0x0000000005331000-memory.dmp
            Download

            memory/2840-129-0x00000000052B0000-0x00000000058B6000-memory.dmp
            Download

            memory/2840-138-0x0000000006C80000-0x0000000006C81000-memory.dmp
            Download

            memory/2840-131-0x0000000005580000-0x0000000005581000-memory.dmp
            Download

            memory/2840-133-0x00000000067F0000-0x00000000067F1000-memory.dmp
            Download

            memory/2840-134-0x0000000006EF0000-0x0000000006EF1000-memory.dmp
            Download

            memory/2840-137-0x0000000007920000-0x0000000007921000-memory.dmp
            Download

            memory/2840-136-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
            Download