Overview

overview

10

Static

static

Setup (1).exe

windows7_x64

10

Setup (1).exe

windows10_x64

10

Setup (10).exe

windows7_x64

10

Setup (10).exe

windows10_x64

10

Setup (11).exe

windows7_x64

10

Setup (11).exe

windows10_x64

10

Setup (12).exe

windows7_x64

10

Setup (12).exe

windows10_x64

10

Setup (13).exe

windows7_x64

10

Setup (13).exe

windows10_x64

10

Setup (14).exe

windows7_x64

10

Setup (14).exe

windows10_x64

10

Setup (15).exe

windows7_x64

10

Setup (15).exe

windows10_x64

10

Setup (16).exe

windows7_x64

10

Setup (16).exe

windows10_x64

10

Setup (17).exe

windows7_x64

10

Setup (17).exe

windows10_x64

10

Setup (18).exe

windows7_x64

10

Setup (18).exe

windows10_x64

10

Setup (19).exe

windows7_x64

10

Setup (19).exe

windows10_x64

10

Setup (2).exe

windows7_x64

10

Setup (2).exe

windows10_x64

10

Setup (20).exe

windows7_x64

10

Setup (20).exe

windows10_x64

10

Setup (21).exe

windows7_x64

10

Setup (21).exe

windows10_x64

10

Setup (22).exe

windows7_x64

10

Setup (22).exe

windows10_x64

10

Setup (23).exe

windows7_x64

10

Setup (23).exe

windows10_x64

10

Resubmissions

15-10-2024 15:36

241015-s1zlzasdkc 10

01-07-2024 18:32

240701-w6yteawhmq 10

01-07-2024 14:52

240701-r82wmaxdnd 10

01-07-2024 14:52

240701-r8syqa1dpp 10

11-03-2024 21:22

240311-z8dsssgg58 10

01-09-2021 13:18

210901-5bmxjspa5s 10

01-09-2021 13:04

210901-te4btfspqa 10

01-09-2021 05:12

210901-4wnkwm1p3j 10

31-08-2021 21:47

210831-41rp97dma2 10

31-08-2021 19:51

210831-359awwatje 10

Analysis

  • max time kernel
    1714s
  • max time network
    1727s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-08-2021 10:21

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup (10).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score
10/10
redlinevidar20_8_rs937@gerhdhddibildsecond_7.5kwwwdiscoveryevasioninfostealerspywarestealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

www

C2

185.204.109.146:54891

Extracted

Family

redline

Botnet

Second_7.5K

C2

45.14.49.200:27625

Extracted

Family

vidar

Version

40.1

Botnet

937

C2

https://eduarroma.tumblr.com/

Attributes
  • profile_id

    937

Extracted

Family

redline

Botnet

dibild

C2

135.148.139.222:33569

Extracted

Family

redline

Botnet

@Gerhdhd

C2

46.8.19.177:41228

Extracted

Family

redline

Botnet

20_8_rs

C2

jekorikani.xyz:80

Extracted

Family

redline

C2

205.185.119.191:18846

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 17 IoCs
  • Vidar

    Vidar is an infostealer based on Arkei stealer.

    stealervidar
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Vidar Stealer 2 IoCs
    stealer
  • Downloads MZ/PE file
  • Executes dropped EXE 26 IoCs
  • Checks BIOS information in registry 2 TTPs 6 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 40 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Themida packer 10 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Checks whether UAC is enabled 1 TTPs 3 IoCs
    evasiontrojan
  • Looks up external IP address via web service 4 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 3 IoCs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Kills process with taskkill 1 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 26 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 13 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (10).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (10).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Users\Admin\Documents\GXqcntlGHYc0L66NCl4YUrE5.exe
      "C:\Users\Admin\Documents\GXqcntlGHYc0L66NCl4YUrE5.exe"
      2⤵
      • Executes dropped EXE
      PID:1080
    • C:\Users\Admin\Documents\Oyuj4edM0T5VmLi18wOaJkwV.exe
      "C:\Users\Admin\Documents\Oyuj4edM0T5VmLi18wOaJkwV.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1108
      • C:\Users\Admin\Documents\Oyuj4edM0T5VmLi18wOaJkwV.exe
        C:\Users\Admin\Documents\Oyuj4edM0T5VmLi18wOaJkwV.exe
        3⤵
        • Executes dropped EXE
        PID:2836
    • C:\Users\Admin\Documents\kDxZzwURoJSup884EVALAd3U.exe
      "C:\Users\Admin\Documents\kDxZzwURoJSup884EVALAd3U.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1636
      • C:\Users\Admin\Documents\kDxZzwURoJSup884EVALAd3U.exe
        C:\Users\Admin\Documents\kDxZzwURoJSup884EVALAd3U.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2844
    • C:\Users\Admin\Documents\VayOCucCmXnp9pR3UmRKIgFZ.exe
      "C:\Users\Admin\Documents\VayOCucCmXnp9pR3UmRKIgFZ.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:872
    • C:\Users\Admin\Documents\ZSFZYvSMNDGmffyInEMQptV2.exe
      "C:\Users\Admin\Documents\ZSFZYvSMNDGmffyInEMQptV2.exe"
      2⤵
      • Executes dropped EXE
      PID:580
    • C:\Users\Admin\Documents\aFevX1m0GF5d5k730ibc_fIi.exe
      "C:\Users\Admin\Documents\aFevX1m0GF5d5k730ibc_fIi.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:380
    • C:\Users\Admin\Documents\3Br0OpI0fjt5PAbS8ImoZRO5.exe
      "C:\Users\Admin\Documents\3Br0OpI0fjt5PAbS8ImoZRO5.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      PID:1272
      • C:\Users\Admin\AppData\Roaming\6699117.exe
        "C:\Users\Admin\AppData\Roaming\6699117.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2476
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe -u -p 2476 -s 1564
          4⤵
          • Program crash
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:2260
      • C:\Users\Admin\AppData\Roaming\3522334.exe
        "C:\Users\Admin\AppData\Roaming\3522334.exe"
        3⤵
        • Executes dropped EXE
        PID:2580
      • C:\Users\Admin\AppData\Roaming\4543669.exe
        "C:\Users\Admin\AppData\Roaming\4543669.exe"
        3⤵
        • Executes dropped EXE
        PID:2656
    • C:\Users\Admin\Documents\lTppLAzi8WQvwLARPLSVxNG5.exe
      "C:\Users\Admin\Documents\lTppLAzi8WQvwLARPLSVxNG5.exe"
      2⤵
      • Executes dropped EXE
      PID:1912
    • C:\Users\Admin\Documents\JAuu_xm_T50e6s9PdjWgjFdv.exe
      "C:\Users\Admin\Documents\JAuu_xm_T50e6s9PdjWgjFdv.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:924
      • C:\Users\Admin\Documents\JAuu_xm_T50e6s9PdjWgjFdv.exe
        "C:\Users\Admin\Documents\JAuu_xm_T50e6s9PdjWgjFdv.exe"
        3⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        PID:1804
    • C:\Users\Admin\Documents\8UxyzatQIoIZ2XmTP9nwbDgB.exe
      "C:\Users\Admin\Documents\8UxyzatQIoIZ2XmTP9nwbDgB.exe"
      2⤵
        PID:1432
      • C:\Users\Admin\Documents\OtUxGS2AanQZ0NCDclLYbwXh.exe
        "C:\Users\Admin\Documents\OtUxGS2AanQZ0NCDclLYbwXh.exe"
        2⤵
        • Executes dropped EXE
        • Checks BIOS information in registry
        • Checks whether UAC is enabled
        • Suspicious use of NtSetInformationThreadHideFromDebugger
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1540
      • C:\Users\Admin\Documents\ea483tLhmJYU48alI1kSD5Um.exe
        "C:\Users\Admin\Documents\ea483tLhmJYU48alI1kSD5Um.exe"
        2⤵
          PID:1356
        • C:\Users\Admin\Documents\XP_hFz01vfcQZOMF_gGVNyCT.exe
          "C:\Users\Admin\Documents\XP_hFz01vfcQZOMF_gGVNyCT.exe"
          2⤵
          • Executes dropped EXE
          • Suspicious use of SetThreadContext
          PID:1624
          • C:\Users\Admin\Documents\XP_hFz01vfcQZOMF_gGVNyCT.exe
            C:\Users\Admin\Documents\XP_hFz01vfcQZOMF_gGVNyCT.exe
            3⤵
            • Executes dropped EXE
            PID:2852
        • C:\Users\Admin\Documents\d9RKMywc7Cv0hN3epr3XbFCP.exe
          "C:\Users\Admin\Documents\d9RKMywc7Cv0hN3epr3XbFCP.exe"
          2⤵
          • Executes dropped EXE
          PID:1904
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im "d9RKMywc7Cv0hN3epr3XbFCP.exe" /f & erase "C:\Users\Admin\Documents\d9RKMywc7Cv0hN3epr3XbFCP.exe" & exit
            3⤵
              PID:1600
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im "d9RKMywc7Cv0hN3epr3XbFCP.exe" /f
                4⤵
                • Kills process with taskkill
                • Suspicious use of AdjustPrivilegeToken
                PID:412
          • C:\Users\Admin\Documents\S_oBUrt6tiby69YBurKbOmPQ.exe
            "C:\Users\Admin\Documents\S_oBUrt6tiby69YBurKbOmPQ.exe"
            2⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:964
          • C:\Users\Admin\Documents\eWy9rwr5i5szjZBj9cBV2k4M.exe
            "C:\Users\Admin\Documents\eWy9rwr5i5szjZBj9cBV2k4M.exe"
            2⤵
            • Executes dropped EXE
            PID:752
          • C:\Users\Admin\Documents\0Ofgf1rtk_CtH7RKEk7fIYZs.exe
            "C:\Users\Admin\Documents\0Ofgf1rtk_CtH7RKEk7fIYZs.exe"
            2⤵
            • Executes dropped EXE
            • Loads dropped DLL
            PID:368
            • C:\Users\Admin\AppData\Local\Temp\is-22J93.tmp\0Ofgf1rtk_CtH7RKEk7fIYZs.tmp
              "C:\Users\Admin\AppData\Local\Temp\is-22J93.tmp\0Ofgf1rtk_CtH7RKEk7fIYZs.tmp" /SL5="$900CE,138429,56832,C:\Users\Admin\Documents\0Ofgf1rtk_CtH7RKEk7fIYZs.exe"
              3⤵
              • Executes dropped EXE
              • Loads dropped DLL
              PID:2988
          • C:\Users\Admin\Documents\aTau7XhS8PLQSkPiaxNkamKd.exe
            "C:\Users\Admin\Documents\aTau7XhS8PLQSkPiaxNkamKd.exe"
            2⤵
            • Executes dropped EXE
            • Checks BIOS information in registry
            • Checks whether UAC is enabled
            • Suspicious use of NtSetInformationThreadHideFromDebugger
            PID:1444
          • C:\Users\Admin\Documents\vqkFUAOaKnMc5RZ3DW_HEkOZ.exe
            "C:\Users\Admin\Documents\vqkFUAOaKnMc5RZ3DW_HEkOZ.exe"
            2⤵
            • Executes dropped EXE
            PID:1628
            • C:\Windows\SysWOW64\WerFault.exe
              C:\Windows\SysWOW64\WerFault.exe -u -p 1628 -s 596
              3⤵
              • Loads dropped DLL
              • Program crash
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious behavior: GetForegroundWindowSpam
              • Suspicious use of AdjustPrivilegeToken
              PID:2436
          • C:\Users\Admin\Documents\kgrPYoJFknb9sW4ljsLu8SBi.exe
            "C:\Users\Admin\Documents\kgrPYoJFknb9sW4ljsLu8SBi.exe"
            2⤵
            • Executes dropped EXE
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:332

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/332-193-0x00000000048A0000-0x00000000048BC000-memory.dmp

          Filesize

          112KB

          Download

        • memory/332-195-0x00000000048C0000-0x00000000048DA000-memory.dmp

          Filesize

          104KB

          Download

        • memory/332-151-0x0000000000400000-0x0000000002CD0000-memory.dmp

          Filesize

          40.8MB

          Download

        • memory/332-145-0x0000000002CD0000-0x0000000002CFF000-memory.dmp

          Filesize

          188KB

          Download

        • memory/380-183-0x00000000009F0000-0x00000000009F1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/872-191-0x0000000001200000-0x0000000001201000-memory.dmp

          Filesize

          4KB

          Download

        • memory/964-201-0x0000000000280000-0x0000000000281000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1080-96-0x00000000009B0000-0x00000000009B1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1108-173-0x0000000000BD0000-0x0000000000BD1000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1272-156-0x000000001B340000-0x000000001B342000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1272-109-0x0000000000220000-0x0000000000221000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1272-153-0x0000000000140000-0x000000000015C000-memory.dmp

          Filesize

          112KB

          Download

        • memory/1444-198-0x0000000000C00000-0x0000000000C01000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1540-197-0x0000000000E00000-0x0000000000E01000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1624-181-0x0000000000A80000-0x0000000000A81000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1628-144-0x0000000002D10000-0x0000000002DAD000-memory.dmp

          Filesize

          628KB

          Download

        • memory/1628-152-0x0000000000400000-0x0000000002D0E000-memory.dmp

          Filesize

          41.1MB

          Download

        • memory/1636-172-0x0000000000D30000-0x0000000000D31000-memory.dmp

          Filesize

          4KB

          Download

        • memory/1844-60-0x0000000076A81000-0x0000000076A83000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1844-61-0x0000000003C70000-0x0000000003DAF000-memory.dmp

          Filesize

          1.2MB

          Download

        • memory/1904-179-0x0000000000220000-0x0000000000250000-memory.dmp

          Filesize

          192KB

          Download

        • memory/1912-154-0x0000000000220000-0x0000000000229000-memory.dmp

          Filesize

          36KB

          Download

        • memory/1912-166-0x0000000000400000-0x00000000023AF000-memory.dmp

          Filesize

          31.7MB

          Download

        • memory/2260-200-0x000007FEFC471000-0x000007FEFC473000-memory.dmp

          Filesize

          8KB

          Download

        • memory/2476-169-0x0000000001290000-0x0000000001291000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2476-180-0x00000000003C0000-0x00000000003EB000-memory.dmp

          Filesize

          172KB

          Download

        • memory/2580-205-0x0000000000A30000-0x0000000000A31000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2656-203-0x0000000001390000-0x0000000001391000-memory.dmp

          Filesize

          4KB

          Download

        • memory/2836-208-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2836-187-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2844-185-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2844-206-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2852-186-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2852-207-0x0000000000400000-0x000000000041E000-memory.dmp

          Filesize

          120KB

          Download

        • memory/2988-215-0x0000000001D60000-0x0000000001D9C000-memory.dmp

          Filesize

          240KB

          Download

        • memory/2988-216-0x0000000072661000-0x0000000072663000-memory.dmp

          Filesize

          8KB

          Download