Overview

overview

10

Static

static

Setup.exe

windows7_x64

10

Setup.exe

windows11_x64

10

Setup.exe

windows10_x64

10

Resubmissions

03/09/2021, 12:16

210903-pfn3ysdac4 10

03/09/2021, 04:55

210903-fj6mqsfbfk 10

02/09/2021, 19:23

210902-x37sksbef5 10

02/09/2021, 15:02

210902-senycadeck 10

02/09/2021, 11:29

210902-4b2x2c3ahj 10

02/09/2021, 05:46

210902-lng5vcn31n 10

02/09/2021, 04:57

210902-gp7zs88ann 10

01/09/2021, 17:32

210901-sgcvvtysvs 10

31/08/2021, 12:57

210831-1v8aywj16x 10

31/08/2021, 07:34

210831-n7h9w45r3x 10

Analysis

  • max time kernel
    1622s
  • max time network
    1489s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    31/08/2021, 12:57

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Setup.exe

  • Size

    631KB

  • MD5

    cb927513ff8ebff4dd52a47f7e42f934

  • SHA1

    0de47c02a8adc4940a6c18621b4e4a619641d029

  • SHA256

    fd5c970806fba1500cbb6af5328329aeb43b8de3f02d90ec5d8cd1d57711622f

  • SHA512

    988c8fd886a9155b7d190faf2ce6b34d910efcffcf1c6251f18a9d0c804a0ea26a89679273033ac98b200363c536426efd1ae9de445c34e660369abb06f0071c

Score
10/10
redlinemybirjaspnewportspectragilenetdiscoveryevasioninfostealerthemidatrojan

Malware Config

Extracted

Family

redline

Botnet

mybirja

C2

45.14.49.232:63850

Extracted

Family

redline

Botnet

spnewportspectr

C2

135.148.139.222:1594

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
    evasiontrojan
  • Process spawned unexpected child process 1 IoCs

    This typically indicates the parent process was compromised via an exploit or macro.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 4 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 28 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Loads dropped DLL 45 IoCs
  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

    agilenet
  • Themida packer 6 IoCs

    Detects Themida, an advanced Windows software protection system.

    themida
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Looks up external IP address via web service 5 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Program Files directory 7 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Kills process with taskkill 3 IoCs
    evasion
  • Modifies data under HKEY_USERS 64 IoCs
  • Modifies system certificate store 2 TTPs 13 IoCs
    evasionspywaretrojan
  • Script User-Agent 1 IoCs

    Uses user-agent string associated with script host/environment.

  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Setup.exe"
    1⤵
    • Checks computer location settings
    • Loads dropped DLL
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1612
    • C:\Users\Admin\Documents\Zk17vtAeYbrEG3kOdWdSrkni.exe
      "C:\Users\Admin\Documents\Zk17vtAeYbrEG3kOdWdSrkni.exe"
      2⤵
      • Executes dropped EXE
      PID:340
    • C:\Users\Admin\Documents\ZM0HwI9mJU4lvonM5nq_9kTk.exe
      "C:\Users\Admin\Documents\ZM0HwI9mJU4lvonM5nq_9kTk.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      PID:1152
      • C:\Users\Admin\Documents\ZM0HwI9mJU4lvonM5nq_9kTk.exe
        "C:\Users\Admin\Documents\ZM0HwI9mJU4lvonM5nq_9kTk.exe"
        3⤵
        • Executes dropped EXE
        PID:2148
    • C:\Users\Admin\Documents\CGYRCfCgvlC_9XiU7Fhy9uMe.exe
      "C:\Users\Admin\Documents\CGYRCfCgvlC_9XiU7Fhy9uMe.exe"
      2⤵
      • Executes dropped EXE
      PID:1388
    • C:\Users\Admin\Documents\2KytRoGyS2hISFGojpqM6o2w.exe
      "C:\Users\Admin\Documents\2KytRoGyS2hISFGojpqM6o2w.exe"
      2⤵
      • Executes dropped EXE
      PID:592
    • C:\Users\Admin\Documents\TPJESoRM8EkMybZAsFub0Ozo.exe
      "C:\Users\Admin\Documents\TPJESoRM8EkMybZAsFub0Ozo.exe"
      2⤵
        PID:2012
      • C:\Users\Admin\Documents\Q98kB2GKzgulEibSDru6Tu7b.exe
        "C:\Users\Admin\Documents\Q98kB2GKzgulEibSDru6Tu7b.exe"
        2⤵
          PID:2008
        • C:\Users\Admin\Documents\y4mC7lqqw1373oVH1QsnkMbj.exe
          "C:\Users\Admin\Documents\y4mC7lqqw1373oVH1QsnkMbj.exe"
          2⤵
          • Executes dropped EXE
          PID:1692
        • C:\Users\Admin\Documents\7kwAtBUW5STJIg6ha1LOS4dT.exe
          "C:\Users\Admin\Documents\7kwAtBUW5STJIg6ha1LOS4dT.exe"
          2⤵
          • Executes dropped EXE
          PID:1588
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\System32\cmd.exe" /c taskkill /im "7kwAtBUW5STJIg6ha1LOS4dT.exe" /f & erase "C:\Users\Admin\Documents\7kwAtBUW5STJIg6ha1LOS4dT.exe" & exit
            3⤵
              PID:2536
              • C:\Windows\SysWOW64\taskkill.exe
                taskkill /im "7kwAtBUW5STJIg6ha1LOS4dT.exe" /f
                4⤵
                • Kills process with taskkill
                PID:2736
          • C:\Users\Admin\Documents\jIvQqzr5t9HvnaMeJswofVGG.exe
            "C:\Users\Admin\Documents\jIvQqzr5t9HvnaMeJswofVGG.exe"
            2⤵
            • Executes dropped EXE
            • Drops file in Program Files directory
            • Modifies system certificate store
            PID:564
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl HR" /sc HOURLY /rl HIGHEST
              3⤵
              • Creates scheduled task(s)
              PID:2188
            • C:\Windows\SysWOW64\schtasks.exe
              schtasks /create /f /RU "Admin" /tr "C:\Program Files (x86)\PowerControl\PowerControl_Svc.exe" /tn "PowerControl LG" /sc ONLOGON /rl HIGHEST
              3⤵
              • Creates scheduled task(s)
              PID:2272
          • C:\Users\Admin\Documents\3AFCfCHLadqLeNGS6fIaE_vo.exe
            "C:\Users\Admin\Documents\3AFCfCHLadqLeNGS6fIaE_vo.exe"
            2⤵
            • Executes dropped EXE
            PID:800
          • C:\Users\Admin\Documents\garD476G0WLcVRPecIvIt7MH.exe
            "C:\Users\Admin\Documents\garD476G0WLcVRPecIvIt7MH.exe"
            2⤵
            • Executes dropped EXE
            PID:956
          • C:\Users\Admin\Documents\xp6TcWFC3Begrv6F4_lMAlP_.exe
            "C:\Users\Admin\Documents\xp6TcWFC3Begrv6F4_lMAlP_.exe"
            2⤵
            • Executes dropped EXE
            PID:976
          • C:\Users\Admin\Documents\1BYpmuqxpoVUKM3XDcInAiRl.exe
            "C:\Users\Admin\Documents\1BYpmuqxpoVUKM3XDcInAiRl.exe"
            2⤵
            • Executes dropped EXE
            PID:908
          • C:\Users\Admin\Documents\WQLifcoXzsYEtAyKyDKDTzyF.exe
            "C:\Users\Admin\Documents\WQLifcoXzsYEtAyKyDKDTzyF.exe"
            2⤵
            • Executes dropped EXE
            PID:1432
            • C:\Users\Admin\Documents\WQLifcoXzsYEtAyKyDKDTzyF.exe
              "C:\Users\Admin\Documents\WQLifcoXzsYEtAyKyDKDTzyF.exe" -u
              3⤵
              • Executes dropped EXE
              PID:2788
          • C:\Users\Admin\Documents\RZ_itK1QVOMvKvpAadS1yDmN.exe
            "C:\Users\Admin\Documents\RZ_itK1QVOMvKvpAadS1yDmN.exe"
            2⤵
            • Executes dropped EXE
            PID:820
          • C:\Users\Admin\Documents\AWr5VrdLpyDwITJp7b6f6t4c.exe
            "C:\Users\Admin\Documents\AWr5VrdLpyDwITJp7b6f6t4c.exe"
            2⤵
            • Executes dropped EXE
            PID:1776
            • C:\Windows\SysWOW64\cmd.exe
              "C:\Windows\System32\cmd.exe" /c taskkill /im "AWr5VrdLpyDwITJp7b6f6t4c.exe" /f & erase "C:\Users\Admin\Documents\AWr5VrdLpyDwITJp7b6f6t4c.exe" & exit
              3⤵
                PID:2164
                • C:\Windows\SysWOW64\taskkill.exe
                  taskkill /im "AWr5VrdLpyDwITJp7b6f6t4c.exe" /f
                  4⤵
                  • Kills process with taskkill
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2348
            • C:\Users\Admin\Documents\RW_84koZio44UIB4QUW4k8Sn.exe
              "C:\Users\Admin\Documents\RW_84koZio44UIB4QUW4k8Sn.exe"
              2⤵
              • Executes dropped EXE
              PID:560
            • C:\Users\Admin\Documents\2IliOKqipizpeBwGNe8DxnLY.exe
              "C:\Users\Admin\Documents\2IliOKqipizpeBwGNe8DxnLY.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              PID:760
              • C:\Users\Admin\Documents\2IliOKqipizpeBwGNe8DxnLY.exe
                "C:\Users\Admin\Documents\2IliOKqipizpeBwGNe8DxnLY.exe"
                3⤵
                • Executes dropped EXE
                • Modifies data under HKEY_USERS
                PID:2992
            • C:\Users\Admin\Documents\lRUFfKolp05XjqiL1zSQVPaE.exe
              "C:\Users\Admin\Documents\lRUFfKolp05XjqiL1zSQVPaE.exe"
              2⤵
              • Executes dropped EXE
              PID:1752
            • C:\Users\Admin\Documents\YWpDCrXfPM2El548uJ3S3xwS.exe
              "C:\Users\Admin\Documents\YWpDCrXfPM2El548uJ3S3xwS.exe"
              2⤵
              • Executes dropped EXE
              • Suspicious use of SetThreadContext
              PID:1216
              • C:\Users\Admin\Documents\YWpDCrXfPM2El548uJ3S3xwS.exe
                C:\Users\Admin\Documents\YWpDCrXfPM2El548uJ3S3xwS.exe
                3⤵
                  PID:2332
              • C:\Users\Admin\Documents\I4EJTePBQ7QbDvx2oWLUHmQi.exe
                "C:\Users\Admin\Documents\I4EJTePBQ7QbDvx2oWLUHmQi.exe"
                2⤵
                • Executes dropped EXE
                • Loads dropped DLL
                • Drops file in Program Files directory
                PID:1340
                • C:\Program Files (x86)\Company\NewProduct\inst001.exe
                  "C:\Program Files (x86)\Company\NewProduct\inst001.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:2132
                • C:\Program Files (x86)\Company\NewProduct\cutm3.exe
                  "C:\Program Files (x86)\Company\NewProduct\cutm3.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:2436
                • C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe
                  "C:\Program Files (x86)\Company\NewProduct\md8_8eus.exe"
                  3⤵
                  • Executes dropped EXE
                  PID:2460
              • C:\Users\Admin\Documents\iMZh5vN3PPjXh3PGVvOOSIPJ.exe
                "C:\Users\Admin\Documents\iMZh5vN3PPjXh3PGVvOOSIPJ.exe"
                2⤵
                • Executes dropped EXE
                PID:1032
                • C:\Windows\SysWOW64\mshta.exe
                  "C:\Windows\System32\mshta.exe" VbsCrIPt: cLOSe ( CREAteobjecT ( "wScRiPT.ShElL" ). RUN ( "C:\Windows\system32\cmd.exe /C tYpe ""C:\Users\Admin\Documents\iMZh5vN3PPjXh3PGVvOOSIPJ.exe"" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi & if """"== """" for %m in ( ""C:\Users\Admin\Documents\iMZh5vN3PPjXh3PGVvOOSIPJ.exe"" ) do taskkill /iM ""%~NXm"" -F" , 0 , TRUE ) )
                  3⤵
                    PID:2372
                    • C:\Windows\SysWOW64\cmd.exe
                      "C:\Windows\system32\cmd.exe" /C tYpe "C:\Users\Admin\Documents\iMZh5vN3PPjXh3PGVvOOSIPJ.exe" > IQ0V_Fe_.eXE && StaRt IQ0v_FE_.ExE -poRsuYEMryiLi& if ""== "" for %m in ( "C:\Users\Admin\Documents\iMZh5vN3PPjXh3PGVvOOSIPJ.exe" ) do taskkill /iM "%~NXm" -F
                      4⤵
                      • Loads dropped DLL
                      PID:2600
                      • C:\Users\Admin\AppData\Local\Temp\IQ0V_Fe_.eXE
                        IQ0v_FE_.ExE -poRsuYEMryiLi
                        5⤵
                        • Executes dropped EXE
                        PID:2848
                      • C:\Windows\SysWOW64\taskkill.exe
                        taskkill /iM "iMZh5vN3PPjXh3PGVvOOSIPJ.exe" -F
                        5⤵
                        • Kills process with taskkill
                        PID:2908
                • C:\Users\Admin\Documents\8Q7sJXZwtLmjvvHbRnr12zIg.exe
                  "C:\Users\Admin\Documents\8Q7sJXZwtLmjvvHbRnr12zIg.exe"
                  2⤵
                  • Executes dropped EXE
                  • Modifies system certificate store
                  PID:1116
                  • C:\Windows\SysWOW64\WerFault.exe
                    C:\Windows\SysWOW64\WerFault.exe -u -p 1116 -s 868
                    3⤵
                    • Loads dropped DLL
                    • Program crash
                    • Suspicious behavior: EnumeratesProcesses
                    • Suspicious behavior: GetForegroundWindowSpam
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2256
              • C:\Windows\system32\rundll32.exe
                rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                1⤵
                • Process spawned unexpected child process
                PID:2096
                • C:\Windows\SysWOW64\rundll32.exe
                  rundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global
                  2⤵
                  • Loads dropped DLL
                  PID:2328

              Network

              MITRE ATT&CK Enterprise v6

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/560-142-0x0000000000AC0000-0x0000000000AC1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/592-159-0x0000000000E90000-0x0000000000E91000-memory.dmp

                Filesize

                4KB

                Download

              • memory/956-160-0x0000000000870000-0x0000000000871000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1216-162-0x0000000000DE0000-0x0000000000DE1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1388-165-0x00000000013C0000-0x00000000013C1000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1612-60-0x0000000004090000-0x00000000041CF000-memory.dmp

                Filesize

                1.2MB

                Download

              • memory/1612-59-0x0000000075551000-0x0000000075553000-memory.dmp

                Filesize

                8KB

                Download

              • memory/1692-158-0x0000000000860000-0x0000000000861000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1752-161-0x0000000000960000-0x0000000000961000-memory.dmp

                Filesize

                4KB

                Download

              • memory/1752-185-0x0000000000400000-0x0000000000416000-memory.dmp

                Filesize

                88KB

                Download

              • memory/1776-132-0x0000000000250000-0x000000000027F000-memory.dmp

                Filesize

                188KB

                Download

              • memory/2148-169-0x0000000000400000-0x0000000000409000-memory.dmp

                Filesize

                36KB

                Download

              • memory/2332-174-0x0000000000400000-0x0000000000422000-memory.dmp

                Filesize

                136KB

                Download