Analysis
- max time kernel
154s - max time network
161s - platform
windows10_x64 - resource
win10v20210408 - submitted
31/08/2021, 06:47
Static task
static1
Behavioral task
behavioral1
Sample
d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe
- Size 1.1MB
- Sample210831-nqmk3dss1x
- SHA256 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f
- MD5 412db95b629bef9d45bbd3c62e37919d
- SHA1 0d42d579cb851469260c0ede693efcf7e73ab252
- SHA512 434e451e2fd28d4e26288579f47c916c1525f75d80d6ecd81c5e5f270825ef43f91b019f617d3dfa3a063d1f2b40a28ee66d14a770260590c7fd76f5ae872199
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
@fff8f8f6d
C2
-
77.220.212.176:35752
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral2/files/0x000100000001ab40-117.dat family_redline behavioral2/files/0x000100000001ab40-124.dat family_redline - Executes dropped EXE 3 IoCs
pid Process 3920 @fff8f8f6d.exe 3028 9012_protected.exe 2220 svchost.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2b4e092e4a6622ccc2b39afba5010a02.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2b4e092e4a6622ccc2b39afba5010a02.exe svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b4e092e4a6622ccc2b39afba5010a02 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2b4e092e4a6622ccc2b39afba5010a02 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\svchost.exe\" .." svchost.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 3028 9012_protected.exe 3028 9012_protected.exe 3028 9012_protected.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe 2220 svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 3920 @fff8f8f6d.exe Token: SeDebugPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe Token: 33 2220 svchost.exe Token: SeIncBasePriorityPrivilege 2220 svchost.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3028 9012_protected.exe 2220 svchost.exe - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 656 wrote to memory of 3920 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 73 PID 656 wrote to memory of 3920 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 73 PID 656 wrote to memory of 3920 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 73 PID 656 wrote to memory of 3028 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 74 PID 656 wrote to memory of 3028 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 74 PID 656 wrote to memory of 3028 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 74 PID 656 wrote to memory of 3664 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 75 PID 656 wrote to memory of 3664 656 d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe 75 PID 3028 wrote to memory of 2220 3028 9012_protected.exe 79 PID 3028 wrote to memory of 2220 3028 9012_protected.exe 79 PID 3028 wrote to memory of 2220 3028 9012_protected.exe 79 PID 2220 wrote to memory of 2188 2220 svchost.exe 80 PID 2220 wrote to memory of 2188 2220 svchost.exe 80 PID 2220 wrote to memory of 2188 2220 svchost.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe"C:\Users\Admin\AppData\Local\Temp\d162aea95889e147b96c2ab4da7cf27ec2538abd149a08f96d993fb7a41b002f.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Users\Admin\AppData\Local\Temp\@fff8f8f6d.exe"C:\Users\Admin\AppData\Local\Temp\@fff8f8f6d.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3920
-
-
C:\Users\Admin\AppData\Local\Temp\9012_protected.exe"C:\Users\Admin\AppData\Local\Temp\9012_protected.exe"2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2220 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\svchost.exe" "svchost.exe" ENABLE4⤵PID:2188
-
-
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\0xcheat loader.bat" "2⤵PID:3664
-