Analysis
-
max time kernel
59s -
max time network
165s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 06:22
Static task
static1
General
-
Target
f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe
-
Size
565KB
-
MD5
b4858160f2f4f0f897b683f46eb66596
-
SHA1
005bbdf184395a5f1229ee71bb7478be4a78941e
-
SHA256
f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9
-
SHA512
9604bc91f55678deeb7aca8b4bb3572dca705d02e8bca9b8f17ca1b21d6cdeab93a2bd88e450fa220241ede2579abcbddb7e8e94c3431096e9e223a6829db7ee
Malware Config
Extracted
redline
15.09
185.215.113.17:48236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3960-121-0x0000000002300000-0x000000000231F000-memory.dmp family_redline behavioral1/memory/3960-123-0x0000000002490000-0x00000000024AE000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
lipstersh.exepid process 3960 lipstersh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
lipstersh.exepid process 3960 lipstersh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lipstersh.exedescription pid process Token: SeDebugPrivilege 3960 lipstersh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exedescription pid process target process PID 3128 wrote to memory of 3960 3128 f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe lipstersh.exe PID 3128 wrote to memory of 3960 3128 f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe lipstersh.exe PID 3128 wrote to memory of 3960 3128 f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe lipstersh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe"C:\Users\Admin\AppData\Local\Temp\f7c90944bd6b0da2e79fb349da368ae3ef38520b43933427bf4ff64f0adf74f9.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wushup\lipstersh.exelipstersh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wushup\lipstersh.exeMD5
2e86ae6eb7d98ccfa1c9433f77baac74
SHA177f47fad5da023c8775496b442666d90dcc5d493
SHA2561566629c1522ed8c33bdf8d6cf525d0611994d45d533ba493b6133b27b668c71
SHA512c3c64a68c992bc24cda82c2115301c5ced2faa3c35b0eecc466d0a6464fd3eecca660779570fe06b30ef7cfbc1957020cf1789eae1a237afdda2da587c06327a
-
C:\Users\Admin\AppData\Roaming\wushup\lipstersh.exeMD5
2e86ae6eb7d98ccfa1c9433f77baac74
SHA177f47fad5da023c8775496b442666d90dcc5d493
SHA2561566629c1522ed8c33bdf8d6cf525d0611994d45d533ba493b6133b27b668c71
SHA512c3c64a68c992bc24cda82c2115301c5ced2faa3c35b0eecc466d0a6464fd3eecca660779570fe06b30ef7cfbc1957020cf1789eae1a237afdda2da587c06327a
-
memory/3128-115-0x0000000000400000-0x00000000021AC000-memory.dmpFilesize
29.7MB
-
memory/3128-114-0x0000000002340000-0x000000000240D000-memory.dmpFilesize
820KB
-
memory/3960-125-0x0000000002620000-0x0000000002621000-memory.dmpFilesize
4KB
-
memory/3960-129-0x00000000056F0000-0x00000000056F1000-memory.dmpFilesize
4KB
-
memory/3960-119-0x00000000005C0000-0x00000000005F0000-memory.dmpFilesize
192KB
-
memory/3960-121-0x0000000002300000-0x000000000231F000-memory.dmpFilesize
124KB
-
memory/3960-122-0x0000000004BA0000-0x0000000004BA1000-memory.dmpFilesize
4KB
-
memory/3960-123-0x0000000002490000-0x00000000024AE000-memory.dmpFilesize
120KB
-
memory/3960-124-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/3960-126-0x0000000002622000-0x0000000002623000-memory.dmpFilesize
4KB
-
memory/3960-116-0x0000000000000000-mapping.dmp
-
memory/3960-127-0x0000000002623000-0x0000000002624000-memory.dmpFilesize
4KB
-
memory/3960-128-0x00000000025F0000-0x00000000025F1000-memory.dmpFilesize
4KB
-
memory/3960-120-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/3960-130-0x0000000005800000-0x0000000005801000-memory.dmpFilesize
4KB
-
memory/3960-131-0x0000000002624000-0x0000000002626000-memory.dmpFilesize
8KB
-
memory/3960-132-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/3960-133-0x0000000006A80000-0x0000000006A81000-memory.dmpFilesize
4KB
-
memory/3960-134-0x0000000006C50000-0x0000000006C51000-memory.dmpFilesize
4KB
-
memory/3960-135-0x0000000007270000-0x0000000007271000-memory.dmpFilesize
4KB
-
memory/3960-136-0x00000000075D0000-0x00000000075D1000-memory.dmpFilesize
4KB
-
memory/3960-137-0x0000000007670000-0x0000000007671000-memory.dmpFilesize
4KB
-
memory/3960-138-0x0000000006030000-0x0000000006031000-memory.dmpFilesize
4KB