Analysis
-
max time kernel
150s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en -
submitted
15-09-2021 06:48
Static task
static1
Behavioral task
behavioral1
Sample
8f6c7a779aad2fcebfde67b679378445.exe
Resource
win7-en
General
-
Target
8f6c7a779aad2fcebfde67b679378445.exe
-
Size
3.8MB
-
MD5
8f6c7a779aad2fcebfde67b679378445
-
SHA1
c2861843b930684f3c15b779e1027ffffe96bcc7
-
SHA256
7feb71e0bcd24d21e20f423434b4c9971c174c9e1aafedab36e2ecab1ff3a5bf
-
SHA512
cbc525092ac6ec65b64944a1708ff102d2019acbf10ad3739a99cd8bb4892f601535028304e957b10fbae19f2d96d9c2f416cc6c79051d4efe651bc03f78fc34
Malware Config
Extracted
redline
Orix1
92.222.145.236:60837
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1836-56-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/1836-57-0x000000000041C636-mapping.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
598714267.exeruntimeservice.exesihost32.exepid process 1648 598714267.exe 1400 runtimeservice.exe 2004 sihost32.exe -
Loads dropped DLL 3 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exepid process 1836 8f6c7a779aad2fcebfde67b679378445.exe 1648 598714267.exe 1400 runtimeservice.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exedescription pid process target process PID 1984 set thread context of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exepid process 1836 8f6c7a779aad2fcebfde67b679378445.exe 1836 8f6c7a779aad2fcebfde67b679378445.exe 1648 598714267.exe 1400 runtimeservice.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exedescription pid process Token: SeDebugPrivilege 1984 8f6c7a779aad2fcebfde67b679378445.exe Token: SeDebugPrivilege 1836 8f6c7a779aad2fcebfde67b679378445.exe Token: SeDebugPrivilege 1648 598714267.exe Token: SeDebugPrivilege 1400 runtimeservice.exe -
Suspicious use of WriteProcessMemory 35 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.execmd.exeruntimeservice.execmd.exedescription pid process target process PID 1984 wrote to memory of 1652 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1652 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1652 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1652 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1984 wrote to memory of 1836 1984 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 1836 wrote to memory of 1648 1836 8f6c7a779aad2fcebfde67b679378445.exe 598714267.exe PID 1836 wrote to memory of 1648 1836 8f6c7a779aad2fcebfde67b679378445.exe 598714267.exe PID 1836 wrote to memory of 1648 1836 8f6c7a779aad2fcebfde67b679378445.exe 598714267.exe PID 1836 wrote to memory of 1648 1836 8f6c7a779aad2fcebfde67b679378445.exe 598714267.exe PID 1648 wrote to memory of 1044 1648 598714267.exe cmd.exe PID 1648 wrote to memory of 1044 1648 598714267.exe cmd.exe PID 1648 wrote to memory of 1044 1648 598714267.exe cmd.exe PID 1044 wrote to memory of 1872 1044 cmd.exe schtasks.exe PID 1044 wrote to memory of 1872 1044 cmd.exe schtasks.exe PID 1044 wrote to memory of 1872 1044 cmd.exe schtasks.exe PID 1648 wrote to memory of 1400 1648 598714267.exe runtimeservice.exe PID 1648 wrote to memory of 1400 1648 598714267.exe runtimeservice.exe PID 1648 wrote to memory of 1400 1648 598714267.exe runtimeservice.exe PID 1400 wrote to memory of 1824 1400 runtimeservice.exe cmd.exe PID 1400 wrote to memory of 1824 1400 runtimeservice.exe cmd.exe PID 1400 wrote to memory of 1824 1400 runtimeservice.exe cmd.exe PID 1824 wrote to memory of 700 1824 cmd.exe schtasks.exe PID 1824 wrote to memory of 700 1824 cmd.exe schtasks.exe PID 1824 wrote to memory of 700 1824 cmd.exe schtasks.exe PID 1400 wrote to memory of 2004 1400 runtimeservice.exe sihost32.exe PID 1400 wrote to memory of 2004 1400 runtimeservice.exe sihost32.exe PID 1400 wrote to memory of 2004 1400 runtimeservice.exe sihost32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\598714267.exe"C:\Users\Admin\AppData\Local\Temp\598714267.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"'5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\runtimeservice.exe"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"'6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\598714267.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
C:\Users\Admin\AppData\Local\Temp\598714267.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
dbd399ad19db67986885ae73860583a1
SHA10981d845da6a8cde0913d08cdcdcacaced6d7141
SHA256b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9
SHA512b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
dbd399ad19db67986885ae73860583a1
SHA10981d845da6a8cde0913d08cdcdcacaced6d7141
SHA256b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9
SHA512b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134
-
C:\Users\Admin\AppData\Roaming\runtimeservice.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
C:\Users\Admin\AppData\Roaming\runtimeservice.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
\Users\Admin\AppData\Local\Temp\598714267.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
dbd399ad19db67986885ae73860583a1
SHA10981d845da6a8cde0913d08cdcdcacaced6d7141
SHA256b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9
SHA512b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134
-
\Users\Admin\AppData\Roaming\runtimeservice.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
memory/700-81-0x0000000000000000-mapping.dmp
-
memory/1044-69-0x0000000000000000-mapping.dmp
-
memory/1400-79-0x0000000000930000-0x0000000000932000-memory.dmpFilesize
8KB
-
memory/1400-73-0x0000000000000000-mapping.dmp
-
memory/1400-76-0x000000013FC10000-0x000000013FC11000-memory.dmpFilesize
4KB
-
memory/1648-63-0x0000000000000000-mapping.dmp
-
memory/1648-66-0x000000013FF80000-0x000000013FF81000-memory.dmpFilesize
4KB
-
memory/1648-68-0x00000000007D0000-0x00000000007D6000-memory.dmpFilesize
24KB
-
memory/1648-71-0x0000000002540000-0x0000000002542000-memory.dmpFilesize
8KB
-
memory/1824-80-0x0000000000000000-mapping.dmp
-
memory/1836-61-0x0000000004C40000-0x0000000004C41000-memory.dmpFilesize
4KB
-
memory/1836-59-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1836-57-0x000000000041C636-mapping.dmp
-
memory/1836-56-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/1872-70-0x0000000000000000-mapping.dmp
-
memory/1984-52-0x0000000000A40000-0x0000000000A41000-memory.dmpFilesize
4KB
-
memory/1984-58-0x0000000000590000-0x0000000000593000-memory.dmpFilesize
12KB
-
memory/1984-55-0x0000000004EC0000-0x0000000004ED8000-memory.dmpFilesize
96KB
-
memory/1984-54-0x0000000005065000-0x0000000005076000-memory.dmpFilesize
68KB
-
memory/1984-53-0x0000000005060000-0x0000000005061000-memory.dmpFilesize
4KB
-
memory/2004-83-0x0000000000000000-mapping.dmp
-
memory/2004-86-0x000000013F280000-0x000000013F281000-memory.dmpFilesize
4KB
-
memory/2004-88-0x00000000021C0000-0x00000000021C2000-memory.dmpFilesize
8KB