8f6c7a779aad2fcebfde67b679378445

General
Target

8f6c7a779aad2fcebfde67b679378445.exe

Filesize

3MB

Completed

15-09-2021 06:50

Score
10 /10
MD5

8f6c7a779aad2fcebfde67b679378445

SHA1

c2861843b930684f3c15b779e1027ffffe96bcc7

SHA256

7feb71e0bcd24d21e20f423434b4c9971c174c9e1aafedab36e2ecab1ff3a5bf

Malware Config

Extracted

Family redline
Botnet Orix1
C2

92.222.145.236:60837

Signatures 15

Filter: none

Collection
Credential Access
Defense Evasion
Discovery
Persistence
  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral2/memory/4884-123-0x0000000000400000-0x0000000000422000-memory.dmpfamily_redline
    behavioral2/memory/4884-124-0x000000000041C636-mapping.dmpfamily_redline
  • Downloads MZ/PE file
  • Executes dropped EXE
    598714267.exeruntimeservice.exesihost32.exe

    Reported IOCs

    pidprocess
    3392598714267.exe
    2776runtimeservice.exe
    4332sihost32.exe
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Legitimate hosting services abused for malware hosting/C2

    TTPs

    Web Service
  • Suspicious use of SetThreadContext
    8f6c7a779aad2fcebfde67b679378445.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4796 set thread context of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
  • Enumerates physical storage devices

    Description

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

    TTPs

    System Information Discovery
  • Program crash
    WerFault.exe

    Reported IOCs

    pidpid_targetprocesstarget process
    50084796WerFault.exe8f6c7a779aad2fcebfde67b679378445.exe
  • Creates scheduled task(s)
    schtasks.exeschtasks.exe

    Description

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    TTPs

    Scheduled Task

    Reported IOCs

    pidprocess
    2568schtasks.exe
    4488schtasks.exe
  • Suspicious behavior: EnumeratesProcesses
    WerFault.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exe

    Reported IOCs

    pidprocess
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    5008WerFault.exe
    48848f6c7a779aad2fcebfde67b679378445.exe
    48848f6c7a779aad2fcebfde67b679378445.exe
    3392598714267.exe
    2776runtimeservice.exe
  • Suspicious use of AdjustPrivilegeToken
    8f6c7a779aad2fcebfde67b679378445.exeWerFault.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege47968f6c7a779aad2fcebfde67b679378445.exe
    Token: SeRestorePrivilege5008WerFault.exe
    Token: SeBackupPrivilege5008WerFault.exe
    Token: SeDebugPrivilege5008WerFault.exe
    Token: SeDebugPrivilege48848f6c7a779aad2fcebfde67b679378445.exe
    Token: SeDebugPrivilege3392598714267.exe
    Token: SeDebugPrivilege2776runtimeservice.exe
  • Suspicious use of WriteProcessMemory
    8f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.execmd.exeruntimeservice.execmd.exe

    Reported IOCs

    descriptionpidprocesstarget process
    PID 4796 wrote to memory of 487647968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 487647968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 487647968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4796 wrote to memory of 488447968f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe
    PID 4884 wrote to memory of 339248848f6c7a779aad2fcebfde67b679378445.exe598714267.exe
    PID 4884 wrote to memory of 339248848f6c7a779aad2fcebfde67b679378445.exe598714267.exe
    PID 3392 wrote to memory of 22923392598714267.execmd.exe
    PID 3392 wrote to memory of 22923392598714267.execmd.exe
    PID 2292 wrote to memory of 25682292cmd.exeschtasks.exe
    PID 2292 wrote to memory of 25682292cmd.exeschtasks.exe
    PID 3392 wrote to memory of 27763392598714267.exeruntimeservice.exe
    PID 3392 wrote to memory of 27763392598714267.exeruntimeservice.exe
    PID 2776 wrote to memory of 39802776runtimeservice.execmd.exe
    PID 2776 wrote to memory of 39802776runtimeservice.execmd.exe
    PID 3980 wrote to memory of 44883980cmd.exeschtasks.exe
    PID 3980 wrote to memory of 44883980cmd.exeschtasks.exe
    PID 2776 wrote to memory of 43322776runtimeservice.exesihost32.exe
    PID 2776 wrote to memory of 43322776runtimeservice.exesihost32.exe
Processes 11
  • C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe
    "C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:4796
    • C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe
      "C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"
      PID:4876
    • C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe
      "C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:4884
      • C:\Users\Admin\AppData\Local\Temp\598714267.exe
        "C:\Users\Admin\AppData\Local\Temp\598714267.exe"
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        PID:3392
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"' & exit
          Suspicious use of WriteProcessMemory
          PID:2292
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"'
            Creates scheduled task(s)
            PID:2568
        • C:\Users\Admin\AppData\Roaming\runtimeservice.exe
          "C:\Users\Admin\AppData\Roaming\runtimeservice.exe"
          Executes dropped EXE
          Suspicious behavior: EnumeratesProcesses
          Suspicious use of AdjustPrivilegeToken
          Suspicious use of WriteProcessMemory
          PID:2776
          • C:\Windows\System32\cmd.exe
            "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"' & exit
            Suspicious use of WriteProcessMemory
            PID:3980
            • C:\Windows\system32\schtasks.exe
              schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"'
              Creates scheduled task(s)
              PID:4488
          • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
            "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
            Executes dropped EXE
            PID:4332
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 1296
      Program crash
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:5008
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
    Execution
      Exfiltration
        Impact
          Initial Access
            Lateral Movement
              Persistence
              Privilege Escalation
                Replay Monitor
                00:00 00:00
                Downloads
                • C:\Users\Admin\AppData\Local\Temp\598714267.exe

                  MD5

                  c4ab556b6a1dd537cc1942204fdfd6cd

                  SHA1

                  91c8f1c171c1710f78a53ab119959e15549c3931

                  SHA256

                  fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79

                  SHA512

                  997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f

                • C:\Users\Admin\AppData\Local\Temp\598714267.exe

                  MD5

                  c4ab556b6a1dd537cc1942204fdfd6cd

                  SHA1

                  91c8f1c171c1710f78a53ab119959e15549c3931

                  SHA256

                  fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79

                  SHA512

                  997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f

                • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe

                  MD5

                  dbd399ad19db67986885ae73860583a1

                  SHA1

                  0981d845da6a8cde0913d08cdcdcacaced6d7141

                  SHA256

                  b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9

                  SHA512

                  b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134

                • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe

                  MD5

                  dbd399ad19db67986885ae73860583a1

                  SHA1

                  0981d845da6a8cde0913d08cdcdcacaced6d7141

                  SHA256

                  b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9

                  SHA512

                  b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134

                • C:\Users\Admin\AppData\Roaming\runtimeservice.exe

                  MD5

                  c4ab556b6a1dd537cc1942204fdfd6cd

                  SHA1

                  91c8f1c171c1710f78a53ab119959e15549c3931

                  SHA256

                  fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79

                  SHA512

                  997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f

                • C:\Users\Admin\AppData\Roaming\runtimeservice.exe

                  MD5

                  c4ab556b6a1dd537cc1942204fdfd6cd

                  SHA1

                  91c8f1c171c1710f78a53ab119959e15549c3931

                  SHA256

                  fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79

                  SHA512

                  997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f

                • memory/2292-150-0x0000000000000000-mapping.dmp

                • memory/2568-151-0x0000000000000000-mapping.dmp

                • memory/2776-152-0x0000000000000000-mapping.dmp

                • memory/2776-166-0x000000001C070000-0x000000001C072000-memory.dmp

                • memory/3392-149-0x000000001C720000-0x000000001C722000-memory.dmp

                • memory/3392-148-0x0000000001970000-0x0000000001971000-memory.dmp

                • memory/3392-142-0x0000000000000000-mapping.dmp

                • memory/3392-147-0x0000000001530000-0x0000000001536000-memory.dmp

                • memory/3392-145-0x0000000000BB0000-0x0000000000BB1000-memory.dmp

                • memory/3980-159-0x0000000000000000-mapping.dmp

                • memory/4332-161-0x0000000000000000-mapping.dmp

                • memory/4332-164-0x0000000000B70000-0x0000000000B71000-memory.dmp

                • memory/4332-167-0x0000000001470000-0x0000000001472000-memory.dmp

                • memory/4488-160-0x0000000000000000-mapping.dmp

                • memory/4796-121-0x0000000005D50000-0x000000000624E000-memory.dmp

                • memory/4796-122-0x000000000C410000-0x000000000C428000-memory.dmp

                • memory/4796-120-0x0000000005F60000-0x0000000005F61000-memory.dmp

                • memory/4796-119-0x0000000005C30000-0x0000000005C31000-memory.dmp

                • memory/4796-118-0x0000000005D50000-0x000000000624E000-memory.dmp

                • memory/4796-117-0x0000000005D50000-0x0000000005D51000-memory.dmp

                • memory/4796-116-0x0000000006250000-0x0000000006251000-memory.dmp

                • memory/4796-115-0x0000000005CB0000-0x0000000005CB1000-memory.dmp

                • memory/4796-125-0x000000000C450000-0x000000000C453000-memory.dmp

                • memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmp

                • memory/4884-139-0x0000000008890000-0x0000000008891000-memory.dmp

                • memory/4884-141-0x0000000008C10000-0x0000000008C11000-memory.dmp

                • memory/4884-140-0x0000000008A50000-0x0000000008A51000-memory.dmp

                • memory/4884-138-0x00000000084D0000-0x00000000084D1000-memory.dmp

                • memory/4884-137-0x0000000008C80000-0x0000000008C81000-memory.dmp

                • memory/4884-136-0x0000000008580000-0x0000000008581000-memory.dmp

                • memory/4884-135-0x0000000005120000-0x000000000561E000-memory.dmp

                • memory/4884-133-0x0000000005EF0000-0x0000000005EF1000-memory.dmp

                • memory/4884-132-0x0000000005FC0000-0x0000000005FC1000-memory.dmp

                • memory/4884-131-0x0000000005530000-0x0000000005531000-memory.dmp

                • memory/4884-130-0x0000000006130000-0x0000000006131000-memory.dmp

                • memory/4884-126-0x0000000000400000-0x0000000000401000-memory.dmp

                • memory/4884-124-0x000000000041C636-mapping.dmp

                • memory/4884-123-0x0000000000400000-0x0000000000422000-memory.dmp

                • memory/4884-134-0x0000000005F50000-0x0000000005F51000-memory.dmp