Analysis
-
max time kernel
129s -
max time network
114s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
15-09-2021 06:48
Static task
static1
Behavioral task
behavioral1
Sample
8f6c7a779aad2fcebfde67b679378445.exe
Resource
win7-en
General
-
Target
8f6c7a779aad2fcebfde67b679378445.exe
-
Size
3.8MB
-
MD5
8f6c7a779aad2fcebfde67b679378445
-
SHA1
c2861843b930684f3c15b779e1027ffffe96bcc7
-
SHA256
7feb71e0bcd24d21e20f423434b4c9971c174c9e1aafedab36e2ecab1ff3a5bf
-
SHA512
cbc525092ac6ec65b64944a1708ff102d2019acbf10ad3739a99cd8bb4892f601535028304e957b10fbae19f2d96d9c2f416cc6c79051d4efe651bc03f78fc34
Malware Config
Extracted
redline
Orix1
92.222.145.236:60837
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4884-123-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral2/memory/4884-124-0x000000000041C636-mapping.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
598714267.exeruntimeservice.exesihost32.exepid process 3392 598714267.exe 2776 runtimeservice.exe 4332 sihost32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exedescription pid process target process PID 4796 set thread context of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5008 4796 WerFault.exe 8f6c7a779aad2fcebfde67b679378445.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 2568 schtasks.exe 4488 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 18 IoCs
Processes:
WerFault.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exepid process 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 5008 WerFault.exe 4884 8f6c7a779aad2fcebfde67b679378445.exe 4884 8f6c7a779aad2fcebfde67b679378445.exe 3392 598714267.exe 2776 runtimeservice.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exeWerFault.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.exeruntimeservice.exedescription pid process Token: SeDebugPrivilege 4796 8f6c7a779aad2fcebfde67b679378445.exe Token: SeRestorePrivilege 5008 WerFault.exe Token: SeBackupPrivilege 5008 WerFault.exe Token: SeDebugPrivilege 5008 WerFault.exe Token: SeDebugPrivilege 4884 8f6c7a779aad2fcebfde67b679378445.exe Token: SeDebugPrivilege 3392 598714267.exe Token: SeDebugPrivilege 2776 runtimeservice.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
8f6c7a779aad2fcebfde67b679378445.exe8f6c7a779aad2fcebfde67b679378445.exe598714267.execmd.exeruntimeservice.execmd.exedescription pid process target process PID 4796 wrote to memory of 4876 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4876 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4876 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4796 wrote to memory of 4884 4796 8f6c7a779aad2fcebfde67b679378445.exe 8f6c7a779aad2fcebfde67b679378445.exe PID 4884 wrote to memory of 3392 4884 8f6c7a779aad2fcebfde67b679378445.exe 598714267.exe PID 4884 wrote to memory of 3392 4884 8f6c7a779aad2fcebfde67b679378445.exe 598714267.exe PID 3392 wrote to memory of 2292 3392 598714267.exe cmd.exe PID 3392 wrote to memory of 2292 3392 598714267.exe cmd.exe PID 2292 wrote to memory of 2568 2292 cmd.exe schtasks.exe PID 2292 wrote to memory of 2568 2292 cmd.exe schtasks.exe PID 3392 wrote to memory of 2776 3392 598714267.exe runtimeservice.exe PID 3392 wrote to memory of 2776 3392 598714267.exe runtimeservice.exe PID 2776 wrote to memory of 3980 2776 runtimeservice.exe cmd.exe PID 2776 wrote to memory of 3980 2776 runtimeservice.exe cmd.exe PID 3980 wrote to memory of 4488 3980 cmd.exe schtasks.exe PID 3980 wrote to memory of 4488 3980 cmd.exe schtasks.exe PID 2776 wrote to memory of 4332 2776 runtimeservice.exe sihost32.exe PID 2776 wrote to memory of 4332 2776 runtimeservice.exe sihost32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"C:\Users\Admin\AppData\Local\Temp\8f6c7a779aad2fcebfde67b679378445.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\598714267.exe"C:\Users\Admin\AppData\Local\Temp\598714267.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"' & exit4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"'5⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\runtimeservice.exe"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"' & exit5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn "runtimeservice" /tr '"C:\Users\Admin\AppData\Roaming\runtimeservice.exe"'6⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"5⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4796 -s 12962⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\598714267.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
C:\Users\Admin\AppData\Local\Temp\598714267.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
dbd399ad19db67986885ae73860583a1
SHA10981d845da6a8cde0913d08cdcdcacaced6d7141
SHA256b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9
SHA512b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134
-
C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exeMD5
dbd399ad19db67986885ae73860583a1
SHA10981d845da6a8cde0913d08cdcdcacaced6d7141
SHA256b4563d2f26a78c16789c86d4aeff3a038832b6af46947fc5e79e51f0bce717f9
SHA512b3198db63958dbad486df7aa067c44b839d8af833f41b08b396ac5f728726428462b25452b82e5cb2500e046e0f7d81dc994808935eabae40ee2ac5d3e068134
-
C:\Users\Admin\AppData\Roaming\runtimeservice.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
C:\Users\Admin\AppData\Roaming\runtimeservice.exeMD5
c4ab556b6a1dd537cc1942204fdfd6cd
SHA191c8f1c171c1710f78a53ab119959e15549c3931
SHA256fb07a088ddf5bab17add34ddbdd3d4d15ebff15412cadc4c6cea801244801a79
SHA512997ad56739814b047ddfe53739660d3a0cc1b6cc3fe813c709048fc8a3af2b8b31a04cd3bfe8716626f96b065aa983176706b28a2da937fda45dcbc43e106a0f
-
memory/2292-150-0x0000000000000000-mapping.dmp
-
memory/2568-151-0x0000000000000000-mapping.dmp
-
memory/2776-152-0x0000000000000000-mapping.dmp
-
memory/2776-166-0x000000001C070000-0x000000001C072000-memory.dmpFilesize
8KB
-
memory/3392-149-0x000000001C720000-0x000000001C722000-memory.dmpFilesize
8KB
-
memory/3392-142-0x0000000000000000-mapping.dmp
-
memory/3392-148-0x0000000001970000-0x0000000001971000-memory.dmpFilesize
4KB
-
memory/3392-147-0x0000000001530000-0x0000000001536000-memory.dmpFilesize
24KB
-
memory/3392-145-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/3980-159-0x0000000000000000-mapping.dmp
-
memory/4332-164-0x0000000000B70000-0x0000000000B71000-memory.dmpFilesize
4KB
-
memory/4332-167-0x0000000001470000-0x0000000001472000-memory.dmpFilesize
8KB
-
memory/4332-161-0x0000000000000000-mapping.dmp
-
memory/4488-160-0x0000000000000000-mapping.dmp
-
memory/4796-125-0x000000000C450000-0x000000000C453000-memory.dmpFilesize
12KB
-
memory/4796-114-0x0000000000F10000-0x0000000000F11000-memory.dmpFilesize
4KB
-
memory/4796-115-0x0000000005CB0000-0x0000000005CB1000-memory.dmpFilesize
4KB
-
memory/4796-116-0x0000000006250000-0x0000000006251000-memory.dmpFilesize
4KB
-
memory/4796-117-0x0000000005D50000-0x0000000005D51000-memory.dmpFilesize
4KB
-
memory/4796-118-0x0000000005D50000-0x000000000624E000-memory.dmpFilesize
5.0MB
-
memory/4796-119-0x0000000005C30000-0x0000000005C31000-memory.dmpFilesize
4KB
-
memory/4796-120-0x0000000005F60000-0x0000000005F61000-memory.dmpFilesize
4KB
-
memory/4796-121-0x0000000005D50000-0x000000000624E000-memory.dmpFilesize
5.0MB
-
memory/4796-122-0x000000000C410000-0x000000000C428000-memory.dmpFilesize
96KB
-
memory/4884-135-0x0000000005120000-0x000000000561E000-memory.dmpFilesize
5.0MB
-
memory/4884-133-0x0000000005EF0000-0x0000000005EF1000-memory.dmpFilesize
4KB
-
memory/4884-130-0x0000000006130000-0x0000000006131000-memory.dmpFilesize
4KB
-
memory/4884-126-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/4884-132-0x0000000005FC0000-0x0000000005FC1000-memory.dmpFilesize
4KB
-
memory/4884-124-0x000000000041C636-mapping.dmp
-
memory/4884-123-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/4884-131-0x0000000005530000-0x0000000005531000-memory.dmpFilesize
4KB
-
memory/4884-134-0x0000000005F50000-0x0000000005F51000-memory.dmpFilesize
4KB
-
memory/4884-138-0x00000000084D0000-0x00000000084D1000-memory.dmpFilesize
4KB
-
memory/4884-136-0x0000000008580000-0x0000000008581000-memory.dmpFilesize
4KB
-
memory/4884-137-0x0000000008C80000-0x0000000008C81000-memory.dmpFilesize
4KB
-
memory/4884-141-0x0000000008C10000-0x0000000008C11000-memory.dmpFilesize
4KB
-
memory/4884-140-0x0000000008A50000-0x0000000008A51000-memory.dmpFilesize
4KB
-
memory/4884-139-0x0000000008890000-0x0000000008891000-memory.dmpFilesize
4KB