Analysis
- max time kernel
118s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
07/10/2021, 12:08
General
- Target 245cceafa613c14d48cd7465b27ba993.exe
- Size 75KB
- Sample211007-pay1zacehj
- SHA256 059afad6c9d4183c5b32b89465732dc6ea7bf7192c0ed7e9f1dabfe65a17da2e
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Executes dropped EXE 6 IoCs
- Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Themida packer 4 IoCs
Detects Themida, an advanced Windows software protection system.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 9 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\245cceafa613c14d48cd7465b27ba993.exe"C:\Users\Admin\AppData\Local\Temp\245cceafa613c14d48cd7465b27ba993.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\6427960.scr"C:\Users\Admin\AppData\Roaming\6427960.scr" /S2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\3697299.scr"C:\Users\Admin\AppData\Roaming\3697299.scr" /S2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\1970253.scr"C:\Users\Admin\AppData\Roaming\1970253.scr" /S2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\4927640.scr"C:\Users\Admin\AppData\Roaming\4927640.scr" /S2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\7937859.scr"C:\Users\Admin\AppData\Roaming\7937859.scr" /S2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/376-115-0x0000000000A10000-0x0000000000A11000-memory.dmp
memory/376-118-0x000000001B490000-0x000000001B492000-memory.dmp
memory/376-117-0x0000000001230000-0x0000000001231000-memory.dmp
memory/3572-133-0x0000000004D60000-0x0000000004DA9000-memory.dmp
memory/3572-141-0x0000000002CE0000-0x0000000002CE1000-memory.dmp
memory/3572-135-0x0000000002D40000-0x0000000002D41000-memory.dmp
memory/3572-167-0x0000000007EB0000-0x0000000007EB1000-memory.dmp
memory/3572-125-0x0000000000A70000-0x0000000000A71000-memory.dmp
memory/3572-145-0x0000000007BD0000-0x0000000007BD1000-memory.dmp
memory/3572-130-0x0000000002CC0000-0x0000000002CC1000-memory.dmp
memory/3572-139-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/3572-140-0x0000000008100000-0x0000000008101000-memory.dmp
memory/3632-126-0x0000000000210000-0x0000000000211000-memory.dmp
memory/3632-131-0x0000000000BC0000-0x0000000000BCC000-memory.dmp
memory/3632-129-0x0000000000CA0000-0x0000000000CA1000-memory.dmp
memory/3632-132-0x0000000009460000-0x0000000009461000-memory.dmp
memory/3632-134-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/3632-136-0x0000000000C50000-0x0000000000C51000-memory.dmp
memory/4356-159-0x0000000005A00000-0x0000000005A01000-memory.dmp
memory/4356-156-0x0000000005F80000-0x0000000005F81000-memory.dmp
memory/4356-151-0x0000000001280000-0x0000000001281000-memory.dmp
memory/4356-196-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
memory/4356-161-0x0000000005B30000-0x0000000005B31000-memory.dmp
memory/4356-198-0x0000000006EE0000-0x0000000006EE1000-memory.dmp
memory/4356-164-0x0000000077700000-0x000000007788E000-memory.dmp
memory/4356-181-0x0000000005970000-0x0000000005F76000-memory.dmp
memory/4356-172-0x0000000005AA0000-0x0000000005AA1000-memory.dmp
memory/4356-168-0x0000000005A60000-0x0000000005A61000-memory.dmp
memory/4380-166-0x0000000005850000-0x0000000005851000-memory.dmp
memory/4380-160-0x000000000AFF0000-0x000000000AFF1000-memory.dmp
memory/4464-170-0x0000000000F20000-0x0000000000F21000-memory.dmp
memory/4464-175-0x0000000001870000-0x0000000001871000-memory.dmp
memory/4464-179-0x0000000005710000-0x0000000005755000-memory.dmp
memory/4464-182-0x0000000001890000-0x0000000001891000-memory.dmp
memory/4464-184-0x00000000058D0000-0x00000000058D1000-memory.dmp
memory/4516-173-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/4516-183-0x0000000077700000-0x000000007788E000-memory.dmp
memory/4516-187-0x0000000005A80000-0x0000000006086000-memory.dmp