Analysis
-
max time kernel
88s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 13:36
Static task
static1
Behavioral task
behavioral1
Sample
fedf404b97ebf25a2df2b7456bbdd974.exe
Resource
win7-en-20210920
General
-
Target
fedf404b97ebf25a2df2b7456bbdd974.exe
-
Size
1.1MB
-
MD5
fedf404b97ebf25a2df2b7456bbdd974
-
SHA1
744eade13828533e7f0fa5c91cd963e88b205402
-
SHA256
24694773eae47324f59b1521fd5303b3742db8a88e177516ef91f14933e3182f
-
SHA512
2d103236ed2b104bbe30fa390cfa7658bec4bf83c459723f46f4d2a4eb33c423727818a9ea6804f1eda2badb9f373b3a7eed4dc7255868446bbd109a8c799832
Malware Config
Extracted
redline
MEW
185.215.113.107:61144
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3212-142-0x0000000002320000-0x0000000002340000-memory.dmp family_redline behavioral2/memory/3212-147-0x0000000002380000-0x000000000239E000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
KR0923403904322FT.exepgamer.exepgamer.exepid process 2004 KR0923403904322FT.exe 3132 pgamer.exe 3212 pgamer.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
pgamer.exedescription pid process target process PID 3132 set thread context of 3212 3132 pgamer.exe pgamer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 5 IoCs
Processes:
timeout.exetimeout.exetimeout.exetimeout.exetimeout.exepid process 600 timeout.exe 2944 timeout.exe 2932 timeout.exe 64 timeout.exe 1604 timeout.exe -
Kills process with taskkill 2 IoCs
Processes:
taskkill.exetaskkill.exepid process 3632 taskkill.exe 1956 taskkill.exe -
Modifies registry class 2 IoCs
Processes:
fedf404b97ebf25a2df2b7456bbdd974.execmd.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings fedf404b97ebf25a2df2b7456bbdd974.exe Key created \REGISTRY\USER\S-1-5-21-941723256-3451054534-3089625102-1000_Classes\Local Settings cmd.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskkill.exetaskkill.exepgamer.exedescription pid process Token: SeDebugPrivilege 3632 taskkill.exe Token: SeDebugPrivilege 1956 taskkill.exe Token: SeDebugPrivilege 3212 pgamer.exe -
Suspicious use of WriteProcessMemory 50 IoCs
Processes:
fedf404b97ebf25a2df2b7456bbdd974.exeWScript.execmd.exeWScript.execmd.exepgamer.exedescription pid process target process PID 1656 wrote to memory of 4088 1656 fedf404b97ebf25a2df2b7456bbdd974.exe WScript.exe PID 1656 wrote to memory of 4088 1656 fedf404b97ebf25a2df2b7456bbdd974.exe WScript.exe PID 1656 wrote to memory of 4088 1656 fedf404b97ebf25a2df2b7456bbdd974.exe WScript.exe PID 4088 wrote to memory of 3060 4088 WScript.exe cmd.exe PID 4088 wrote to memory of 3060 4088 WScript.exe cmd.exe PID 4088 wrote to memory of 3060 4088 WScript.exe cmd.exe PID 3060 wrote to memory of 600 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 600 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 600 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2004 3060 cmd.exe KR0923403904322FT.exe PID 3060 wrote to memory of 2004 3060 cmd.exe KR0923403904322FT.exe PID 3060 wrote to memory of 2004 3060 cmd.exe KR0923403904322FT.exe PID 3060 wrote to memory of 2944 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2944 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2944 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 652 3060 cmd.exe WScript.exe PID 3060 wrote to memory of 652 3060 cmd.exe WScript.exe PID 3060 wrote to memory of 652 3060 cmd.exe WScript.exe PID 3060 wrote to memory of 2932 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2932 3060 cmd.exe timeout.exe PID 3060 wrote to memory of 2932 3060 cmd.exe timeout.exe PID 652 wrote to memory of 1480 652 WScript.exe cmd.exe PID 652 wrote to memory of 1480 652 WScript.exe cmd.exe PID 652 wrote to memory of 1480 652 WScript.exe cmd.exe PID 1480 wrote to memory of 372 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 372 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 372 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 64 1480 cmd.exe timeout.exe PID 1480 wrote to memory of 64 1480 cmd.exe timeout.exe PID 1480 wrote to memory of 64 1480 cmd.exe timeout.exe PID 1480 wrote to memory of 3132 1480 cmd.exe pgamer.exe PID 1480 wrote to memory of 3132 1480 cmd.exe pgamer.exe PID 1480 wrote to memory of 3132 1480 cmd.exe pgamer.exe PID 3132 wrote to memory of 3212 3132 pgamer.exe pgamer.exe PID 3132 wrote to memory of 3212 3132 pgamer.exe pgamer.exe PID 3132 wrote to memory of 3212 3132 pgamer.exe pgamer.exe PID 3132 wrote to memory of 3212 3132 pgamer.exe pgamer.exe PID 3132 wrote to memory of 3212 3132 pgamer.exe pgamer.exe PID 1480 wrote to memory of 3632 1480 cmd.exe taskkill.exe PID 1480 wrote to memory of 3632 1480 cmd.exe taskkill.exe PID 1480 wrote to memory of 3632 1480 cmd.exe taskkill.exe PID 1480 wrote to memory of 1956 1480 cmd.exe taskkill.exe PID 1480 wrote to memory of 1956 1480 cmd.exe taskkill.exe PID 1480 wrote to memory of 1956 1480 cmd.exe taskkill.exe PID 1480 wrote to memory of 2328 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 2328 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 2328 1480 cmd.exe attrib.exe PID 1480 wrote to memory of 1604 1480 cmd.exe timeout.exe PID 1480 wrote to memory of 1604 1480 cmd.exe timeout.exe PID 1480 wrote to memory of 1604 1480 cmd.exe timeout.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2328 attrib.exe 372 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fedf404b97ebf25a2df2b7456bbdd974.exe"C:\Users\Admin\AppData\Local\Temp\fedf404b97ebf25a2df2b7456bbdd974.exe"1⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1656 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\RKL4099023598809324\ok.vbs" /f=CREATE_NO_WINDOW install.cmd2⤵
- Suspicious use of WriteProcessMemory
PID:4088 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\RKL4099023598809324\un.bat" "3⤵
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3060 -
C:\Windows\SysWOW64\timeout.exetimeout 74⤵
- Delays execution with timeout.exe
PID:600 -
C:\RKL4099023598809324\KR0923403904322FT.exe"KR0923403904322FT.exe" e -pZXCupcontrolfolders 1qw.rar4⤵
- Executes dropped EXE
PID:2004 -
C:\Windows\SysWOW64\timeout.exetimeout 64⤵
- Delays execution with timeout.exe
PID:2944 -
C:\Windows\SysWOW64\WScript.exe"C:\Windows\System32\WScript.exe" "C:\RKL4099023598809324\hjkd.vbs"4⤵
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\RKL4099023598809324\S456.bat" "5⤵
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Windows\SysWOW64\attrib.exeattrib +s +h "C:\RKL4099023598809324"6⤵
- Views/modifies file attributes
PID:372 -
C:\Windows\SysWOW64\timeout.exetimeout 26⤵
- Delays execution with timeout.exe
PID:64 -
C:\RKL4099023598809324\pgamer.exepgamer.exe /start6⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3132 -
C:\RKL4099023598809324\pgamer.exepgamer.exe /start7⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:3212 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KR0923403904322FT.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3632 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im KR0923403904322FT.exe6⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1956 -
C:\Windows\SysWOW64\attrib.exeattrib -s -h "C:\RKL4099023598809324"6⤵
- Views/modifies file attributes
PID:2328 -
C:\Windows\SysWOW64\timeout.exetimeout 46⤵
- Delays execution with timeout.exe
PID:1604 -
C:\Windows\SysWOW64\timeout.exetimeout 84⤵
- Delays execution with timeout.exe
PID:2932
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\RKL4099023598809324\1.icoMD5
5fb78309efe6ffeee40c6d8a7e6ff210
SHA1a918bd0706bb2a90d15727d6869ffdae84f50549
SHA256eaf298f9e7b495b8ee19f5595f496d4522c4b027b283acf9df5ac8ceeb182bee
SHA512588268cbdd30681a5889064520e354cbda17485b771ad3ff5b2779f22effbede19110b600de2d2f3e341865f3963182f919a02b3d2f4759866e247f1ab8c7278
-
C:\RKL4099023598809324\KR0923403904322FT.exeMD5
061f64173293969577916832be29b90d
SHA1b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA25634dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA51266e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da
-
C:\RKL4099023598809324\KR0923403904322FT.exeMD5
061f64173293969577916832be29b90d
SHA1b05b80385de20463a80b6c9c39bd1d53123aab9b
SHA25634dfe4869b0a524c63cc4696fafe30c83a22dc5fe4b994b9fe777f2c986733ce
SHA51266e284f7c7e40af988ab09ff48cc786d287ac906368042d98d313be764058f01ecb5c3a7ab8d4336ee6494ea4a1347e73f0f2b4f3baec25ca6bcec1d888bd3da
-
C:\RKL4099023598809324\S456.batMD5
a97bfce282d0c9561d28f176775da6d3
SHA1c4a793e54d7e62698b61a975fb1efa692255b494
SHA256d44244a910c829dfe199f7a15f8ecbe4fb9d9dc250b27e10d9dcc726c3354daa
SHA512e4e3cce9341276c1fa470a9287c12b9b157e37a30f0adc0cd492be12a775cb373dc7fab5bb394eef02b5d83d177f42d3086bb2390a733bb4619cc816959b46d4
-
C:\RKL4099023598809324\hjkd.vbsMD5
f10cc4a30d203a0c9fc627a212fdb068
SHA14ef14c8fa3f6ea6be1f7b391564283a769a561e4
SHA2566dac725bf03e356a205a78edae3209d79cbeea8ba66d9c900f45dd6058ba25ff
SHA51222347e966e0863ba5189341d20cf8cc61187b835bcc01664a83ea07cdadf10192bc70de81371686ca39757e7a9e8f329272b320d0049877c02e796bddddba366
-
C:\RKL4099023598809324\ok.vbsMD5
9b4ac8d30f8ee1e3270a598ff8cfdee0
SHA12cb027f9f8fe6a038f70ae15bea6fbc2e851906f
SHA2562cbd5c56dd3b8d0b9822bfbf09f3fb1205d4ac22e66515eef12df04b3c99f090
SHA512c359f5c14290799781a955b186b17a99392c77bff78c9db711ad17c836325444242c5baeb6fe9a233bf64ab14ea9dc3e93f71b7a881de8bd8bc06435b05da2d6
-
C:\RKL4099023598809324\pgamer.exeMD5
93c8f50bce4c6ce5e9d481531a917eeb
SHA12ca174d68fab060ee9eb40001d559d98ececc977
SHA2565c7ee0567655c92ec02ecbcb880ddb4b5d9095c23578965121e7359b9c378e52
SHA512ec968f9030ed6ba332b0bb5d3216fc42905748ce73b2e6899c23a909a3e359f0028547d0a6f8a9ca8cd2943e729a6d236a1740d9170c896c8caf26efde2782b0
-
C:\RKL4099023598809324\pgamer.exeMD5
93c8f50bce4c6ce5e9d481531a917eeb
SHA12ca174d68fab060ee9eb40001d559d98ececc977
SHA2565c7ee0567655c92ec02ecbcb880ddb4b5d9095c23578965121e7359b9c378e52
SHA512ec968f9030ed6ba332b0bb5d3216fc42905748ce73b2e6899c23a909a3e359f0028547d0a6f8a9ca8cd2943e729a6d236a1740d9170c896c8caf26efde2782b0
-
C:\RKL4099023598809324\pgamer.exeMD5
93c8f50bce4c6ce5e9d481531a917eeb
SHA12ca174d68fab060ee9eb40001d559d98ececc977
SHA2565c7ee0567655c92ec02ecbcb880ddb4b5d9095c23578965121e7359b9c378e52
SHA512ec968f9030ed6ba332b0bb5d3216fc42905748ce73b2e6899c23a909a3e359f0028547d0a6f8a9ca8cd2943e729a6d236a1740d9170c896c8caf26efde2782b0
-
C:\RKL4099023598809324\un.batMD5
1b639b021bbd10f13f38e1c2b027996f
SHA14f788ac98a4d1d018115a5568f9685c3ab5e86dd
SHA2568070a0ecd7110a3b7cd2a1f03e24873e77bcb50a25e54223ce2b419d556b7404
SHA512ef1d17e1a4f8a8d38ac558a9f25ddc7bac8ba74a3019770716a9209e4365a763ad6ec77dd81899db0a99b7bb40761ae47aad88ed555301f419f61ac06e48481a
-
memory/64-130-0x0000000000000000-mapping.dmp
-
memory/372-129-0x0000000000000000-mapping.dmp
-
memory/600-119-0x0000000000000000-mapping.dmp
-
memory/652-125-0x0000000000000000-mapping.dmp
-
memory/1480-128-0x0000000000000000-mapping.dmp
-
memory/1604-141-0x0000000000000000-mapping.dmp
-
memory/1956-138-0x0000000000000000-mapping.dmp
-
memory/2004-121-0x0000000000000000-mapping.dmp
-
memory/2328-139-0x0000000000000000-mapping.dmp
-
memory/2932-126-0x0000000000000000-mapping.dmp
-
memory/2944-123-0x0000000000000000-mapping.dmp
-
memory/3060-118-0x0000000000000000-mapping.dmp
-
memory/3132-131-0x0000000000000000-mapping.dmp
-
memory/3212-148-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3212-149-0x00000000049C0000-0x00000000049C1000-memory.dmpFilesize
4KB
-
memory/3212-140-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3212-135-0x000000000040CD2F-mapping.dmp
-
memory/3212-142-0x0000000002320000-0x0000000002340000-memory.dmpFilesize
128KB
-
memory/3212-143-0x0000000004AA0000-0x0000000004AA1000-memory.dmpFilesize
4KB
-
memory/3212-145-0x0000000004A92000-0x0000000004A93000-memory.dmpFilesize
4KB
-
memory/3212-144-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/3212-146-0x0000000004A93000-0x0000000004A94000-memory.dmpFilesize
4KB
-
memory/3212-147-0x0000000002380000-0x000000000239E000-memory.dmpFilesize
120KB
-
memory/3212-160-0x0000000006B40000-0x0000000006B41000-memory.dmpFilesize
4KB
-
memory/3212-159-0x0000000006A90000-0x0000000006A91000-memory.dmpFilesize
4KB
-
memory/3212-150-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/3212-151-0x0000000004A94000-0x0000000004A96000-memory.dmpFilesize
8KB
-
memory/3212-152-0x00000000049F0000-0x00000000049F1000-memory.dmpFilesize
4KB
-
memory/3212-153-0x00000000056C0000-0x00000000056C1000-memory.dmpFilesize
4KB
-
memory/3212-134-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3212-155-0x00000000061C0000-0x00000000061C1000-memory.dmpFilesize
4KB
-
memory/3212-156-0x0000000006490000-0x0000000006491000-memory.dmpFilesize
4KB
-
memory/3212-157-0x0000000006810000-0x0000000006811000-memory.dmpFilesize
4KB
-
memory/3212-158-0x0000000006890000-0x0000000006891000-memory.dmpFilesize
4KB
-
memory/3632-137-0x0000000000000000-mapping.dmp
-
memory/4088-115-0x0000000000000000-mapping.dmp