Analysis
-
max time kernel
154s -
max time network
173s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
22-10-2021 18:42
Static task
static1
Behavioral task
behavioral1
Sample
03f2f05fd23256e1e87c96107a388aad.exe
Resource
win7-en-20211014
General
-
Target
03f2f05fd23256e1e87c96107a388aad.exe
-
Size
653KB
-
MD5
03f2f05fd23256e1e87c96107a388aad
-
SHA1
5f04ef9eb70f32a0245d9c752193693ffacf57fc
-
SHA256
a01644daf56c53fc12d8757a63d9ccf35929e30d17fe6f1076f6320d2e1115f6
-
SHA512
5e1629fec02855c5a9e464a013bceb004bf46d561323c1fad2672318ce949b8be0399c345d4c71d09bf9073521e38f518517edefc25de259ca2d9f87f9fc9c33
Malware Config
Extracted
redline
22.10
185.215.113.17:7700
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3108-127-0x0000000004D70000-0x0000000004D8C000-memory.dmp family_redline behavioral2/memory/3108-129-0x0000000005020000-0x000000000503A000-memory.dmp family_redline -
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
ipstersh.exepid process 3108 ipstersh.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
03f2f05fd23256e1e87c96107a388aad.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 03f2f05fd23256e1e87c96107a388aad.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 03f2f05fd23256e1e87c96107a388aad.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ipstersh.exepid process 3108 ipstersh.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ipstersh.exedescription pid process Token: SeDebugPrivilege 3108 ipstersh.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
03f2f05fd23256e1e87c96107a388aad.exedescription pid process target process PID 4328 wrote to memory of 3108 4328 03f2f05fd23256e1e87c96107a388aad.exe ipstersh.exe PID 4328 wrote to memory of 3108 4328 03f2f05fd23256e1e87c96107a388aad.exe ipstersh.exe PID 4328 wrote to memory of 3108 4328 03f2f05fd23256e1e87c96107a388aad.exe ipstersh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\03f2f05fd23256e1e87c96107a388aad.exe"C:\Users\Admin\AppData\Local\Temp\03f2f05fd23256e1e87c96107a388aad.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeipstersh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeMD5
c4d5d13ebf7d05776d60caa9f33428af
SHA1385e771216489a904ceda560d2715a760bfa7451
SHA256391fe7f9cb02a497ee846f1637eb01ca6f3586cadc277bf71074906d5c0d4be1
SHA512689a0e819c00be0b3b74c7fd386597274f44b38ac435c0bdc5db8ba5e51b1ea6a20478131f9c4b6ecafcc724509069e854064b8c128d5adfc19028a86097efed
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeMD5
c4d5d13ebf7d05776d60caa9f33428af
SHA1385e771216489a904ceda560d2715a760bfa7451
SHA256391fe7f9cb02a497ee846f1637eb01ca6f3586cadc277bf71074906d5c0d4be1
SHA512689a0e819c00be0b3b74c7fd386597274f44b38ac435c0bdc5db8ba5e51b1ea6a20478131f9c4b6ecafcc724509069e854064b8c128d5adfc19028a86097efed
-
memory/3108-131-0x0000000005072000-0x0000000005073000-memory.dmpFilesize
4KB
-
memory/3108-142-0x0000000008CF0000-0x0000000008CF1000-memory.dmpFilesize
4KB
-
memory/3108-143-0x0000000008EB0000-0x0000000008EB1000-memory.dmpFilesize
4KB
-
memory/3108-125-0x0000000000400000-0x0000000002F1A000-memory.dmpFilesize
43.1MB
-
memory/3108-124-0x0000000002F20000-0x000000000306A000-memory.dmpFilesize
1.3MB
-
memory/3108-126-0x0000000003080000-0x00000000030AF000-memory.dmpFilesize
188KB
-
memory/3108-127-0x0000000004D70000-0x0000000004D8C000-memory.dmpFilesize
112KB
-
memory/3108-128-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/3108-129-0x0000000005020000-0x000000000503A000-memory.dmpFilesize
104KB
-
memory/3108-130-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/3108-144-0x00000000090B0000-0x00000000090B1000-memory.dmpFilesize
4KB
-
memory/3108-121-0x0000000000000000-mapping.dmp
-
memory/3108-135-0x0000000008070000-0x0000000008071000-memory.dmpFilesize
4KB
-
memory/3108-134-0x0000000008040000-0x0000000008041000-memory.dmpFilesize
4KB
-
memory/3108-133-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/3108-136-0x0000000008180000-0x0000000008181000-memory.dmpFilesize
4KB
-
memory/3108-137-0x0000000005074000-0x0000000005076000-memory.dmpFilesize
8KB
-
memory/3108-138-0x0000000008200000-0x0000000008201000-memory.dmpFilesize
4KB
-
memory/3108-139-0x00000000086D0000-0x00000000086D1000-memory.dmpFilesize
4KB
-
memory/3108-140-0x0000000008B70000-0x0000000008B71000-memory.dmpFilesize
4KB
-
memory/3108-141-0x0000000008C00000-0x0000000008C01000-memory.dmpFilesize
4KB
-
memory/3108-132-0x0000000005073000-0x0000000005074000-memory.dmpFilesize
4KB
-
memory/4328-119-0x0000000000D70000-0x0000000000E3F000-memory.dmpFilesize
828KB
-
memory/4328-120-0x0000000000400000-0x00000000008D3000-memory.dmpFilesize
4.8MB