Analysis
-
max time kernel
118s -
max time network
133s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
24-10-2021 17:22
Static task
static1
Behavioral task
behavioral1
Sample
Top.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
Top.exe
Resource
win10-en-20211014
General
-
Target
Top.exe
-
Size
212KB
-
MD5
96427c202bca1af1acd22256c92cc898
-
SHA1
728fd65a135a31b83138cc7b1e0754b17bb5ee81
-
SHA256
73186a5d3be2fa9711f31dfbac376773f5e05116652ff2d413edea2390670ee5
-
SHA512
9ddd65f6d72b00838189b7e954a91fd182e5d7808aa2927f762945d3991982649ef3d6bc745e22552fdfea02e5afae452e9f03ec86ee63f6fc49875c95d60d56
Malware Config
Extracted
redline
@Top_seller_ak
51.91.193.177:18717
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/816-90-0x0000000000400000-0x000000000041F000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Nonconjugation.exeRuntimeBroker.exepid process 1932 Nonconjugation.exe 1140 RuntimeBroker.exe -
Drops startup file 1 IoCs
Processes:
RuntimeBroker.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\updater.lnk RuntimeBroker.exe -
Loads dropped DLL 4 IoCs
Processes:
regasm.exepid process 816 regasm.exe 816 regasm.exe 816 regasm.exe 816 regasm.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
regasm.exepid process 816 regasm.exe 816 regasm.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Top.exedescription pid process target process PID 604 set thread context of 816 604 Top.exe regasm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
regasm.exepid process 816 regasm.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
Top.exepid process 604 Top.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
regasm.exeRuntimeBroker.exeNonconjugation.exedescription pid process Token: SeDebugPrivilege 816 regasm.exe Token: 35 1140 RuntimeBroker.exe Token: SeDebugPrivilege 1932 Nonconjugation.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Top.exepid process 604 Top.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
Top.exeregasm.exedescription pid process target process PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 604 wrote to memory of 816 604 Top.exe regasm.exe PID 816 wrote to memory of 1932 816 regasm.exe Nonconjugation.exe PID 816 wrote to memory of 1932 816 regasm.exe Nonconjugation.exe PID 816 wrote to memory of 1932 816 regasm.exe Nonconjugation.exe PID 816 wrote to memory of 1932 816 regasm.exe Nonconjugation.exe PID 816 wrote to memory of 1140 816 regasm.exe RuntimeBroker.exe PID 816 wrote to memory of 1140 816 regasm.exe RuntimeBroker.exe PID 816 wrote to memory of 1140 816 regasm.exe RuntimeBroker.exe PID 816 wrote to memory of 1140 816 regasm.exe RuntimeBroker.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Top.exe"C:\Users\Admin\AppData\Local\Temp\Top.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\regasm.exe"2⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Nonconjugation.exe"C:\Users\Admin\AppData\Local\Temp\Nonconjugation.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exe"3⤵
- Executes dropped EXE
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Nonconjugation.exeMD5
d7881860a75e6bb3eab8ac39d030a5f8
SHA1f0819587f1d91f39983dd2a8a425ec4c587f76e3
SHA2563d55a01696666b6b5498ab33c770ba2ab8c5f066a8ac5816b0695e2f84d641c4
SHA512cf6c481f420aaef40b405ff55ff87db942fd1614211ce0ca6ef30253280067759eb3fe9faf12702a60059c24bfa3da97ba148cd449ee70eba5f6902f75576029
-
C:\Users\Admin\AppData\Local\Temp\Nonconjugation.exeMD5
d7881860a75e6bb3eab8ac39d030a5f8
SHA1f0819587f1d91f39983dd2a8a425ec4c587f76e3
SHA2563d55a01696666b6b5498ab33c770ba2ab8c5f066a8ac5816b0695e2f84d641c4
SHA512cf6c481f420aaef40b405ff55ff87db942fd1614211ce0ca6ef30253280067759eb3fe9faf12702a60059c24bfa3da97ba148cd449ee70eba5f6902f75576029
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exeMD5
949ba7b89f4ae521a9e9b8eb37b3e634
SHA148ba8aace3429679cf01a3363b3fec2f1c023e6b
SHA2564aea9f63c01162e271d6a2b1926ab00ae4f523465ebd2ed0feaea089ba95b86f
SHA512bfb8e81f16bdb8c69dfbf518555da9001caf3dee14b874dd8c1c1ed32c0add3177eccf2b32fb4b9f0a3ce190075acff68b0ce1ce27d2965f7f60d22370276b93
-
C:\Users\Admin\AppData\Local\Temp\RuntimeBroker.exeMD5
949ba7b89f4ae521a9e9b8eb37b3e634
SHA148ba8aace3429679cf01a3363b3fec2f1c023e6b
SHA2564aea9f63c01162e271d6a2b1926ab00ae4f523465ebd2ed0feaea089ba95b86f
SHA512bfb8e81f16bdb8c69dfbf518555da9001caf3dee14b874dd8c1c1ed32c0add3177eccf2b32fb4b9f0a3ce190075acff68b0ce1ce27d2965f7f60d22370276b93
-
\Users\Admin\AppData\Local\Temp\Nonconjugation.exeMD5
d7881860a75e6bb3eab8ac39d030a5f8
SHA1f0819587f1d91f39983dd2a8a425ec4c587f76e3
SHA2563d55a01696666b6b5498ab33c770ba2ab8c5f066a8ac5816b0695e2f84d641c4
SHA512cf6c481f420aaef40b405ff55ff87db942fd1614211ce0ca6ef30253280067759eb3fe9faf12702a60059c24bfa3da97ba148cd449ee70eba5f6902f75576029
-
\Users\Admin\AppData\Local\Temp\Nonconjugation.exeMD5
d7881860a75e6bb3eab8ac39d030a5f8
SHA1f0819587f1d91f39983dd2a8a425ec4c587f76e3
SHA2563d55a01696666b6b5498ab33c770ba2ab8c5f066a8ac5816b0695e2f84d641c4
SHA512cf6c481f420aaef40b405ff55ff87db942fd1614211ce0ca6ef30253280067759eb3fe9faf12702a60059c24bfa3da97ba148cd449ee70eba5f6902f75576029
-
\Users\Admin\AppData\Local\Temp\RuntimeBroker.exeMD5
949ba7b89f4ae521a9e9b8eb37b3e634
SHA148ba8aace3429679cf01a3363b3fec2f1c023e6b
SHA2564aea9f63c01162e271d6a2b1926ab00ae4f523465ebd2ed0feaea089ba95b86f
SHA512bfb8e81f16bdb8c69dfbf518555da9001caf3dee14b874dd8c1c1ed32c0add3177eccf2b32fb4b9f0a3ce190075acff68b0ce1ce27d2965f7f60d22370276b93
-
\Users\Admin\AppData\Local\Temp\RuntimeBroker.exeMD5
949ba7b89f4ae521a9e9b8eb37b3e634
SHA148ba8aace3429679cf01a3363b3fec2f1c023e6b
SHA2564aea9f63c01162e271d6a2b1926ab00ae4f523465ebd2ed0feaea089ba95b86f
SHA512bfb8e81f16bdb8c69dfbf518555da9001caf3dee14b874dd8c1c1ed32c0add3177eccf2b32fb4b9f0a3ce190075acff68b0ce1ce27d2965f7f60d22370276b93
-
memory/604-68-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-89-0x00000000002A0000-0x00000000002A2000-memory.dmpFilesize
8KB
-
memory/604-65-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-66-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-67-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-54-0x0000000000230000-0x0000000000236000-memory.dmpFilesize
24KB
-
memory/604-69-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-70-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-71-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-77-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-76-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-75-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-74-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-73-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-72-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-79-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-78-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-80-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-81-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-82-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-83-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/604-55-0x0000000000230000-0x000000000023A000-memory.dmpFilesize
40KB
-
memory/604-56-0x000000000052F000-0x0000000000530000-memory.dmpFilesize
4KB
-
memory/604-64-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-88-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/604-57-0x000000000052F000-0x0000000000530000-memory.dmpFilesize
4KB
-
memory/604-59-0x000000000052F000-0x0000000000530000-memory.dmpFilesize
4KB
-
memory/604-60-0x0000000000541000-0x0000000000546000-memory.dmpFilesize
20KB
-
memory/604-63-0x000000000055C000-0x000000000055E000-memory.dmpFilesize
8KB
-
memory/604-62-0x000000000052F000-0x0000000000530000-memory.dmpFilesize
4KB
-
memory/604-61-0x000000000052A000-0x000000000052B000-memory.dmpFilesize
4KB
-
memory/816-90-0x0000000000400000-0x000000000041F000-memory.dmpFilesize
124KB
-
memory/816-92-0x0000000004A60000-0x0000000004A61000-memory.dmpFilesize
4KB
-
memory/816-84-0x00000000004186AA-mapping.dmp
-
memory/816-85-0x0000000076A81000-0x0000000076A83000-memory.dmpFilesize
8KB
-
memory/816-91-0x0000000000110000-0x0000000000122000-memory.dmpFilesize
72KB
-
memory/1140-102-0x0000000000000000-mapping.dmp
-
memory/1932-95-0x0000000000000000-mapping.dmp
-
memory/1932-98-0x0000000000E90000-0x0000000000E91000-memory.dmpFilesize
4KB
-
memory/1932-105-0x000000001C5C0000-0x000000001C900000-memory.dmpFilesize
3.2MB
-
memory/1932-106-0x000000001BFE0000-0x000000001BFE2000-memory.dmpFilesize
8KB
-
memory/1932-107-0x000000001BFE6000-0x000000001C005000-memory.dmpFilesize
124KB
-
memory/1932-108-0x000000001ADF0000-0x000000001B123000-memory.dmpFilesize
3.2MB
-
memory/1932-109-0x0000000020DC0000-0x000000002102E000-memory.dmpFilesize
2.4MB
-
memory/1932-110-0x000000001C005000-0x000000001C006000-memory.dmpFilesize
4KB