Analysis
-
max time kernel
110s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
30-10-2021 18:36
Static task
static1
Behavioral task
behavioral1
Sample
FL Studia.exe
Resource
win7-en-20211014
General
-
Target
FL Studia.exe
-
Size
1.5MB
-
MD5
865634b3f6cb4d2ac3dafbbd88085511
-
SHA1
5f9882d70100ed1b5fd7281bc6cbb1026591f83e
-
SHA256
3e6ecd9dc9ec4d42be5fdca7c55931fa9f835f3f634ee9f707ed7b1a102e9f7d
-
SHA512
8dff199ebf486bdac97ac760bf557a84e84dff631d57f627ade2bddbe76dd145d5d4014506a5f1944ccd6ba58b309a2c24845adb49e66b7229b28a79d3da7b99
Malware Config
Extracted
redline
H
185.255.133.25:18225
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/4092-120-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/4092-125-0x0000000000418D2A-mapping.dmp family_redline behavioral2/memory/4092-135-0x0000000009090000-0x0000000009696000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 3952 created 992 3952 WerFault.exe FL Studia.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
FL Studia.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FL Studia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FL Studia.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
FL Studia.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FL Studia.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FL Studia.exedescription pid process target process PID 992 set thread context of 4092 992 FL Studia.exe AppLaunch.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3952 992 WerFault.exe FL Studia.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
WerFault.exeAppLaunch.exepid process 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 3952 WerFault.exe 4092 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
WerFault.exeAppLaunch.exedescription pid process Token: SeRestorePrivilege 3952 WerFault.exe Token: SeBackupPrivilege 3952 WerFault.exe Token: SeDebugPrivilege 3952 WerFault.exe Token: SeDebugPrivilege 4092 AppLaunch.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
FL Studia.exedescription pid process target process PID 992 wrote to memory of 4092 992 FL Studia.exe AppLaunch.exe PID 992 wrote to memory of 4092 992 FL Studia.exe AppLaunch.exe PID 992 wrote to memory of 4092 992 FL Studia.exe AppLaunch.exe PID 992 wrote to memory of 4092 992 FL Studia.exe AppLaunch.exe PID 992 wrote to memory of 4092 992 FL Studia.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FL Studia.exe"C:\Users\Admin\AppData\Local\Temp\FL Studia.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 992 -s 4882⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/992-115-0x00000000003E0000-0x0000000000876000-memory.dmpFilesize
4.6MB
-
memory/992-116-0x00000000003E0000-0x0000000000876000-memory.dmpFilesize
4.6MB
-
memory/992-117-0x00000000003E0000-0x0000000000876000-memory.dmpFilesize
4.6MB
-
memory/992-118-0x00000000003E0000-0x0000000000876000-memory.dmpFilesize
4.6MB
-
memory/992-119-0x00000000003E0000-0x0000000000876000-memory.dmpFilesize
4.6MB
-
memory/4092-120-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4092-125-0x0000000000418D2A-mapping.dmp
-
memory/4092-126-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/4092-127-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/4092-128-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/4092-129-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/4092-131-0x00000000096A0000-0x00000000096A1000-memory.dmpFilesize
4KB
-
memory/4092-132-0x0000000009090000-0x0000000009091000-memory.dmpFilesize
4KB
-
memory/4092-133-0x00000000091C0000-0x00000000091C1000-memory.dmpFilesize
4KB
-
memory/4092-134-0x00000000090F0000-0x00000000090F1000-memory.dmpFilesize
4KB
-
memory/4092-135-0x0000000009090000-0x0000000009696000-memory.dmpFilesize
6.0MB
-
memory/4092-136-0x0000000009130000-0x0000000009131000-memory.dmpFilesize
4KB
-
memory/4092-137-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/4092-141-0x000000000A1B0000-0x000000000A1B1000-memory.dmpFilesize
4KB
-
memory/4092-144-0x0000000009490000-0x0000000009491000-memory.dmpFilesize
4KB
-
memory/4092-145-0x000000000A030000-0x000000000A031000-memory.dmpFilesize
4KB
-
memory/4092-146-0x000000000A6B0000-0x000000000A6B1000-memory.dmpFilesize
4KB
-
memory/4092-147-0x000000000A870000-0x000000000A871000-memory.dmpFilesize
4KB
-
memory/4092-160-0x000000000AB10000-0x000000000AB11000-memory.dmpFilesize
4KB
-
memory/4092-161-0x000000000B210000-0x000000000B211000-memory.dmpFilesize
4KB