Analysis
-
max time kernel
121s -
max time network
121s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
30-10-2021 18:47
Static task
static1
Behavioral task
behavioral1
Sample
FL Studia.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
General
-
Target
FL Studia.exe
-
Size
1.5MB
-
MD5
865634b3f6cb4d2ac3dafbbd88085511
-
SHA1
5f9882d70100ed1b5fd7281bc6cbb1026591f83e
-
SHA256
3e6ecd9dc9ec4d42be5fdca7c55931fa9f835f3f634ee9f707ed7b1a102e9f7d
-
SHA512
8dff199ebf486bdac97ac760bf557a84e84dff631d57f627ade2bddbe76dd145d5d4014506a5f1944ccd6ba58b309a2c24845adb49e66b7229b28a79d3da7b99
Malware Config
Extracted
Family
redline
Botnet
H
C2
185.255.133.25:18225
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/260-62-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/260-67-0x0000000000418D2A-mapping.dmp family_redline behavioral1/memory/260-68-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/260-69-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
FL Studia.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion FL Studia.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion FL Studia.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Processes:
FL Studia.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA FL Studia.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
FL Studia.exedescription pid process target process PID 856 set thread context of 260 856 FL Studia.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 260 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 260 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
FL Studia.exedescription pid process target process PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe PID 856 wrote to memory of 260 856 FL Studia.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FL Studia.exe"C:\Users\Admin\AppData\Local\Temp\FL Studia.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/260-68-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/260-61-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/260-62-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/260-67-0x0000000000418D2A-mapping.dmp
-
memory/260-69-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/260-71-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/260-73-0x0000000000F20000-0x0000000000F21000-memory.dmpFilesize
4KB
-
memory/856-56-0x00000000013A0000-0x0000000001836000-memory.dmpFilesize
4.6MB
-
memory/856-57-0x00000000013A0000-0x0000000001836000-memory.dmpFilesize
4.6MB
-
memory/856-58-0x00000000013A0000-0x0000000001836000-memory.dmpFilesize
4.6MB
-
memory/856-60-0x00000000013A0000-0x0000000001836000-memory.dmpFilesize
4.6MB
-
memory/856-59-0x00000000013A0000-0x0000000001836000-memory.dmpFilesize
4.6MB
-
memory/856-55-0x0000000074A41000-0x0000000074A43000-memory.dmpFilesize
8KB