Analysis
- max time kernel
121s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
10/11/2021, 08:54
General
- Target INSTALLER_Robot_V_7.8.9.exe
- Size 1.8MB
- Sample211110-ktw89sdggj
- SHA256 487435d01fc04eba8555aab50d83ef39195f810786da6df4eebb4b88623aba2d
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\INSTALLER_Robot_V_7.8.9.exe"C:\Users\Admin\AppData\Local\Temp\INSTALLER_Robot_V_7.8.9.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2592 -s 5762⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2208-171-0x00000000001B0000-0x00000000001EC000-memory.dmp
memory/2208-209-0x000000000B430000-0x000000000B431000-memory.dmp
memory/2208-208-0x000000000A620000-0x000000000A621000-memory.dmp
memory/2208-197-0x0000000009C90000-0x0000000009C91000-memory.dmp
memory/2208-196-0x0000000009F50000-0x0000000009F51000-memory.dmp
memory/2208-195-0x00000000099B0000-0x00000000099B1000-memory.dmp
memory/2208-194-0x0000000009890000-0x0000000009891000-memory.dmp
memory/2208-193-0x0000000008D00000-0x0000000008D01000-memory.dmp
memory/2208-189-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2208-188-0x0000000008A70000-0x0000000008A71000-memory.dmp
memory/2208-187-0x00000000089C0000-0x00000000089C1000-memory.dmp
memory/2208-186-0x0000000008A60000-0x0000000008A61000-memory.dmp
memory/2208-185-0x0000000008B80000-0x0000000008B81000-memory.dmp
memory/2208-184-0x0000000008960000-0x0000000008961000-memory.dmp
memory/2208-183-0x0000000009080000-0x0000000009081000-memory.dmp
memory/2208-182-0x00000000062A0000-0x00000000062A1000-memory.dmp
memory/2208-180-0x00000000001B0000-0x00000000001B1000-memory.dmp
memory/2208-179-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2208-178-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2208-177-0x0000000000100000-0x0000000000101000-memory.dmp
memory/2592-136-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/2592-168-0x0000000002900000-0x0000000002901000-memory.dmp
memory/2592-140-0x0000000002870000-0x0000000002871000-memory.dmp
memory/2592-142-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/2592-144-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-143-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-145-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/2592-147-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/2592-157-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2592-158-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/2592-159-0x0000000002B80000-0x0000000002B81000-memory.dmp
memory/2592-156-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-153-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-152-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-151-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/2592-150-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/2592-160-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/2592-161-0x0000000002BA0000-0x0000000002BA1000-memory.dmp
memory/2592-162-0x0000000002B60000-0x0000000002B61000-memory.dmp
memory/2592-149-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/2592-164-0x0000000002BC0000-0x0000000002BC1000-memory.dmp
memory/2592-163-0x0000000002B50000-0x0000000002B51000-memory.dmp
memory/2592-165-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2592-166-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2592-169-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2592-167-0x0000000002BB0000-0x0000000002BB1000-memory.dmp
memory/2592-148-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/2592-138-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/2592-170-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2592-155-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-154-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-146-0x0000000002A10000-0x0000000002A11000-memory.dmp
memory/2592-141-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/2592-139-0x0000000002850000-0x0000000002851000-memory.dmp
memory/2592-137-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/2592-119-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/2592-134-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-135-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/2592-133-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-132-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-131-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/2592-130-0x00000000037A0000-0x00000000037A1000-memory.dmp
memory/2592-129-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/2592-128-0x00000000037B0000-0x00000000037B1000-memory.dmp
memory/2592-126-0x0000000002AE0000-0x0000000002AE1000-memory.dmp
memory/2592-127-0x0000000000400000-0x00000000008F7000-memory.dmp
memory/2592-124-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/2592-125-0x0000000002B10000-0x0000000002B11000-memory.dmp
memory/2592-123-0x0000000002AB0000-0x0000000002AB1000-memory.dmp
memory/2592-122-0x0000000002AF0000-0x0000000002AF1000-memory.dmp
memory/2592-120-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/2592-121-0x0000000002A80000-0x0000000002A81000-memory.dmp
memory/2592-118-0x00000000026C0000-0x0000000002720000-memory.dmp