Analysis
- max time kernel
103s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
10/11/2021, 18:35
General
- Target 7dfb2f23de7ab9bb70929798cc42cbfb.exe
- Size 504KB
- Sample211110-w8etbafbam
- SHA256 fe3d7939166e8e6ae965d66d98f6ee5583e535b575ba194aef038c6c1ea15ae4
Malware Config
Extracted
-
redline
-
95.181.152.14:46927
Extracted
-
redline
-
xxluchxx1
-
212.86.102.63:62907
Extracted
-
raccoon
-
1.8.3-hotfix
-
34b5c357572382155552cb40207e952f9f95264b
-
url4cnc
http://91.219.236.162/baldandbankrupt1
http://185.163.47.176/baldandbankrupt1
http://193.38.54.238/baldandbankrupt1
http://74.119.192.122/baldandbankrupt1
http://91.219.236.240/baldandbankrupt1
https://t.me/baldandbankrupt1
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 29 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dfb2f23de7ab9bb70929798cc42cbfb.exe"C:\Users\Admin\AppData\Local\Temp\7dfb2f23de7ab9bb70929798cc42cbfb.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\asfasf.exe"C:\Users\Admin\AppData\Roaming\asfasf.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Memo.exe"C:\Users\Admin\AppData\Roaming\Memo.exe"3⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 3124⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1536 -s 6684⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1176-132-0x00000000001C0000-0x00000000001C1000-memory.dmp
memory/1176-139-0x0000000004A40000-0x0000000004A41000-memory.dmp
memory/1176-143-0x0000000004A30000-0x0000000004A31000-memory.dmp
memory/1176-141-0x0000000004A80000-0x0000000004A81000-memory.dmp
memory/1492-117-0x0000000002FD0000-0x0000000002FD2000-memory.dmp
memory/1492-118-0x000000001D1F0000-0x000000001D1F1000-memory.dmp
memory/1492-119-0x000000001BE00000-0x000000001BE01000-memory.dmp
memory/1492-115-0x0000000000F10000-0x0000000000F11000-memory.dmp
memory/1536-170-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-179-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1536-203-0x0000000003680000-0x0000000003681000-memory.dmp
memory/1536-206-0x0000000003610000-0x0000000003611000-memory.dmp
memory/1536-202-0x0000000003630000-0x0000000003631000-memory.dmp
memory/1536-205-0x0000000003620000-0x0000000003621000-memory.dmp
memory/1536-204-0x0000000003670000-0x0000000003671000-memory.dmp
memory/1536-200-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1536-146-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/1536-147-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1536-148-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1536-145-0x0000000000600000-0x000000000074A000-memory.dmp
memory/1536-150-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/1536-149-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/1536-151-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/1536-152-0x0000000002910000-0x0000000002911000-memory.dmp
memory/1536-153-0x0000000002900000-0x0000000002901000-memory.dmp
memory/1536-154-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/1536-155-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-157-0x0000000003720000-0x00000000037B1000-memory.dmp
memory/1536-156-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-159-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-163-0x00000000007E0000-0x00000000007E1000-memory.dmp
memory/1536-161-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-164-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/1536-166-0x0000000000790000-0x0000000000791000-memory.dmp
memory/1536-167-0x00000000007D0000-0x00000000007D1000-memory.dmp
memory/1536-169-0x0000000000800000-0x0000000000801000-memory.dmp
memory/1536-168-0x00000000007B0000-0x00000000007B1000-memory.dmp
memory/1536-171-0x00000000036C0000-0x00000000036C1000-memory.dmp
memory/1536-173-0x0000000002840000-0x0000000002841000-memory.dmp
memory/1536-172-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-175-0x0000000000A50000-0x0000000000A51000-memory.dmp
memory/1536-174-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/1536-177-0x0000000002820000-0x0000000002821000-memory.dmp
memory/1536-176-0x0000000002810000-0x0000000002811000-memory.dmp
memory/1536-201-0x0000000003640000-0x0000000003641000-memory.dmp
memory/1536-178-0x0000000002830000-0x0000000002831000-memory.dmp
memory/1536-181-0x0000000003690000-0x0000000003691000-memory.dmp
memory/1536-180-0x00000000035C0000-0x00000000035C1000-memory.dmp
memory/1536-184-0x0000000003690000-0x0000000003691000-memory.dmp
memory/1536-182-0x0000000003690000-0x0000000003691000-memory.dmp
memory/1536-183-0x0000000003690000-0x0000000003691000-memory.dmp
memory/1536-186-0x0000000003690000-0x0000000003691000-memory.dmp
memory/1536-185-0x0000000003690000-0x0000000003691000-memory.dmp
memory/1536-188-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/1536-187-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1536-190-0x0000000002960000-0x0000000002961000-memory.dmp
memory/1536-189-0x0000000002970000-0x0000000002971000-memory.dmp
memory/1536-192-0x0000000002990000-0x0000000002991000-memory.dmp
memory/1536-191-0x0000000002980000-0x0000000002981000-memory.dmp
memory/1536-193-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/1536-194-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/1536-197-0x0000000002950000-0x0000000002951000-memory.dmp
memory/1536-195-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1536-196-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1536-199-0x0000000000760000-0x0000000000761000-memory.dmp
memory/1536-198-0x0000000000820000-0x0000000000821000-memory.dmp
memory/4020-134-0x00000000060A0000-0x00000000060A1000-memory.dmp
memory/4020-212-0x00000000070B0000-0x00000000070B1000-memory.dmp
memory/4020-122-0x0000000000570000-0x0000000000590000-memory.dmp
memory/4020-124-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/4020-138-0x0000000005BA0000-0x0000000005BA1000-memory.dmp
memory/4020-136-0x0000000005700000-0x0000000005701000-memory.dmp
memory/4020-208-0x0000000005E50000-0x0000000005E51000-memory.dmp
memory/4020-125-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
memory/4020-209-0x0000000006BB0000-0x0000000006BB1000-memory.dmp
memory/4020-210-0x0000000005CB0000-0x0000000005CB1000-memory.dmp
memory/4020-211-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/4020-207-0x0000000005D30000-0x0000000005D31000-memory.dmp
memory/4020-213-0x00000000077B0000-0x00000000077B1000-memory.dmp