Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
11-11-2021 23:34
Static task
static1
Behavioral task
behavioral1
Sample
InstallerTool.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
InstallerTool.exe
Resource
win10-en-20211104
General
-
Target
InstallerTool.exe
-
Size
1.4MB
-
MD5
963a69f3894ea42c7352337772a2d9d3
-
SHA1
e4da98fad2f4468ce44dab1d1462c8b6c489ead2
-
SHA256
1e718ba10afeffd0173f8a685541c705246cea8a2776765403fb2b948aed4c9f
-
SHA512
04739fecffcf9132048ca0f886b1b8ddd040a6c887bfcfa54a5b7c572afcfc266f0b80cc70c79d540b9bbfe041d74cbd8df4ea75f06f3f6f9b79c322224c0024
Malware Config
Extracted
redline
@whizzkid1
185.215.113.83:60722
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1388-110-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1388-115-0x0000000000418F16-mapping.dmp family_redline behavioral1/memory/1388-116-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/1388-117-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
InstallerTool.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion InstallerTool.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion InstallerTool.exe -
Processes:
InstallerTool.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA InstallerTool.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
InstallerTool.exedescription pid process target process PID 744 set thread context of 1388 744 InstallerTool.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
AppLaunch.exepid process 1388 AppLaunch.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
AppLaunch.exedescription pid process Token: SeDebugPrivilege 1388 AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
InstallerTool.exedescription pid process target process PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe PID 744 wrote to memory of 1388 744 InstallerTool.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\InstallerTool.exe"C:\Users\Admin\AppData\Local\Temp\InstallerTool.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/744-55-0x0000000076A21000-0x0000000076A23000-memory.dmpFilesize
8KB
-
memory/744-56-0x0000000000400000-0x00000000007B7000-memory.dmpFilesize
3.7MB
-
memory/744-57-0x0000000000400000-0x00000000007B7000-memory.dmpFilesize
3.7MB
-
memory/744-58-0x0000000000400000-0x00000000007B7000-memory.dmpFilesize
3.7MB
-
memory/744-59-0x00000000002D0000-0x0000000000330000-memory.dmpFilesize
384KB
-
memory/744-60-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/744-63-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/744-64-0x0000000002750000-0x0000000002751000-memory.dmpFilesize
4KB
-
memory/744-65-0x0000000002740000-0x0000000002741000-memory.dmpFilesize
4KB
-
memory/744-66-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/744-70-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-74-0x0000000000950000-0x0000000000951000-memory.dmpFilesize
4KB
-
memory/744-76-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/744-79-0x0000000000BB0000-0x0000000000BB1000-memory.dmpFilesize
4KB
-
memory/744-82-0x00000000026B0000-0x00000000026B1000-memory.dmpFilesize
4KB
-
memory/744-85-0x00000000026E0000-0x00000000026E1000-memory.dmpFilesize
4KB
-
memory/744-88-0x0000000002700000-0x0000000002701000-memory.dmpFilesize
4KB
-
memory/744-90-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-92-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-95-0x0000000002810000-0x0000000002811000-memory.dmpFilesize
4KB
-
memory/744-97-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/744-99-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/744-104-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/744-107-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/744-106-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/744-105-0x0000000000BC0000-0x0000000000BC1000-memory.dmpFilesize
4KB
-
memory/744-103-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/744-102-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/744-108-0x0000000000400000-0x00000000007B7000-memory.dmpFilesize
3.7MB
-
memory/744-101-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/744-100-0x00000000027F0000-0x00000000027F1000-memory.dmpFilesize
4KB
-
memory/744-98-0x0000000002840000-0x0000000002841000-memory.dmpFilesize
4KB
-
memory/744-96-0x0000000002820000-0x0000000002821000-memory.dmpFilesize
4KB
-
memory/744-94-0x00000000003B0000-0x00000000003B1000-memory.dmpFilesize
4KB
-
memory/744-93-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-91-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-89-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-87-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/744-86-0x00000000026A0000-0x00000000026A1000-memory.dmpFilesize
4KB
-
memory/744-84-0x0000000002670000-0x0000000002671000-memory.dmpFilesize
4KB
-
memory/744-83-0x00000000026C0000-0x00000000026C1000-memory.dmpFilesize
4KB
-
memory/744-81-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-80-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-78-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/744-77-0x00000000003E0000-0x00000000003E1000-memory.dmpFilesize
4KB
-
memory/744-75-0x0000000000960000-0x0000000000961000-memory.dmpFilesize
4KB
-
memory/744-73-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-72-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-71-0x0000000003440000-0x0000000003441000-memory.dmpFilesize
4KB
-
memory/744-69-0x0000000003450000-0x0000000003451000-memory.dmpFilesize
4KB
-
memory/744-68-0x0000000000400000-0x00000000007B7000-memory.dmpFilesize
3.7MB
-
memory/744-67-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/744-62-0x0000000002720000-0x0000000002721000-memory.dmpFilesize
4KB
-
memory/744-61-0x0000000002770000-0x0000000002771000-memory.dmpFilesize
4KB
-
memory/1388-109-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1388-110-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1388-115-0x0000000000418F16-mapping.dmp
-
memory/1388-116-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1388-117-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/1388-119-0x0000000000400000-0x0000000000401000-memory.dmpFilesize
4KB
-
memory/1388-121-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB