Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
29-11-2021 19:17
Static task
static1
Behavioral task
behavioral1
Sample
9877b157ae0bcd3feb87ccfef4253491.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
9877b157ae0bcd3feb87ccfef4253491.exe
Resource
win10-en-20211104
General
-
Target
9877b157ae0bcd3feb87ccfef4253491.exe
-
Size
396KB
-
MD5
9877b157ae0bcd3feb87ccfef4253491
-
SHA1
a003d7ced4aa5ea3001439b6e2cd8ae9c96d1703
-
SHA256
d18d56376c20fdc8504567c79055654278da9bfbea33aef2159af126247c5ced
-
SHA512
2067a09d2be11bb006cc6a2c4a509e1ded3491c06fab8a81d3d3eb67420fba1fca4853d819eec1d4fad9d2553c66c87217a2ddb3e270476ee3f9e375132215bd
Malware Config
Extracted
redline
185.191.215.179:29003
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 5 IoCs
Processes:
resource yara_rule behavioral1/memory/2036-75-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2036-76-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2036-77-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/2036-78-0x0000000000418EEA-mapping.dmp family_redline behavioral1/memory/2036-79-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
9877b157ae0bcd3feb87ccfef4253491.exedescription pid process target process PID 1284 set thread context of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Processes:
9877b157ae0bcd3feb87ccfef4253491.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25 9877b157ae0bcd3feb87ccfef4253491.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 0f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a8090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703085300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc30b00000001000000120000004400690067006900430065007200740000001d00000001000000100000008f76b981d528ad4770088245e2031b630300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc252000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 9877b157ae0bcd3feb87ccfef4253491.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\5FB7EE0633E259DBAD0C4C9AE6D38F1A61C7DC25\Blob = 190000000100000010000000ba4f3972e7aed9dccdc210db59da13c90300000001000000140000005fb7ee0633e259dbad0c4c9ae6d38f1a61c7dc251d00000001000000100000008f76b981d528ad4770088245e2031b630b0000000100000012000000440069006700690043006500720074000000140000000100000014000000b13ec36903f8bf4701d498261a0802ef63642bc35300000001000000230000003021301f06096086480186fd6c020130123010060a2b0601040182373c0101030200c0090000000100000034000000303206082b0601050507030106082b0601050507030206082b0601050507030406082b0601050507030306082b060105050703080f0000000100000014000000e35ef08d884f0a0ade2f75e96301ce6230f213a82000000001000000c9030000308203c5308202ada003020102021002ac5c266a0b409b8f0b79f2ae462577300d06092a864886f70d0101050500306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f74204341301e170d3036313131303030303030305a170d3331313131303030303030305a306c310b300906035504061302555331153013060355040a130c446967694365727420496e6331193017060355040b13107777772e64696769636572742e636f6d312b30290603550403132244696769436572742048696768204173737572616e636520455620526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100c6cce573e6fbd4bbe52d2d32a6dfe5813fc9cd2549b6712ac3d5943467a20a1cb05f69a640b1c4b7b28fd098a4a941593ad3dc94d63cdb7438a44acc4d2582f74aa5531238eef3496d71917e63b6aba65fc3a484f84f6251bef8c5ecdb3892e306e508910cc4284155fbcb5a89157e71e835bf4d72093dbe3a38505b77311b8db3c724459aa7ac6d00145a04b7ba13eb510a984141224e656187814150a6795c89de194a57d52ee65d1c532c7e98cd1a0616a46873d03404135ca171d35a7c55db5e64e13787305604e511b4298012f1793988a202117c2766b788b778f2ca0aa838ab0a64c2bf665d9584c1a1251e875d1a500b2012cc41bb6e0b5138b84bcb0203010001a3633061300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff301d0603551d0e04160414b13ec36903f8bf4701d498261a0802ef63642bc3301f0603551d23041830168014b13ec36903f8bf4701d498261a0802ef63642bc3300d06092a864886f70d010105050003820101001c1a0697dcd79c9f3c886606085721db2147f82a67aabf183276401057c18af37ad911658e35fa9efc45b59ed94c314bb891e8432c8eb378cedbe3537971d6e5219401da55879a2464f68a66ccde9c37cda834b1699b23c89e78222b7043e35547316119ef58c5852f4e30f6a0311623c8e7e2651633cbbf1a1ba03df8ca5e8b318b6008892d0c065c52b7c4f90a98d1155f9f12be7c366338bd44a47fe4262b0ac497690de98ce2c01057b8c876129155f24869d8bc2a025b0f44d42031dbf4ba70265d90609ebc4b17092fb4cb1e4368c90727c1d25cf7ea21b968129c3c9cbf9efc805c9b63cdec47aa252767a037f300827d54d7a9f8e92e13a377e81f4a 9877b157ae0bcd3feb87ccfef4253491.exe -
Runs ping.exe 1 TTPs 6 IoCs
Processes:
PING.EXEPING.EXEPING.EXEPING.EXEPING.EXEPING.EXEpid process 296 PING.EXE 1056 PING.EXE 1156 PING.EXE 792 PING.EXE 832 PING.EXE 1104 PING.EXE -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
9877b157ae0bcd3feb87ccfef4253491.exe9877b157ae0bcd3feb87ccfef4253491.exepid process 1284 9877b157ae0bcd3feb87ccfef4253491.exe 1284 9877b157ae0bcd3feb87ccfef4253491.exe 2036 9877b157ae0bcd3feb87ccfef4253491.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
9877b157ae0bcd3feb87ccfef4253491.exe9877b157ae0bcd3feb87ccfef4253491.exedescription pid process Token: SeDebugPrivilege 1284 9877b157ae0bcd3feb87ccfef4253491.exe Token: SeDebugPrivilege 2036 9877b157ae0bcd3feb87ccfef4253491.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
9877b157ae0bcd3feb87ccfef4253491.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 1284 wrote to memory of 1632 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1632 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1632 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1632 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1632 wrote to memory of 792 1632 cmd.exe PING.EXE PID 1632 wrote to memory of 792 1632 cmd.exe PING.EXE PID 1632 wrote to memory of 792 1632 cmd.exe PING.EXE PID 1632 wrote to memory of 792 1632 cmd.exe PING.EXE PID 1284 wrote to memory of 1820 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1820 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1820 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1820 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1820 wrote to memory of 832 1820 cmd.exe PING.EXE PID 1820 wrote to memory of 832 1820 cmd.exe PING.EXE PID 1820 wrote to memory of 832 1820 cmd.exe PING.EXE PID 1820 wrote to memory of 832 1820 cmd.exe PING.EXE PID 1284 wrote to memory of 1868 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1868 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1868 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1868 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1868 wrote to memory of 1104 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 1104 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 1104 1868 cmd.exe PING.EXE PID 1868 wrote to memory of 1104 1868 cmd.exe PING.EXE PID 1284 wrote to memory of 1144 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1144 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1144 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1144 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1144 wrote to memory of 296 1144 cmd.exe PING.EXE PID 1144 wrote to memory of 296 1144 cmd.exe PING.EXE PID 1144 wrote to memory of 296 1144 cmd.exe PING.EXE PID 1144 wrote to memory of 296 1144 cmd.exe PING.EXE PID 1284 wrote to memory of 1876 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1876 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1876 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 1876 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1876 wrote to memory of 1056 1876 cmd.exe PING.EXE PID 1876 wrote to memory of 1056 1876 cmd.exe PING.EXE PID 1876 wrote to memory of 1056 1876 cmd.exe PING.EXE PID 1876 wrote to memory of 1056 1876 cmd.exe PING.EXE PID 1284 wrote to memory of 860 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 860 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 860 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 1284 wrote to memory of 860 1284 9877b157ae0bcd3feb87ccfef4253491.exe cmd.exe PID 860 wrote to memory of 1156 860 cmd.exe PING.EXE PID 860 wrote to memory of 1156 860 cmd.exe PING.EXE PID 860 wrote to memory of 1156 860 cmd.exe PING.EXE PID 860 wrote to memory of 1156 860 cmd.exe PING.EXE PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe PID 1284 wrote to memory of 2036 1284 9877b157ae0bcd3feb87ccfef4253491.exe 9877b157ae0bcd3feb87ccfef4253491.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9877b157ae0bcd3feb87ccfef4253491.exe"C:\Users\Admin\AppData\Local\Temp\9877b157ae0bcd3feb87ccfef4253491.exe"1⤵
- Suspicious use of SetThreadContext
- Modifies system certificate store
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping youtube.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping youtube.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping facebook.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping facebook.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping youtube.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping youtube.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping facebook.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping facebook.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping youtube.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping youtube.com3⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping facebook.com2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping facebook.com3⤵
- Runs ping.exe
-
C:\Users\Admin\AppData\Local\Temp\9877b157ae0bcd3feb87ccfef4253491.exeC:\Users\Admin\AppData\Local\Temp\9877b157ae0bcd3feb87ccfef4253491.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/296-65-0x0000000000000000-mapping.dmp
-
memory/792-59-0x0000000000000000-mapping.dmp
-
memory/832-61-0x0000000000000000-mapping.dmp
-
memory/860-68-0x0000000000000000-mapping.dmp
-
memory/1056-67-0x0000000000000000-mapping.dmp
-
memory/1104-63-0x0000000000000000-mapping.dmp
-
memory/1144-64-0x0000000000000000-mapping.dmp
-
memory/1156-69-0x0000000000000000-mapping.dmp
-
memory/1284-55-0x0000000000CE0000-0x0000000000CE1000-memory.dmpFilesize
4KB
-
memory/1284-57-0x0000000075971000-0x0000000075973000-memory.dmpFilesize
8KB
-
memory/1284-72-0x0000000004A10000-0x0000000004A28000-memory.dmpFilesize
96KB
-
memory/1284-71-0x0000000004810000-0x000000000485A000-memory.dmpFilesize
296KB
-
memory/1284-70-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/1632-58-0x0000000000000000-mapping.dmp
-
memory/1820-60-0x0000000000000000-mapping.dmp
-
memory/1868-62-0x0000000000000000-mapping.dmp
-
memory/1876-66-0x0000000000000000-mapping.dmp
-
memory/2036-73-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-74-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-75-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-76-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-77-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-78-0x0000000000418EEA-mapping.dmp
-
memory/2036-79-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2036-81-0x0000000004B80000-0x0000000004B81000-memory.dmpFilesize
4KB