Analysis

  • max time kernel
    117s
  • max time network
    125s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    20-12-2021 17:13

General

  • Target

    0aef3aef127a4f780fc0166e4ed8ebac.exe

  • Size

    549KB

  • MD5

    0aef3aef127a4f780fc0166e4ed8ebac

  • SHA1

    de5e59cd81f17027d811400bc7d48765e1d55df2

  • SHA256

    e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152

  • SHA512

    1cd35a889aebf12b42b43eb83aa8c224e1896045c37b0f08f89b5910ff55e15bcba9e215f97ead7432dc47796263508906287e184ab9f6c602097f7eb93ce5fa

Malware Config

Extracted

Family

redline

Botnet

10

C2

18.191.251.199:45097

Signatures

  • Modifies Windows Defender Real-time Protection settings 3 TTPs
  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 6 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Modifies system certificate store 2 TTPs 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 45 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
    "C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
      C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
      2⤵
        PID:1516
      • C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
        C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
        2⤵
        • Loads dropped DLL
        • Drops file in Windows directory
        • Modifies system certificate store
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:1064
        • C:\Windows\SysWOW64\cmd.exe
          "cmd" /C cmd /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f & reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f & c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRealtimeMonitoring $true" & dism /online /disable-feature /featurename:windows-defender /remove /norestart /quiet
          3⤵
          • Suspicious use of WriteProcessMemory
          PID:1164
          • C:\Windows\SysWOW64\cmd.exe
            cmd /c reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
            4⤵
            • Suspicious use of WriteProcessMemory
            PID:1184
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender" /v DisableAntiSpyware /t REG_DWORD /d 1 /f
              5⤵
                PID:1988
            • C:\Windows\SysWOW64\reg.exe
              reg.exe add "HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows Defender\Real-Time Protection" /v DisableRealtimeMonitoring /t REG_DWORD /d 1 /f
              4⤵
                PID:1220
              • \??\c:\windows\SysWOW64\windowspowershell\v1.0\powershell.exe
                c:\windows\system32\windowspowershell\v1.0\powershell.exe "Set-MpPreference -DisableRealtimeMonitoring $true"
                4⤵
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1868
              • C:\Windows\SysWOW64\Dism.exe
                dism /online /disable-feature /featurename:windows-defender /remove /norestart /quiet
                4⤵
                • Drops file in Windows directory
                PID:1704
            • C:\Windows\Tasks\condition.exe
              "C:\Windows\Tasks\condition.exe"
              3⤵
              • Executes dropped EXE
              • Suspicious use of WriteProcessMemory
              PID:1692
              • C:\Windows\SysWOW64\WerFault.exe
                C:\Windows\SysWOW64\WerFault.exe -u -p 1692 -s 564
                4⤵
                • Loads dropped DLL
                • Program crash
                • Suspicious behavior: EnumeratesProcesses
                • Suspicious use of AdjustPrivilegeToken
                PID:1564

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Persistence

        Modify Existing Service

        1
        T1031

        Defense Evasion

        Modify Registry

        2
        T1112

        Disabling Security Tools

        1
        T1089

        Install Root Certificate

        1
        T1130

        Credential Access

        Credentials in Files

        1
        T1081

        Discovery

        Query Registry

        1
        T1012

        System Information Discovery

        1
        T1082

        Collection

        Data from Local System

        1
        T1005

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • C:\Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • \Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • \Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • \Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • \Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • \Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • \Windows\Tasks\condition.exe
          MD5

          77641a8ced792a27d6e11d69d068ce17

          SHA1

          39153e51fd474b299087f4adba901a0cc064eb11

          SHA256

          bdf924721a28595ab2d233ffbca8cea121194642786a76bfe1cd58f3721ed3b7

          SHA512

          83933db29bb384fd843ae0a25728c17180722c835e9f023dc4a4d7aac2c876851aa098aeb9893561bffd06682814fb1ca0b5359af7e46b19946e2ecfb38a6b2c

        • memory/1064-64-0x0000000000419322-mapping.dmp
        • memory/1064-59-0x0000000000400000-0x0000000000422000-memory.dmp
          Filesize

          136KB

        • memory/1064-67-0x0000000004330000-0x0000000004331000-memory.dmp
          Filesize

          4KB

        • memory/1064-60-0x0000000000400000-0x0000000000422000-memory.dmp
          Filesize

          136KB

        • memory/1064-63-0x0000000000400000-0x0000000000422000-memory.dmp
          Filesize

          136KB

        • memory/1064-65-0x0000000000400000-0x0000000000422000-memory.dmp
          Filesize

          136KB

        • memory/1064-61-0x0000000000400000-0x0000000000422000-memory.dmp
          Filesize

          136KB

        • memory/1064-62-0x0000000000400000-0x0000000000422000-memory.dmp
          Filesize

          136KB

        • memory/1164-68-0x0000000000000000-mapping.dmp
        • memory/1184-69-0x0000000000000000-mapping.dmp
        • memory/1220-71-0x0000000000000000-mapping.dmp
        • memory/1564-84-0x0000000000000000-mapping.dmp
        • memory/1564-91-0x0000000000250000-0x0000000000251000-memory.dmp
          Filesize

          4KB

        • memory/1608-58-0x0000000000230000-0x0000000000231000-memory.dmp
          Filesize

          4KB

        • memory/1608-57-0x00000000047E0000-0x00000000047E1000-memory.dmp
          Filesize

          4KB

        • memory/1608-55-0x0000000000280000-0x0000000000281000-memory.dmp
          Filesize

          4KB

        • memory/1692-79-0x0000000000000000-mapping.dmp
        • memory/1692-82-0x0000000000820000-0x0000000000821000-memory.dmp
          Filesize

          4KB

        • memory/1704-77-0x0000000000000000-mapping.dmp
        • memory/1868-76-0x00000000024D2000-0x00000000024D4000-memory.dmp
          Filesize

          8KB

        • memory/1868-75-0x00000000024D1000-0x00000000024D2000-memory.dmp
          Filesize

          4KB

        • memory/1868-74-0x00000000024D0000-0x00000000024D1000-memory.dmp
          Filesize

          4KB

        • memory/1868-73-0x0000000075AC1000-0x0000000075AC3000-memory.dmp
          Filesize

          8KB

        • memory/1868-72-0x0000000000000000-mapping.dmp
        • memory/1988-70-0x0000000000000000-mapping.dmp