Analysis

  • max time kernel
    143s
  • max time network
    146s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    23-12-2021 08:52

General

  • Target

    93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd.exe

  • Size

    691KB

  • MD5

    ce8db50913eff9d4e600312d7c446b4a

  • SHA1

    6ed1b7efb1acb82b5856824a66b0a70af319109f

  • SHA256

    93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd

  • SHA512

    74f979d6678ab68b6063b8497f37303d41c0f084ee198d0260fd90fc28aa8a1e1cc55a8bcd65cff7c05338bc93e23b33767efa1d0c8974a1a3039916835d05e4

Malware Config

Extracted

Family

redline

Botnet

runpe

C2

142.202.242.172:7667

Signatures

  • DarkVNC

    DarkVNC is a malicious version of the famous VNC software.

  • Detect Neshta Payload 2 IoCs
  • Modifies system executable filetype association 2 TTPs 1 IoCs
  • Neshta

    Malware from the neshta family is designed to infect itself into other files to spread itself and cause damage.

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • DarkVNC Payload 5 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 53 IoCs
  • Drops file in Windows directory 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: MapViewOfSection 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd.exe
    "C:\Users\Admin\AppData\Local\Temp\93b96a1511a6f2084db207b831e3e072d8e5a4901592db660d456d10e5f618dd.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2608
    • C:\ProgramData\5922_1640024838_6584.exe
      "C:\ProgramData\5922_1640024838_6584.exe"
      2⤵
      • Modifies system executable filetype association
      • Executes dropped EXE
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies registry class
      • Suspicious use of WriteProcessMemory
      PID:660
      • C:\Users\Admin\AppData\Local\Temp\3582-490\5922_1640024838_6584.exe
        "C:\Users\Admin\AppData\Local\Temp\3582-490\5922_1640024838_6584.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:420
        • C:\Windows\system32\WerFault.exe
          C:\Windows\system32\WerFault.exe
          4⤵
            PID:1184

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Persistence

    Change Default File Association

    1
    T1042

    Defense Evasion

    Modify Registry

    1
    T1112

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\ProgramData\5922_1640024838_6584.exe
      MD5

      fe9462599a08f62eb6d8035dd453fad7

      SHA1

      6fdf760e3768ab2797ccd271f59a48abb8b7a6bd

      SHA256

      0531cae688e34d09b9a7da4e5f50cedaf854d47e7d15eae958cd569a1ecf0b55

      SHA512

      6de9d4fa81af0bd904bc1b88339a62a4e2f46dd7575771f68e42dd77389cf96907f6af1dbbe1bf2e4e5a1e7d4cbeb4dc7cf5af23b9bde187759c405f1127ea5c

    • C:\ProgramData\5922_1640024838_6584.exe
      MD5

      fe9462599a08f62eb6d8035dd453fad7

      SHA1

      6fdf760e3768ab2797ccd271f59a48abb8b7a6bd

      SHA256

      0531cae688e34d09b9a7da4e5f50cedaf854d47e7d15eae958cd569a1ecf0b55

      SHA512

      6de9d4fa81af0bd904bc1b88339a62a4e2f46dd7575771f68e42dd77389cf96907f6af1dbbe1bf2e4e5a1e7d4cbeb4dc7cf5af23b9bde187759c405f1127ea5c

    • C:\Users\Admin\AppData\Local\Temp\3582-490\5922_1640024838_6584.exe
      MD5

      0ee2c60b8e99b5da3c495f1dd2861cd5

      SHA1

      0d040ef434e0db2679ce78ec8996895399cc2cf9

      SHA256

      1ca91e55867ad256da14a7b0c5679e94395da033e87aab24c9a9187963829a87

      SHA512

      996ae9cc73b2aee3049975c757210724b838e959fd79c811b80ea1b0c23a6949e40805f62a77a66400ae5e1b3d5d97dc0af28b8ff474794068efa43a6f4e9005

    • C:\Users\Admin\AppData\Local\Temp\3582-490\5922_1640024838_6584.exe
      MD5

      0ee2c60b8e99b5da3c495f1dd2861cd5

      SHA1

      0d040ef434e0db2679ce78ec8996895399cc2cf9

      SHA256

      1ca91e55867ad256da14a7b0c5679e94395da033e87aab24c9a9187963829a87

      SHA512

      996ae9cc73b2aee3049975c757210724b838e959fd79c811b80ea1b0c23a6949e40805f62a77a66400ae5e1b3d5d97dc0af28b8ff474794068efa43a6f4e9005

    • memory/420-122-0x0000000000000000-mapping.dmp
    • memory/660-119-0x0000000000000000-mapping.dmp
    • memory/1184-125-0x0000000000000000-mapping.dmp
    • memory/1184-127-0x000001F63BEF0000-0x000001F63BFBA000-memory.dmp
      Filesize

      808KB

    • memory/1184-126-0x000001F63BD70000-0x000001F63BD99000-memory.dmp
      Filesize

      164KB

    • memory/2608-130-0x000001E9E3580000-0x000001E9E3592000-memory.dmp
      Filesize

      72KB

    • memory/2608-131-0x000001E9E35E0000-0x000001E9E361E000-memory.dmp
      Filesize

      248KB

    • memory/2608-116-0x000001E9C8DB0000-0x000001E9C8E62000-memory.dmp
      Filesize

      712KB

    • memory/2608-117-0x000001E9C9150000-0x000001E9C9174000-memory.dmp
      Filesize

      144KB

    • memory/2608-128-0x000001E9E3420000-0x000001E9E3440000-memory.dmp
      Filesize

      128KB

    • memory/2608-129-0x000001E9E3670000-0x000001E9E377A000-memory.dmp
      Filesize

      1.0MB

    • memory/2608-118-0x000001E9E3450000-0x000001E9E3452000-memory.dmp
      Filesize

      8KB

    • memory/2608-115-0x000001E9C8DB0000-0x000001E9C8E62000-memory.dmp
      Filesize

      712KB

    • memory/2608-132-0x000001E9E3800000-0x000001E9E3876000-memory.dmp
      Filesize

      472KB

    • memory/2608-133-0x000001E9E35A0000-0x000001E9E35BE000-memory.dmp
      Filesize

      120KB

    • memory/2608-134-0x000001E9E3BB0000-0x000001E9E3D72000-memory.dmp
      Filesize

      1.8MB

    • memory/2608-135-0x000001E9E42B0000-0x000001E9E47D6000-memory.dmp
      Filesize

      5.1MB

    • memory/2608-136-0x000001E9E3452000-0x000001E9E3454000-memory.dmp
      Filesize

      8KB

    • memory/2608-137-0x000001E9E3980000-0x000001E9E39D0000-memory.dmp
      Filesize

      320KB