Analysis
- max time kernel
153s - max time network
158s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
05/01/2022, 12:20
General
- Target 6b9a2749233e308effc6d4d7f190af1d.exe
- Size 990KB
- Sample220105-phr8dsafam
- SHA256 e670a645b65e5a4deadb6d555fa4f2bc88ef92a5e9657419f410bd1cc076f407
Malware Config
Extracted
-
redline
-
cheat
-
45.147.196.146:6213
Extracted
-
raccoon
-
e9f10fade0328e7cef5c9f5bf00076086ba5a8a1
-
url4cnc
http://91.219.236.18/baldandbankrupt1
http://194.180.174.41/baldandbankrupt1
http://91.219.236.148/baldandbankrupt1
https://t.me/baldandbankrupt1
Signatures
- Raccoon
Simple but powerful infostealer which was very active in 2019.
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b9a2749233e308effc6d4d7f190af1d.exe"C:\Users\Admin\AppData\Local\Temp\6b9a2749233e308effc6d4d7f190af1d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\whw.exe"C:\Users\Admin\AppData\Roaming\whw.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\e3dwefw.exe"C:\Users\Admin\AppData\Roaming\e3dwefw.exe"3⤵
- Executes dropped EXE
- Adds Run key to start application
-
-
C:\Users\Admin\AppData\Roaming\sdfsd.exe"C:\Users\Admin\AppData\Roaming\sdfsd.exe"3⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1364-157-0x0000000005670000-0x00000000056AE000-memory.dmp
memory/1364-189-0x0000000007490000-0x00000000074E0000-memory.dmp
memory/1364-182-0x00000000066F0000-0x0000000006BEE000-memory.dmp
memory/1364-165-0x00000000055D0000-0x0000000005BD6000-memory.dmp
memory/1364-159-0x00000000056B0000-0x00000000056FB000-memory.dmp
memory/1364-187-0x00000000071C0000-0x0000000007382000-memory.dmp
memory/1364-184-0x0000000005B10000-0x0000000005BA2000-memory.dmp
memory/1364-186-0x00000000065C0000-0x0000000006626000-memory.dmp
memory/1364-185-0x0000000005A70000-0x0000000005A8E000-memory.dmp
memory/1364-148-0x0000000000E10000-0x0000000000E30000-memory.dmp
memory/1364-154-0x0000000005740000-0x000000000584A000-memory.dmp
memory/1364-188-0x00000000078C0000-0x0000000007DEC000-memory.dmp
memory/1364-183-0x00000000059F0000-0x0000000005A66000-memory.dmp
memory/1364-153-0x0000000005610000-0x0000000005622000-memory.dmp
memory/1364-150-0x0000000005BE0000-0x00000000061E6000-memory.dmp
memory/1364-147-0x0000000000E10000-0x0000000000E30000-memory.dmp
memory/1472-155-0x0000000000E60000-0x0000000000E68000-memory.dmp
memory/1472-156-0x0000000000E60000-0x0000000000E68000-memory.dmp
memory/2120-166-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-180-0x00000000775A0000-0x000000007772E000-memory.dmp
memory/2120-181-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-179-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-178-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-177-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-176-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-175-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-174-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-173-0x0000000075DA0000-0x0000000075E91000-memory.dmp
memory/2120-172-0x00000000746C0000-0x0000000074882000-memory.dmp
memory/2120-171-0x0000000000A80000-0x0000000000A81000-memory.dmp
memory/2120-169-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-170-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-168-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-167-0x0000000000580000-0x00000000005C5000-memory.dmp
memory/2120-162-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-163-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/2120-164-0x0000000000A90000-0x0000000000EA8000-memory.dmp
memory/3036-125-0x00000000059E0000-0x00000000059EA000-memory.dmp
memory/3036-119-0x0000000000BF0000-0x0000000000CEC000-memory.dmp
memory/3036-120-0x0000000005A10000-0x0000000005F0E000-memory.dmp
memory/3036-121-0x00000000055B0000-0x0000000005642000-memory.dmp
memory/3036-122-0x0000000005F10000-0x0000000005F86000-memory.dmp
memory/3036-118-0x0000000000BF0000-0x0000000000CEC000-memory.dmp
memory/3036-123-0x0000000005580000-0x000000000559E000-memory.dmp
memory/3036-124-0x0000000005510000-0x0000000005A0E000-memory.dmp
memory/3536-134-0x0000000005480000-0x00000000054BE000-memory.dmp
memory/3536-137-0x0000000006230000-0x000000000672E000-memory.dmp
memory/3536-138-0x0000000005DC0000-0x0000000005E36000-memory.dmp
memory/3536-139-0x0000000005EE0000-0x0000000005F72000-memory.dmp
memory/3536-140-0x0000000005F80000-0x0000000005F9E000-memory.dmp
memory/3536-143-0x0000000006A30000-0x0000000006A80000-memory.dmp
memory/3536-141-0x0000000006B00000-0x0000000006CC2000-memory.dmp
memory/3536-142-0x0000000007200000-0x000000000772C000-memory.dmp
memory/3536-136-0x0000000005470000-0x0000000005471000-memory.dmp
memory/3536-135-0x0000000005890000-0x00000000058DB000-memory.dmp
memory/3536-128-0x0000000000410000-0x0000000000432000-memory.dmp
memory/3536-129-0x0000000000410000-0x0000000000432000-memory.dmp
memory/3536-133-0x0000000004900000-0x0000000004966000-memory.dmp
memory/3536-132-0x00000000049A0000-0x0000000004AAA000-memory.dmp
memory/3536-131-0x0000000004870000-0x0000000004882000-memory.dmp
memory/3536-130-0x0000000004DF0000-0x00000000053F6000-memory.dmp