Analysis
-
max time kernel
120s -
max time network
129s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
25-01-2022 17:07
Static task
static1
Behavioral task
behavioral1
Sample
be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe
Resource
win7-en-20211208
General
-
Target
be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe
-
Size
5.0MB
-
MD5
897fdc53ce5f26017c224ccab9001e74
-
SHA1
987fa2dec584d70da3c12f78ac777ca571261131
-
SHA256
be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39baf2c34ebfc49b158cf
-
SHA512
ad52fea715a346f7377cfe131bc97da46c3f690a7f86e08b44feeb5857191b959eeee309394c6423e014e901a23dea77ec20b51ee581370fe4a5ba1cbd8c61ad
Malware Config
Extracted
redline
GLADIATOR
185.215.113.107:1433
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1360-68-0x00000000020C0000-0x00000000020F4000-memory.dmp family_redline behavioral1/memory/1360-72-0x0000000004640000-0x0000000004672000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
systill.exesystill.exepid process 432 systill.exe 1360 systill.exe -
Loads dropped DLL 3 IoCs
Processes:
be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exesystill.exepid process 1616 be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe 1616 be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe 432 systill.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
systill.exedescription pid process target process PID 432 set thread context of 1360 432 systill.exe systill.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
systill.exedescription pid process Token: SeDebugPrivilege 1360 systill.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exesystill.exedescription pid process target process PID 1616 wrote to memory of 432 1616 be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe systill.exe PID 1616 wrote to memory of 432 1616 be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe systill.exe PID 1616 wrote to memory of 432 1616 be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe systill.exe PID 1616 wrote to memory of 432 1616 be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe systill.exe PID 432 wrote to memory of 1360 432 systill.exe systill.exe PID 432 wrote to memory of 1360 432 systill.exe systill.exe PID 432 wrote to memory of 1360 432 systill.exe systill.exe PID 432 wrote to memory of 1360 432 systill.exe systill.exe PID 432 wrote to memory of 1360 432 systill.exe systill.exe PID 432 wrote to memory of 1360 432 systill.exe systill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe"C:\Users\Admin\AppData\Local\Temp\be06e503bd48a2d5ec4dbb6532ad3ef1abd2d3659fa39.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\ProgramData\Drivers Installer Assistants\systill.exe"C:\ProgramData\Drivers Installer Assistants\systill.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:432 -
C:\ProgramData\Drivers Installer Assistants\systill.exe"C:\ProgramData\Drivers Installer Assistants\systill.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1360
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData\Drivers Installer Assistants\systill.exeMD5
227cde11a1caa7ee396f648dee1159d0
SHA1c6e7b57e0bc5c2a174c23c8acc6e4e5bedb57bca
SHA2568a9f149593085be8898fcf2ae3e492ee3c2dc9519125275958235ed7cc4b588e
SHA51279ae89d736367560f90fd7f3323bb290c4b03b74c4a291fd660caa92259de6b59435b5e1334a557c0843ed93d7d1c4019861a13fe459276eb77aca34a3c5e463
-
C:\ProgramData\Drivers Installer Assistants\systill.exeMD5
227cde11a1caa7ee396f648dee1159d0
SHA1c6e7b57e0bc5c2a174c23c8acc6e4e5bedb57bca
SHA2568a9f149593085be8898fcf2ae3e492ee3c2dc9519125275958235ed7cc4b588e
SHA51279ae89d736367560f90fd7f3323bb290c4b03b74c4a291fd660caa92259de6b59435b5e1334a557c0843ed93d7d1c4019861a13fe459276eb77aca34a3c5e463
-
C:\ProgramData\Drivers Installer Assistants\systill.exeMD5
227cde11a1caa7ee396f648dee1159d0
SHA1c6e7b57e0bc5c2a174c23c8acc6e4e5bedb57bca
SHA2568a9f149593085be8898fcf2ae3e492ee3c2dc9519125275958235ed7cc4b588e
SHA51279ae89d736367560f90fd7f3323bb290c4b03b74c4a291fd660caa92259de6b59435b5e1334a557c0843ed93d7d1c4019861a13fe459276eb77aca34a3c5e463
-
\ProgramData\Drivers Installer Assistants\systill.exeMD5
227cde11a1caa7ee396f648dee1159d0
SHA1c6e7b57e0bc5c2a174c23c8acc6e4e5bedb57bca
SHA2568a9f149593085be8898fcf2ae3e492ee3c2dc9519125275958235ed7cc4b588e
SHA51279ae89d736367560f90fd7f3323bb290c4b03b74c4a291fd660caa92259de6b59435b5e1334a557c0843ed93d7d1c4019861a13fe459276eb77aca34a3c5e463
-
\ProgramData\Drivers Installer Assistants\systill.exeMD5
227cde11a1caa7ee396f648dee1159d0
SHA1c6e7b57e0bc5c2a174c23c8acc6e4e5bedb57bca
SHA2568a9f149593085be8898fcf2ae3e492ee3c2dc9519125275958235ed7cc4b588e
SHA51279ae89d736367560f90fd7f3323bb290c4b03b74c4a291fd660caa92259de6b59435b5e1334a557c0843ed93d7d1c4019861a13fe459276eb77aca34a3c5e463
-
\ProgramData\Drivers Installer Assistants\systill.exeMD5
227cde11a1caa7ee396f648dee1159d0
SHA1c6e7b57e0bc5c2a174c23c8acc6e4e5bedb57bca
SHA2568a9f149593085be8898fcf2ae3e492ee3c2dc9519125275958235ed7cc4b588e
SHA51279ae89d736367560f90fd7f3323bb290c4b03b74c4a291fd660caa92259de6b59435b5e1334a557c0843ed93d7d1c4019861a13fe459276eb77aca34a3c5e463
-
memory/1360-65-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1360-64-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1360-67-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1360-68-0x00000000020C0000-0x00000000020F4000-memory.dmpFilesize
208KB
-
memory/1360-70-0x0000000004772000-0x0000000004773000-memory.dmpFilesize
4KB
-
memory/1360-69-0x0000000004771000-0x0000000004772000-memory.dmpFilesize
4KB
-
memory/1360-71-0x0000000004773000-0x0000000004774000-memory.dmpFilesize
4KB
-
memory/1360-72-0x0000000004640000-0x0000000004672000-memory.dmpFilesize
200KB
-
memory/1360-73-0x0000000004670000-0x0000000004776000-memory.dmpFilesize
1.0MB
-
memory/1616-56-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/1616-55-0x0000000076921000-0x0000000076923000-memory.dmpFilesize
8KB