Analysis
- max time kernel
143s - max time network
134s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
02/02/2022, 16:51
Static task
static1
Behavioral task
behavioral1
Sample
143e689d9fab6186b4fb3fd1f4fa7bd2.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
143e689d9fab6186b4fb3fd1f4fa7bd2.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
General
- Target 143e689d9fab6186b4fb3fd1f4fa7bd2.exe
- Size 993KB
- Sample220202-vctrxsbgb9
- SHA256 abd054e7a6a48ac8a33ffa9fab4814d0c68149f5a5eea1b0a68e84d2057811d6
- MD5 143e689d9fab6186b4fb3fd1f4fa7bd2
- SHA1 187e23407c8b1dd7a911c5d9e5b42b2ac303459f
- SHA512 d4d331a05040a7394c42ace4ff37a349de96ad59b8b3ccb2dbcda30ecba37275054b76f8f5188d42385421032599472dd9290c162a6ca2ec9abe57950d7bff16
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Extracted
Family
-
redline
Botnet
-
pliswork
C2
-
heninnertal.xyz:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
resource yara_rule behavioral1/memory/452-67-0x0000000000080000-0x00000000000A0000-memory.dmp family_redline behavioral1/memory/452-71-0x0000000000080000-0x00000000000A0000-memory.dmp family_redline - Executes dropped EXE 1 IoCs
pid Process 560 Stelle.exe.pif - Deletes itself 1 IoCs
pid Process 540 cmd.exe - Loads dropped DLL 7 IoCs
pid Process 1156 cmd.exe 560 Stelle.exe.pif 560 Stelle.exe.pif 560 Stelle.exe.pif 560 Stelle.exe.pif 560 Stelle.exe.pif 560 Stelle.exe.pif - Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 560 set thread context of 452 560 Stelle.exe.pif 41 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Enumerates processes with tasklist 1 TTPs 2 IoCs
pid Process 580 tasklist.exe 1180 tasklist.exe - Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1180 tasklist.exe Token: SeDebugPrivilege 580 tasklist.exe Token: SeDebugPrivilege 452 jsc.exe - Suspicious use of FindShellTrayWindow 3 IoCs
pid Process 560 Stelle.exe.pif 560 Stelle.exe.pif 560 Stelle.exe.pif - Suspicious use of SendNotifyMessage 3 IoCs
pid Process 560 Stelle.exe.pif 560 Stelle.exe.pif 560 Stelle.exe.pif - Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 1532 wrote to memory of 968 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 27 PID 1532 wrote to memory of 968 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 27 PID 1532 wrote to memory of 968 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 27 PID 1532 wrote to memory of 968 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 27 PID 1532 wrote to memory of 1100 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 28 PID 1532 wrote to memory of 1100 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 28 PID 1532 wrote to memory of 1100 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 28 PID 1532 wrote to memory of 1100 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 28 PID 1100 wrote to memory of 1156 1100 cmd.exe 30 PID 1100 wrote to memory of 1156 1100 cmd.exe 30 PID 1100 wrote to memory of 1156 1100 cmd.exe 30 PID 1100 wrote to memory of 1156 1100 cmd.exe 30 PID 1156 wrote to memory of 1180 1156 cmd.exe 31 PID 1156 wrote to memory of 1180 1156 cmd.exe 31 PID 1156 wrote to memory of 1180 1156 cmd.exe 31 PID 1156 wrote to memory of 1180 1156 cmd.exe 31 PID 1156 wrote to memory of 1808 1156 cmd.exe 32 PID 1156 wrote to memory of 1808 1156 cmd.exe 32 PID 1156 wrote to memory of 1808 1156 cmd.exe 32 PID 1156 wrote to memory of 1808 1156 cmd.exe 32 PID 1156 wrote to memory of 580 1156 cmd.exe 34 PID 1156 wrote to memory of 580 1156 cmd.exe 34 PID 1156 wrote to memory of 580 1156 cmd.exe 34 PID 1156 wrote to memory of 580 1156 cmd.exe 34 PID 1156 wrote to memory of 268 1156 cmd.exe 35 PID 1156 wrote to memory of 268 1156 cmd.exe 35 PID 1156 wrote to memory of 268 1156 cmd.exe 35 PID 1156 wrote to memory of 268 1156 cmd.exe 35 PID 1156 wrote to memory of 1372 1156 cmd.exe 36 PID 1156 wrote to memory of 1372 1156 cmd.exe 36 PID 1156 wrote to memory of 1372 1156 cmd.exe 36 PID 1156 wrote to memory of 1372 1156 cmd.exe 36 PID 1156 wrote to memory of 560 1156 cmd.exe 37 PID 1156 wrote to memory of 560 1156 cmd.exe 37 PID 1156 wrote to memory of 560 1156 cmd.exe 37 PID 1156 wrote to memory of 560 1156 cmd.exe 37 PID 1156 wrote to memory of 1132 1156 cmd.exe 38 PID 1156 wrote to memory of 1132 1156 cmd.exe 38 PID 1156 wrote to memory of 1132 1156 cmd.exe 38 PID 1156 wrote to memory of 1132 1156 cmd.exe 38 PID 1532 wrote to memory of 540 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 39 PID 1532 wrote to memory of 540 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 39 PID 1532 wrote to memory of 540 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 39 PID 1532 wrote to memory of 540 1532 143e689d9fab6186b4fb3fd1f4fa7bd2.exe 39 PID 560 wrote to memory of 452 560 Stelle.exe.pif 41 PID 560 wrote to memory of 452 560 Stelle.exe.pif 41 PID 560 wrote to memory of 452 560 Stelle.exe.pif 41 PID 560 wrote to memory of 452 560 Stelle.exe.pif 41 PID 560 wrote to memory of 452 560 Stelle.exe.pif 41 PID 560 wrote to memory of 452 560 Stelle.exe.pif 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\143e689d9fab6186b4fb3fd1f4fa7bd2.exe"C:\Users\Admin\AppData\Local\Temp\143e689d9fab6186b4fb3fd1f4fa7bd2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Windows\SysWOW64\dllhost.exe"C:\Windows\System32\dllhost.exe"2⤵PID:968
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c cmd < Sconvolta.jpeg2⤵
- Suspicious use of WriteProcessMemory
PID:1100 -
C:\Windows\SysWOW64\cmd.execmd3⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq BullGuardCore.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Windows\SysWOW64\find.exefind /I /N "bullguardcore.exe"4⤵PID:1808
-
-
C:\Windows\SysWOW64\tasklist.exetasklist /FI "imagename eq PSUAService.exe"4⤵
- Enumerates processes with tasklist
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
C:\Windows\SysWOW64\find.exefind /I /N "psuaservice.exe"4⤵PID:268
-
-
C:\Windows\SysWOW64\findstr.exefindstr /V /R "^QQmJwbYqajuadVccfuSigykCrBawZhTSXHgQtFNhIVXEWfqNJvbuOVhKFWGAtXqyagxJGEdKaFmzoHGNAFaDPMrezDkiYhoLURkHVdutyMNpcUCYdSqnEb$" Cancellato.jpeg4⤵PID:1372
-
-
C:\Users\Admin\AppData\Local\Temp\7ZipSfx.000\Stelle.exe.pifStelle.exe.pif h4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:560 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\jsc.exe5⤵
- Suspicious use of AdjustPrivilegeToken
PID:452
-
-
-
C:\Windows\SysWOW64\waitfor.exewaitfor /t 5 sKEzMhCjWHeZVbCUEYRCQctqEQONjSbyzefp4⤵PID:1132
-
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\7ZSfx000.cmd" "2⤵
- Deletes itself
PID:540
-