Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 05:39
Static task
static1
Behavioral task
behavioral1
Sample
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe
Resource
win10v2004-en-20220113
General
-
Target
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe
-
Size
3.6MB
-
MD5
e45121171ab4c1e206b98b136b65d42e
-
SHA1
e560c2ce841a4af3aee1d32dbd906bcc044657bf
-
SHA256
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069
-
SHA512
c2adecc87845a6a0a8eeda057c7ec6919075c08085723f775763e2eabbbd215549888167ccc8c366950aa0c04ac1ce849391177c6b775a1f8e6f4f73c891d1f6
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/792-62-0x0000000000220000-0x0000000000ACC000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe -
Processes:
resource yara_rule behavioral1/memory/792-62-0x0000000000220000-0x0000000000ACC000-memory.dmp themida -
Processes:
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exepid process 792 d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exepid process 792 d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe"C:\Users\Admin\AppData\Local\Temp\d8df6ea842d843537e4e258b00441184ab937afa7ab8bc19fae5960821629069.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/792-54-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB
-
memory/792-58-0x0000000075931000-0x0000000075932000-memory.dmpFilesize
4KB
-
memory/792-59-0x0000000075934000-0x0000000075935000-memory.dmpFilesize
4KB
-
memory/792-60-0x0000000076D0E000-0x0000000076D0F000-memory.dmpFilesize
4KB
-
memory/792-61-0x0000000077E10000-0x0000000077E12000-memory.dmpFilesize
8KB
-
memory/792-62-0x0000000000220000-0x0000000000ACC000-memory.dmpFilesize
8.7MB
-
memory/792-63-0x0000000074C5E000-0x0000000074C5F000-memory.dmpFilesize
4KB
-
memory/792-64-0x00000000053B0000-0x00000000053B1000-memory.dmpFilesize
4KB