Analysis
-
max time kernel
152s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
15-02-2022 14:40
Static task
static1
Behavioral task
behavioral1
Sample
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe
Resource
win10v2004-en-20220113
General
-
Target
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe
-
Size
1.4MB
-
MD5
dfcb432a6e55ed55ab7635f594a6d550
-
SHA1
538bd66e36e97daaccbe39bab507a1e2e77fc601
-
SHA256
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e
-
SHA512
ae23480fc6981dc5a831ed985217587deb8fe631e7d241c1d5639e27ef3a5b5ad90836d091280442379038b430a2145ff5e2772926e907b481a9ed200a63a816
Malware Config
Extracted
redline
garik
94.26.249.132:19205
-
auth_value
b066c5fcfab0da3546ce851ec2b7c262
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2584-166-0x0000000000700000-0x0000000000720000-memory.dmp family_redline -
Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
Processes:
WerFault.exedescription pid process target process PID 4420 created 3536 4420 WerFault.exe 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe -
Processes:
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exedescription pid process target process PID 3536 set thread context of 2584 3536 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe AppLaunch.exe -
Drops file in Windows directory 8 IoCs
Processes:
TiWorker.exesvchost.exedescription ioc process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1140 3536 WerFault.exe 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
WerFault.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString WerFault.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz WerFault.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
WerFault.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS WerFault.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU WerFault.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
WerFault.exepid process 1140 WerFault.exe 1140 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
WerFault.exesvchost.exeTiWorker.exedescription pid process Token: SeRestorePrivilege 1140 WerFault.exe Token: SeBackupPrivilege 1140 WerFault.exe Token: SeShutdownPrivilege 3680 svchost.exe Token: SeCreatePagefilePrivilege 3680 svchost.exe Token: SeShutdownPrivilege 3680 svchost.exe Token: SeCreatePagefilePrivilege 3680 svchost.exe Token: SeShutdownPrivilege 3680 svchost.exe Token: SeCreatePagefilePrivilege 3680 svchost.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe Token: SeSecurityPrivilege 1692 TiWorker.exe Token: SeBackupPrivilege 1692 TiWorker.exe Token: SeRestorePrivilege 1692 TiWorker.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exeWerFault.exedescription pid process target process PID 3536 wrote to memory of 2584 3536 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe AppLaunch.exe PID 3536 wrote to memory of 2584 3536 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe AppLaunch.exe PID 3536 wrote to memory of 2584 3536 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe AppLaunch.exe PID 3536 wrote to memory of 2584 3536 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe AppLaunch.exe PID 3536 wrote to memory of 2584 3536 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe AppLaunch.exe PID 4420 wrote to memory of 3536 4420 WerFault.exe 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe PID 4420 wrote to memory of 3536 4420 WerFault.exe 2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe"C:\Users\Admin\AppData\Local\Temp\2c59b4e57c8717b35b465ccf992ea48de637dcfea185507cdb88fd99b7ee136e.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3536 -s 5442⤵
- Program crash
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 464 -p 3536 -ip 35361⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2584-166-0x0000000000700000-0x0000000000720000-memory.dmpFilesize
128KB
-
memory/2584-180-0x0000000005100000-0x0000000005101000-memory.dmpFilesize
4KB
-
memory/2584-179-0x0000000004D30000-0x0000000004D6C000-memory.dmpFilesize
240KB
-
memory/2584-178-0x0000000004E00000-0x0000000004F0A000-memory.dmpFilesize
1.0MB
-
memory/2584-176-0x0000000004CD0000-0x0000000004CE2000-memory.dmpFilesize
72KB
-
memory/2584-173-0x00000000052F0000-0x0000000005908000-memory.dmpFilesize
6.1MB
-
memory/2584-172-0x000000007508E000-0x000000007508F000-memory.dmpFilesize
4KB
-
memory/3536-151-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/3536-156-0x0000000002A60000-0x0000000002A61000-memory.dmpFilesize
4KB
-
memory/3536-141-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/3536-140-0x0000000002A00000-0x0000000002A01000-memory.dmpFilesize
4KB
-
memory/3536-139-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/3536-142-0x0000000002780000-0x0000000002781000-memory.dmpFilesize
4KB
-
memory/3536-144-0x0000000002740000-0x0000000002741000-memory.dmpFilesize
4KB
-
memory/3536-143-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/3536-145-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/3536-146-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/3536-147-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/3536-148-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/3536-149-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/3536-150-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/3536-152-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/3536-130-0x0000000000400000-0x00000000007B6000-memory.dmpFilesize
3.7MB
-
memory/3536-153-0x00000000028D0000-0x00000000028D1000-memory.dmpFilesize
4KB
-
memory/3536-154-0x0000000002950000-0x0000000002951000-memory.dmpFilesize
4KB
-
memory/3536-155-0x0000000002730000-0x0000000002731000-memory.dmpFilesize
4KB
-
memory/3536-138-0x00000000029A0000-0x00000000029A1000-memory.dmpFilesize
4KB
-
memory/3536-157-0x0000000002A70000-0x0000000002A71000-memory.dmpFilesize
4KB
-
memory/3536-158-0x0000000002A20000-0x0000000002A21000-memory.dmpFilesize
4KB
-
memory/3536-160-0x0000000002A50000-0x0000000002A51000-memory.dmpFilesize
4KB
-
memory/3536-159-0x0000000002A90000-0x0000000002A91000-memory.dmpFilesize
4KB
-
memory/3536-162-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/3536-163-0x0000000002AA0000-0x0000000002AA1000-memory.dmpFilesize
4KB
-
memory/3536-161-0x0000000002A40000-0x0000000002A41000-memory.dmpFilesize
4KB
-
memory/3536-164-0x0000000000401000-0x0000000000423000-memory.dmpFilesize
136KB
-
memory/3536-165-0x0000000000423000-0x0000000000425000-memory.dmpFilesize
8KB
-
memory/3536-136-0x0000000002970000-0x0000000002971000-memory.dmpFilesize
4KB
-
memory/3536-171-0x000000000019F000-0x00000000001A0000-memory.dmpFilesize
4KB
-
memory/3536-137-0x00000000029E0000-0x00000000029E1000-memory.dmpFilesize
4KB
-
memory/3536-135-0x00000000029C0000-0x00000000029C1000-memory.dmpFilesize
4KB
-
memory/3536-131-0x0000000000400000-0x00000000007B6000-memory.dmpFilesize
3.7MB
-
memory/3536-132-0x0000000000400000-0x00000000007B6000-memory.dmpFilesize
3.7MB
-
memory/3536-134-0x00000000029B0000-0x00000000029B1000-memory.dmpFilesize
4KB
-
memory/3536-133-0x0000000002570000-0x00000000025D0000-memory.dmpFilesize
384KB
-
memory/3680-177-0x000001CF86890000-0x000001CF86894000-memory.dmpFilesize
16KB
-
memory/3680-175-0x000001CF83B90000-0x000001CF83BA0000-memory.dmpFilesize
64KB
-
memory/3680-174-0x000001CF83B30000-0x000001CF83B40000-memory.dmpFilesize
64KB