Analysis
- max time kernel
145s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
17/02/2022, 17:17
Static task
static1
Behavioral task
behavioral1
Sample
RFQ-23511-MACHINE QUOTATION.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target RFQ-23511-MACHINE QUOTATION.exe
- Size 806KB
- Sample220217-vtsaescdc6
- SHA256 1e47364a4a6b1e59a75a72a91a759daa67c9f4e4101c1231fb6b236026a8a743
- MD5 a9e31a79a0d032567fbe184a958b50b0
- SHA1 7b9e171d962d46101fd05b7f7c5f027af7a6dd6a
- SHA512 74d793aca6fde310c558845988d9a2bb77ac378879618d48c280b9a562041e485409fa32cf51941435e9d50ae6f9f1499471da0eef380e18e4f9bb51af95e380
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
redline
Botnet
-
XL
C2
-
2.56.56.182:3631
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
resource yara_rule behavioral2/memory/4384-138-0x0000000000400000-0x000000000041E000-memory.dmp family_redline - Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\Control Panel\International\Geo\Nation RFQ-23511-MACHINE QUOTATION.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3640 set thread context of 4384 3640 RFQ-23511-MACHINE QUOTATION.exe 131 - Drops file in Windows directory 8 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Runs ping.exe 1 TTPs 10 IoCs
pid Process 4520 PING.EXE 1508 PING.EXE 3444 PING.EXE 1340 PING.EXE 836 PING.EXE 2608 PING.EXE 4812 PING.EXE 408 PING.EXE 1308 PING.EXE 3820 PING.EXE - Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 3640 RFQ-23511-MACHINE QUOTATION.exe 3640 RFQ-23511-MACHINE QUOTATION.exe 3640 RFQ-23511-MACHINE QUOTATION.exe 3640 RFQ-23511-MACHINE QUOTATION.exe 3640 RFQ-23511-MACHINE QUOTATION.exe 3640 RFQ-23511-MACHINE QUOTATION.exe 4384 RFQ-23511-MACHINE QUOTATION.exe 4384 RFQ-23511-MACHINE QUOTATION.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeShutdownPrivilege 1116 svchost.exe Token: SeCreatePagefilePrivilege 1116 svchost.exe Token: SeShutdownPrivilege 1116 svchost.exe Token: SeCreatePagefilePrivilege 1116 svchost.exe Token: SeShutdownPrivilege 1116 svchost.exe Token: SeCreatePagefilePrivilege 1116 svchost.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe Token: SeRestorePrivilege 2924 TiWorker.exe Token: SeSecurityPrivilege 2924 TiWorker.exe Token: SeBackupPrivilege 2924 TiWorker.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3640 wrote to memory of 3276 3640 RFQ-23511-MACHINE QUOTATION.exe 82 PID 3640 wrote to memory of 3276 3640 RFQ-23511-MACHINE QUOTATION.exe 82 PID 3640 wrote to memory of 3276 3640 RFQ-23511-MACHINE QUOTATION.exe 82 PID 3276 wrote to memory of 4812 3276 cmd.exe 85 PID 3276 wrote to memory of 4812 3276 cmd.exe 85 PID 3276 wrote to memory of 4812 3276 cmd.exe 85 PID 3640 wrote to memory of 3116 3640 RFQ-23511-MACHINE QUOTATION.exe 90 PID 3640 wrote to memory of 3116 3640 RFQ-23511-MACHINE QUOTATION.exe 90 PID 3640 wrote to memory of 3116 3640 RFQ-23511-MACHINE QUOTATION.exe 90 PID 3116 wrote to memory of 408 3116 cmd.exe 92 PID 3116 wrote to memory of 408 3116 cmd.exe 92 PID 3116 wrote to memory of 408 3116 cmd.exe 92 PID 3640 wrote to memory of 4964 3640 RFQ-23511-MACHINE QUOTATION.exe 96 PID 3640 wrote to memory of 4964 3640 RFQ-23511-MACHINE QUOTATION.exe 96 PID 3640 wrote to memory of 4964 3640 RFQ-23511-MACHINE QUOTATION.exe 96 PID 4964 wrote to memory of 1508 4964 cmd.exe 98 PID 4964 wrote to memory of 1508 4964 cmd.exe 98 PID 4964 wrote to memory of 1508 4964 cmd.exe 98 PID 3640 wrote to memory of 3204 3640 RFQ-23511-MACHINE QUOTATION.exe 100 PID 3640 wrote to memory of 3204 3640 RFQ-23511-MACHINE QUOTATION.exe 100 PID 3640 wrote to memory of 3204 3640 RFQ-23511-MACHINE QUOTATION.exe 100 PID 3204 wrote to memory of 1308 3204 cmd.exe 102 PID 3204 wrote to memory of 1308 3204 cmd.exe 102 PID 3204 wrote to memory of 1308 3204 cmd.exe 102 PID 3640 wrote to memory of 3428 3640 RFQ-23511-MACHINE QUOTATION.exe 105 PID 3640 wrote to memory of 3428 3640 RFQ-23511-MACHINE QUOTATION.exe 105 PID 3640 wrote to memory of 3428 3640 RFQ-23511-MACHINE QUOTATION.exe 105 PID 3428 wrote to memory of 3820 3428 cmd.exe 107 PID 3428 wrote to memory of 3820 3428 cmd.exe 107 PID 3428 wrote to memory of 3820 3428 cmd.exe 107 PID 3640 wrote to memory of 440 3640 RFQ-23511-MACHINE QUOTATION.exe 109 PID 3640 wrote to memory of 440 3640 RFQ-23511-MACHINE QUOTATION.exe 109 PID 3640 wrote to memory of 440 3640 RFQ-23511-MACHINE QUOTATION.exe 109 PID 440 wrote to memory of 3444 440 cmd.exe 111 PID 440 wrote to memory of 3444 440 cmd.exe 111 PID 440 wrote to memory of 3444 440 cmd.exe 111 PID 3640 wrote to memory of 2328 3640 RFQ-23511-MACHINE QUOTATION.exe 114 PID 3640 wrote to memory of 2328 3640 RFQ-23511-MACHINE QUOTATION.exe 114 PID 3640 wrote to memory of 2328 3640 RFQ-23511-MACHINE QUOTATION.exe 114 PID 2328 wrote to memory of 1340 2328 cmd.exe 116 PID 2328 wrote to memory of 1340 2328 cmd.exe 116 PID 2328 wrote to memory of 1340 2328 cmd.exe 116 PID 3640 wrote to memory of 920 3640 RFQ-23511-MACHINE QUOTATION.exe 117 PID 3640 wrote to memory of 920 3640 RFQ-23511-MACHINE QUOTATION.exe 117 PID 3640 wrote to memory of 920 3640 RFQ-23511-MACHINE QUOTATION.exe 117 PID 920 wrote to memory of 2608 920 cmd.exe 119 PID 920 wrote to memory of 2608 920 cmd.exe 119 PID 920 wrote to memory of 2608 920 cmd.exe 119 PID 3640 wrote to memory of 4800 3640 RFQ-23511-MACHINE QUOTATION.exe 123 PID 3640 wrote to memory of 4800 3640 RFQ-23511-MACHINE QUOTATION.exe 123 PID 3640 wrote to memory of 4800 3640 RFQ-23511-MACHINE QUOTATION.exe 123 PID 4800 wrote to memory of 836 4800 cmd.exe 125 PID 4800 wrote to memory of 836 4800 cmd.exe 125 PID 4800 wrote to memory of 836 4800 cmd.exe 125 PID 3640 wrote to memory of 4832 3640 RFQ-23511-MACHINE QUOTATION.exe 126 PID 3640 wrote to memory of 4832 3640 RFQ-23511-MACHINE QUOTATION.exe 126 PID 3640 wrote to memory of 4832 3640 RFQ-23511-MACHINE QUOTATION.exe 126 PID 4832 wrote to memory of 4520 4832 cmd.exe 128 PID 4832 wrote to memory of 4520 4832 cmd.exe 128 PID 4832 wrote to memory of 4520 4832 cmd.exe 128 PID 3640 wrote to memory of 1148 3640 RFQ-23511-MACHINE QUOTATION.exe 130 PID 3640 wrote to memory of 1148 3640 RFQ-23511-MACHINE QUOTATION.exe 130 PID 3640 wrote to memory of 1148 3640 RFQ-23511-MACHINE QUOTATION.exe 130 PID 3640 wrote to memory of 4384 3640 RFQ-23511-MACHINE QUOTATION.exe 131
Processes
-
C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3640 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:3276 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:4812
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:3116 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:408
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:4964 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:1508
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:3204 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:1308
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:3820
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:440 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:3444
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:1340
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:2608
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:4800 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:836
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c ping yahoo.com2⤵
- Suspicious use of WriteProcessMemory
PID:4832 -
C:\Windows\SysWOW64\PING.EXEping yahoo.com3⤵
- Runs ping.exe
PID:4520
-
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"2⤵PID:1148
-
-
C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"C:\Users\Admin\AppData\Local\Temp\RFQ-23511-MACHINE QUOTATION.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4384
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1116
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2924