Overview

overview

10

Static

static

9d1c7694e5...ba.exe

windows7_x64

10

9d1c7694e5...ba.exe

windows10-2004_x64

10

Analysis

  • max time kernel
    166s
  • max time network
    190s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    12-05-2022 11:54

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    9d1c7694e5d77b85d7b408ce5c7b2b4c83fe75458ec3d3cd320ea5eed7de2cba.exe

  • Size

    2.0MB

  • MD5

    4733a823253e50d03fac643b86bfc988

  • SHA1

    f665d1e999f428ff6c737eed26e83790dbee024d

  • SHA256

    9d1c7694e5d77b85d7b408ce5c7b2b4c83fe75458ec3d3cd320ea5eed7de2cba

  • SHA512

    17c8e90f316004f38dc92e5102ee78903f7d7bf62c40231b868e8182740b9f659cc95bb9d5e19b2830671e43855f3a90d0b380cef2236213227f99fe538b1984

Score
10/10
redlinebootkitevasioninfostealerpersistencetrojan

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 2 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
    evasion
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Identifies Wine through registry keys 2 TTPs 1 IoCs

    Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.

    evasion
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs

    Bootkits write to the MBR to gain persistence at a level below the operating system.

    bootkitpersistence
  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9d1c7694e5d77b85d7b408ce5c7b2b4c83fe75458ec3d3cd320ea5eed7de2cba.exe
    "C:\Users\Admin\AppData\Local\Temp\9d1c7694e5d77b85d7b408ce5c7b2b4c83fe75458ec3d3cd320ea5eed7de2cba.exe"
    1⤵
    • Checks BIOS information in registry
    • Identifies Wine through registry keys
    • Checks whether UAC is enabled
    • Writes to the Master Boot Record (MBR)
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3956

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Bootkit

1
T1067

Privilege Escalation

Defense Evasion

Virtualization/Sandbox Evasion

2
T1497

Credential Access

Discovery

Query Registry

3
T1012

Virtualization/Sandbox Evasion

2
T1497

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3956-130-0x00000000771E0000-0x0000000077383000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/3956-131-0x0000000000B10000-0x0000000001008000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3956-132-0x0000000000B10000-0x0000000001008000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/3956-133-0x0000000006030000-0x0000000006648000-memory.dmp
    Filesize

    6.1MB

    Download
  • memory/3956-134-0x0000000005A30000-0x0000000005A42000-memory.dmp
    Filesize

    72KB

    Download
  • memory/3956-135-0x0000000005A90000-0x0000000005ACC000-memory.dmp
    Filesize

    240KB

    Download
  • memory/3956-136-0x0000000005D10000-0x0000000005E1A000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/3956-137-0x00000000015D0000-0x0000000001662000-memory.dmp
    Filesize

    584KB

    Download
  • memory/3956-138-0x0000000007040000-0x00000000075E4000-memory.dmp
    Filesize

    5.6MB

    Download
  • memory/3956-139-0x0000000006DE0000-0x0000000006FA2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/3956-140-0x0000000007B20000-0x000000000804C000-memory.dmp
    Filesize

    5.2MB

    Download