Analysis
-
max time kernel
60s -
max time network
63s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
13-05-2022 19:35
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
tmp.exe
Resource
win10v2004-20220414-en
General
-
Target
tmp.exe
-
Size
1.2MB
-
MD5
c52e23f559f027c6af598ff0a4c3497d
-
SHA1
0e6de0682ae5d89a6530a6c6e03054f5aaeb0662
-
SHA256
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021
-
SHA512
802159c0fa6034dfc4278ee470aef46a52947006b007ae6a90391377d6c9b3774c999c30ab8d62a10869bf4d459736da4b70ce97d7771bf849effff7714e6428
Malware Config
Extracted
redline
test1
23.88.112.179:19536
-
auth_value
68c6114f4d4c471ad88677f54e75676f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1716-71-0x00000000003B0000-0x00000000003D0000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
tmp.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lrjaaawiu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cdyynpvt\\Lrjaaawiu.exe\"" tmp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tmp.exedescription pid process target process PID 944 set thread context of 1716 944 tmp.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1992 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
tmp.exeInstallUtil.exepid process 944 tmp.exe 1716 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
tmp.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 944 tmp.exe Token: SeDebugPrivilege 1716 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
tmp.execmd.exedescription pid process target process PID 944 wrote to memory of 2024 944 tmp.exe cmd.exe PID 944 wrote to memory of 2024 944 tmp.exe cmd.exe PID 944 wrote to memory of 2024 944 tmp.exe cmd.exe PID 944 wrote to memory of 2024 944 tmp.exe cmd.exe PID 2024 wrote to memory of 1992 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1992 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1992 2024 cmd.exe timeout.exe PID 2024 wrote to memory of 1992 2024 cmd.exe timeout.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe PID 944 wrote to memory of 1716 944 tmp.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/944-59-0x0000000000B10000-0x0000000000B4A000-memory.dmpFilesize
232KB
-
memory/944-55-0x0000000007F80000-0x00000000080B0000-memory.dmpFilesize
1.2MB
-
memory/944-56-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/944-54-0x0000000000D50000-0x0000000000E94000-memory.dmpFilesize
1.3MB
-
memory/1716-63-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-60-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-61-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-64-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-65-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-66-0x000000000041232E-mapping.dmp
-
memory/1716-70-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-68-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1716-71-0x00000000003B0000-0x00000000003D0000-memory.dmpFilesize
128KB
-
memory/1992-58-0x0000000000000000-mapping.dmp
-
memory/2024-57-0x0000000000000000-mapping.dmp