Analysis
-
max time kernel
59s -
max time network
61s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
14-05-2022 15:03
Static task
static1
Behavioral task
behavioral1
Sample
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe
Resource
win10v2004-20220414-en
General
-
Target
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe
-
Size
1.2MB
-
MD5
c52e23f559f027c6af598ff0a4c3497d
-
SHA1
0e6de0682ae5d89a6530a6c6e03054f5aaeb0662
-
SHA256
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021
-
SHA512
802159c0fa6034dfc4278ee470aef46a52947006b007ae6a90391377d6c9b3774c999c30ab8d62a10869bf4d459736da4b70ce97d7771bf849effff7714e6428
Malware Config
Extracted
redline
test1
23.88.112.179:19536
-
auth_value
68c6114f4d4c471ad88677f54e75676f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/948-71-0x00000000003E0000-0x0000000000400000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lrjaaawiu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cdyynpvt\\Lrjaaawiu.exe\"" 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exedescription pid process target process PID 1464 set thread context of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1628 timeout.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exeInstallUtil.exepid process 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe 948 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b45344.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe Token: SeDebugPrivilege 948 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b45344.execmd.exedescription pid process target process PID 1464 wrote to memory of 2032 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe cmd.exe PID 1464 wrote to memory of 2032 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe cmd.exe PID 1464 wrote to memory of 2032 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe cmd.exe PID 1464 wrote to memory of 2032 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe cmd.exe PID 2032 wrote to memory of 1628 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1628 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1628 2032 cmd.exe timeout.exe PID 2032 wrote to memory of 1628 2032 cmd.exe timeout.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe PID 1464 wrote to memory of 948 1464 409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe"C:\Users\Admin\AppData\Local\Temp\409a345a063f2fc853b7b45c060970231d9fdc6b45344.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/948-64-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/948-65-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/948-71-0x00000000003E0000-0x0000000000400000-memory.dmpFilesize
128KB
-
memory/948-68-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/948-70-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/948-66-0x000000000041232E-mapping.dmp
-
memory/948-61-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/948-63-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/948-60-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/1464-54-0x00000000008D0000-0x0000000000A14000-memory.dmpFilesize
1.3MB
-
memory/1464-55-0x0000000008160000-0x0000000008290000-memory.dmpFilesize
1.2MB
-
memory/1464-59-0x0000000000760000-0x000000000079A000-memory.dmpFilesize
232KB
-
memory/1464-56-0x00000000754A1000-0x00000000754A3000-memory.dmpFilesize
8KB
-
memory/1628-58-0x0000000000000000-mapping.dmp
-
memory/2032-57-0x0000000000000000-mapping.dmp