Analysis
-
max time kernel
57s -
max time network
60s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 16:48
Static task
static1
Behavioral task
behavioral1
Sample
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe
Resource
win10-20220414-en
General
-
Target
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe
-
Size
1.2MB
-
MD5
c52e23f559f027c6af598ff0a4c3497d
-
SHA1
0e6de0682ae5d89a6530a6c6e03054f5aaeb0662
-
SHA256
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021
-
SHA512
802159c0fa6034dfc4278ee470aef46a52947006b007ae6a90391377d6c9b3774c999c30ab8d62a10869bf4d459736da4b70ce97d7771bf849effff7714e6428
Malware Config
Extracted
redline
test1
23.88.112.179:19536
-
auth_value
68c6114f4d4c471ad88677f54e75676f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4772-121-0x0000000002F60000-0x0000000002F80000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4236190499-842014725-259441995-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lrjaaawiu = "\"C:\\Users\\Admin\\AppData\\Roaming\\Cdyynpvt\\Lrjaaawiu.exe\"" 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exedescription pid process target process PID 4316 set thread context of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2136 timeout.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exeInstallUtil.exepid process 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe 4772 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe Token: SeDebugPrivilege 4772 InstallUtil.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.execmd.exedescription pid process target process PID 4316 wrote to memory of 4452 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe cmd.exe PID 4316 wrote to memory of 4452 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe cmd.exe PID 4316 wrote to memory of 4452 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe cmd.exe PID 4452 wrote to memory of 2136 4452 cmd.exe timeout.exe PID 4452 wrote to memory of 2136 4452 cmd.exe timeout.exe PID 4452 wrote to memory of 2136 4452 cmd.exe timeout.exe PID 4316 wrote to memory of 2832 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 2832 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 2832 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe PID 4316 wrote to memory of 4772 4316 409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe"C:\Users\Admin\AppData\Local\Temp\409a345a063f2fc853b7b45c060970231d9fdc6b453444ae855b7fda4be50021.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2136-117-0x0000000000000000-mapping.dmp
-
memory/4316-114-0x0000000000ED0000-0x0000000001014000-memory.dmpFilesize
1.3MB
-
memory/4316-115-0x0000000008E70000-0x0000000008FA0000-memory.dmpFilesize
1.2MB
-
memory/4316-118-0x0000000005840000-0x000000000587A000-memory.dmpFilesize
232KB
-
memory/4452-116-0x0000000000000000-mapping.dmp
-
memory/4772-124-0x0000000007C60000-0x0000000007D6A000-memory.dmpFilesize
1.0MB
-
memory/4772-126-0x0000000007BD0000-0x0000000007C1B000-memory.dmpFilesize
300KB
-
memory/4772-121-0x0000000002F60000-0x0000000002F80000-memory.dmpFilesize
128KB
-
memory/4772-122-0x0000000008120000-0x0000000008726000-memory.dmpFilesize
6.0MB
-
memory/4772-123-0x0000000007B30000-0x0000000007B42000-memory.dmpFilesize
72KB
-
memory/4772-120-0x000000000041232E-mapping.dmp
-
memory/4772-125-0x0000000007B90000-0x0000000007BCE000-memory.dmpFilesize
248KB
-
memory/4772-119-0x0000000000400000-0x0000000000418000-memory.dmpFilesize
96KB
-
memory/4772-127-0x0000000008C30000-0x000000000912E000-memory.dmpFilesize
5.0MB
-
memory/4772-128-0x0000000007EC0000-0x0000000007F26000-memory.dmpFilesize
408KB
-
memory/4772-129-0x0000000009230000-0x00000000092A6000-memory.dmpFilesize
472KB
-
memory/4772-130-0x00000000092B0000-0x0000000009342000-memory.dmpFilesize
584KB
-
memory/4772-131-0x0000000009470000-0x000000000948E000-memory.dmpFilesize
120KB
-
memory/4772-132-0x000000000A1B0000-0x000000000A200000-memory.dmpFilesize
320KB
-
memory/4772-133-0x000000000A3D0000-0x000000000A592000-memory.dmpFilesize
1.8MB
-
memory/4772-134-0x000000000AAD0000-0x000000000AFFC000-memory.dmpFilesize
5.2MB