Analysis
-
max time kernel
140s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 10:29
Static task
static1
Behavioral task
behavioral1
Sample
8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
Resource
win7-20220414-en
General
-
Target
8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
-
Size
732KB
-
MD5
72373a16a801b46d2647eb6e2e146538
-
SHA1
1d0e360c9d24cf3c8bbbece9f43601d8abb74fc5
-
SHA256
8734c057703087fe126636fbb1fa6b367d10e8f192307987fa3d81efdf6258c1
-
SHA512
65631c8c4080493d5125c8eaac546adb45becfab653d679b54c4e3b269e0050c11fd4aa69cf073b9ecd05e2eff2f774657892fbf3e36533b850e3f019c926986
Malware Config
Extracted
redline
777
107.175.65.144:41825
-
auth_value
8ff2bff46289ab145ce573ede9b4258f
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/920-135-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Looks for VirtualBox Guest Additions in registry 2 TTPs
-
Looks for VMWare Tools registry key 2 TTPs
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exedescription pid process target process PID 2324 set thread context of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exe8734C057703087FE126636FBB1FA6B367D10E8F192307.exepid process 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 920 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exe8734C057703087FE126636FBB1FA6B367D10E8F192307.exedescription pid process Token: SeDebugPrivilege 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe Token: SeDebugPrivilege 920 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8734C057703087FE126636FBB1FA6B367D10E8F192307.exedescription pid process target process PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe PID 2324 wrote to memory of 920 2324 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe 8734C057703087FE126636FBB1FA6B367D10E8F192307.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"1⤵
- Checks BIOS information in registry
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2324 -
C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"C:\Users\Admin\AppData\Local\Temp\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:920
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k appmodel -p -s camsvc1⤵PID:4784
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8734C057703087FE126636FBB1FA6B367D10E8F192307.exe.logFilesize
709B
MD5a1ef6491d8da3aeba79b1fb9dae7ee67
SHA15770f6bc40729e2a1bd992c63f0cad37f895b551
SHA256f7f9fadcb15620a0c2c37b15c7384fe41151b9df9496bd0aa61e04e3c768bd4e
SHA512371d5c32bf0cced0cde23bad056d25f79f3361059a571ba2cbd9b56b1a19c76849db55256de7028b6020a6ae6b6f215892a8816bad48452cce6f080e6ef5c1e6
-
memory/920-138-0x0000000007F60000-0x000000000806A000-memory.dmpFilesize
1.0MB
-
memory/920-137-0x0000000006550000-0x0000000006562000-memory.dmpFilesize
72KB
-
memory/920-145-0x0000000009C80000-0x0000000009CD0000-memory.dmpFilesize
320KB
-
memory/920-134-0x0000000000000000-mapping.dmp
-
memory/920-139-0x0000000007E90000-0x0000000007ECC000-memory.dmpFilesize
240KB
-
memory/920-136-0x0000000006590000-0x0000000006BA8000-memory.dmpFilesize
6.1MB
-
memory/920-144-0x000000000A0B0000-0x000000000A5DC000-memory.dmpFilesize
5.2MB
-
memory/920-143-0x00000000099B0000-0x0000000009B72000-memory.dmpFilesize
1.8MB
-
memory/920-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/920-140-0x0000000008C90000-0x0000000008D06000-memory.dmpFilesize
472KB
-
memory/920-141-0x0000000008DB0000-0x0000000008E42000-memory.dmpFilesize
584KB
-
memory/920-142-0x0000000008D70000-0x0000000008D8E000-memory.dmpFilesize
120KB
-
memory/2324-130-0x0000000000CB0000-0x0000000000D6C000-memory.dmpFilesize
752KB
-
memory/2324-132-0x0000000007170000-0x0000000007714000-memory.dmpFilesize
5.6MB
-
memory/2324-133-0x0000000006C80000-0x0000000006CE6000-memory.dmpFilesize
408KB
-
memory/2324-131-0x00000000056E0000-0x000000000577C000-memory.dmpFilesize
624KB