Analysis
-
max time kernel
90s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
25-05-2022 18:45
Static task
static1
Behavioral task
behavioral1
Sample
FL Studio/FL Studio 3.2.0.exe
Resource
win7-20220414-en
General
-
Target
FL Studio/FL Studio 3.2.0.exe
-
Size
391.3MB
-
MD5
b0c5ae4dec5a28e5c27ee33e2e1ab240
-
SHA1
d84c677bbcc05a6d28001566196f43374dfec74e
-
SHA256
792ea90eb358df40c67fb494300cd97397375f7ec46ef6311cfff06f7fa58de0
-
SHA512
dbe14ada46abd5b86fcc54e828876410b1223682a832b091e3cca31d40269f06554c3e5ad7ce043ab231856f0ae0ff7d539d1f88cf0140062c186335e95f7e05
Malware Config
Extracted
redline
1
185.106.92.81:16312
-
auth_value
54b1ff720bb86daceb65cf07d4d5ae88
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4192-135-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FL Studio 3.2.0.exedescription pid process target process PID 1484 set thread context of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
FL Studio 3.2.0.exeFL Studio 3.2.0.exepid process 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 1484 FL Studio 3.2.0.exe 4192 FL Studio 3.2.0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FL Studio 3.2.0.exeFL Studio 3.2.0.exedescription pid process Token: SeDebugPrivilege 1484 FL Studio 3.2.0.exe Token: SeDebugPrivilege 4192 FL Studio 3.2.0.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
FL Studio 3.2.0.exedescription pid process target process PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe PID 1484 wrote to memory of 4192 1484 FL Studio 3.2.0.exe FL Studio 3.2.0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FL Studio\FL Studio 3.2.0.exe"C:\Users\Admin\AppData\Local\Temp\FL Studio\FL Studio 3.2.0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\FL Studio\FL Studio 3.2.0.exe"C:\Users\Admin\AppData\Local\Temp\FL Studio\FL Studio 3.2.0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\FL Studio 3.2.0.exe.logFilesize
706B
MD5d95c58e609838928f0f49837cab7dfd2
SHA155e7139a1e3899195b92ed8771d1ca2c7d53c916
SHA2560407c814aef0d62aec7fd39b7c2f614746f0d8ff41f8ef957736f520f14b0339
SHA512405310b29a833604c6627063bfdcf055a197e01f633ef21da238f1a6415a02e21315d689b4a6669db23e82152bed6f3492afb60963e6b2a0e9bb2ac09a480b5d
-
memory/1484-130-0x0000000000C10000-0x0000000000CB6000-memory.dmpFilesize
664KB
-
memory/1484-131-0x0000000005450000-0x00000000054EC000-memory.dmpFilesize
624KB
-
memory/1484-132-0x0000000005AA0000-0x0000000006044000-memory.dmpFilesize
5.6MB
-
memory/1484-133-0x00000000054F0000-0x0000000005582000-memory.dmpFilesize
584KB
-
memory/4192-138-0x00000000058B0000-0x00000000059BA000-memory.dmpFilesize
1.0MB
-
memory/4192-136-0x0000000005DC0000-0x00000000063D8000-memory.dmpFilesize
6.1MB
-
memory/4192-137-0x0000000001E60000-0x0000000001E72000-memory.dmpFilesize
72KB
-
memory/4192-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4192-139-0x0000000001EF0000-0x0000000001F2C000-memory.dmpFilesize
240KB
-
memory/4192-140-0x0000000005A50000-0x0000000005AC6000-memory.dmpFilesize
472KB
-
memory/4192-141-0x0000000005D30000-0x0000000005D4E000-memory.dmpFilesize
120KB
-
memory/4192-142-0x00000000066C0000-0x0000000006726000-memory.dmpFilesize
408KB
-
memory/4192-143-0x0000000007210000-0x00000000073D2000-memory.dmpFilesize
1.8MB
-
memory/4192-144-0x0000000007910000-0x0000000007E3C000-memory.dmpFilesize
5.2MB
-
memory/4192-145-0x0000000007870000-0x00000000078C0000-memory.dmpFilesize
320KB
-
memory/4192-134-0x0000000000000000-mapping.dmp