Analysis

  • max time kernel
    107s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    05-06-2022 07:27

General

  • Target

    0b757d38d347d1f763f59ab7f0423ae8.exe

  • Size

    406KB

  • MD5

    0b757d38d347d1f763f59ab7f0423ae8

  • SHA1

    fcf1b343ab5c7f9ac72fc6c85b3c478c5875f577

  • SHA256

    2105710d19c34b91be3a37c24ab4a4835dcdc606c0f2d8b487beb0d24e336124

  • SHA512

    0b9661590897256242ddc4ea43d069999e1ddca9d7fed671a6aa31a60f0da4bd820b8bb6c2502fa1b7979dea932375e2363e882e31379935751af1cdf2ce7d94

Malware Config

Extracted

Family

redline

Botnet

X

C2

194.127.179.35:35180

Attributes
  • auth_value

    76e43cff05002e5f6e3334fa7946e404

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • Executes dropped EXE 3 IoCs
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Suspicious use of SetThreadContext 3 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Creates scheduled task(s) 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b757d38d347d1f763f59ab7f0423ae8.exe
    "C:\Users\Admin\AppData\Local\Temp\0b757d38d347d1f763f59ab7f0423ae8.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious behavior: RenamesItself
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\chromedrivers32.exe'" /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3396
      • C:\Windows\system32\schtasks.exe
        schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\chromedrivers32.exe'" /f
        3⤵
        • Creates scheduled task(s)
        PID:4124
    • C:\Windows\SYSTEM32\cmd.exe
      "cmd.exe" /C copy "C:\Users\Admin\AppData\Local\Temp\0b757d38d347d1f763f59ab7f0423ae8.exe" "C:\Users\Admin\AppData\Roaming\chromedrivers32.exe"
      2⤵
        PID:3124
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1180
      • C:\Users\Admin\AppData\Local\Temp\WinRar Activator.exe
        "C:\Users\Admin\AppData\Local\Temp\WinRar Activator.exe"
        2⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:3828
    • C:\Users\Admin\AppData\Roaming\chromedrivers32.exe
      C:\Users\Admin\AppData\Roaming\chromedrivers32.exe
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:880
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\chromedrivers32.exe'" /f
        2⤵
        • Suspicious use of WriteProcessMemory
        PID:1640
        • C:\Windows\system32\schtasks.exe
          schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\chromedrivers32.exe'" /f
          3⤵
          • Creates scheduled task(s)
          PID:3892
      • C:\Windows\system32\cmd.exe
        "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\chromedrivers32.exe" "C:\Users\Admin\AppData\Roaming\chromedrivers32.exe"
        2⤵
          PID:1176
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4456
      • C:\Users\Admin\AppData\Roaming\chromedrivers32.exe
        C:\Users\Admin\AppData\Roaming\chromedrivers32.exe
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:3012
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\chromedrivers32.exe'" /f
          2⤵
          • Suspicious use of WriteProcessMemory
          PID:2964
          • C:\Windows\system32\schtasks.exe
            schtasks /create /sc minute /mo 1 /tn "Nafdnasia" /tr "'C:\Users\Admin\AppData\Roaming\chromedrivers32.exe'" /f
            3⤵
            • Creates scheduled task(s)
            PID:4108
        • C:\Windows\system32\cmd.exe
          "cmd.exe" /C copy "C:\Users\Admin\AppData\Roaming\chromedrivers32.exe" "C:\Users\Admin\AppData\Roaming\chromedrivers32.exe"
          2⤵
            PID:1556
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
            • Suspicious behavior: EnumeratesProcesses
            • Suspicious use of AdjustPrivilegeToken
            PID:4592

        Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\chromedrivers32.exe.log

          Filesize

          859B

          MD5

          6e11a15fe4491ead2a94f64d3467be38

          SHA1

          9a8329fb71ddc89dae9aa174c0b44a1f646efd63

          SHA256

          087cf6355ae9fc71eea2493b30c6b10a6775f3dd68b2cb5e07fcc13461b74248

          SHA512

          6154e320e2556aef177fc5bfb4e5fe8fabe324af736b89db4db41e6dd51658f7f6a7d0f73c24dc6ccdc4edf14023f4a1ecd0908abac5b82cebd038a93b2fc106

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.log

          Filesize

          2KB

          MD5

          9c49939c6bad2727502a6d536f8a3516

          SHA1

          b5eefe41d4e8fe019da07c5ca0f18651fa23934e

          SHA256

          64ba592b4ea398f8525140a1b5693a3e9a0e899d9afae5b6d8b150190c2c4f3a

          SHA512

          40cd10bebcc4a71f3038f8cdd6c06e9ea7b61e4758f70f80f48f31ec57b5e4e64b169a8f70cf6ed35a60e4368191e0f5dea29c049d49898334230cc148ebb477

        • C:\Users\Admin\AppData\Local\Temp\WinRar Activator.exe

          Filesize

          259KB

          MD5

          f385414230d858b00cbe7ffe3daa5928

          SHA1

          04f24e4f0bab06e7d58fc39b328baf382dae9cff

          SHA256

          b9ef9b0ae62b70c0ee11f8ff8bc87e2a7b91c2ebbd46af1a29bc5b4119145335

          SHA512

          1f9ad4545b37f2953f1e0f9c9409cc960d7cf30d926c80fb58e92924566d20b3ecf7a971a93f998da105c5e8b36ff5a6b9de46d29a7accd0f96ed9d1c0efb8c2

        • C:\Users\Admin\AppData\Local\Temp\WinRar Activator.exe

          Filesize

          259KB

          MD5

          f385414230d858b00cbe7ffe3daa5928

          SHA1

          04f24e4f0bab06e7d58fc39b328baf382dae9cff

          SHA256

          b9ef9b0ae62b70c0ee11f8ff8bc87e2a7b91c2ebbd46af1a29bc5b4119145335

          SHA512

          1f9ad4545b37f2953f1e0f9c9409cc960d7cf30d926c80fb58e92924566d20b3ecf7a971a93f998da105c5e8b36ff5a6b9de46d29a7accd0f96ed9d1c0efb8c2

        • C:\Users\Admin\AppData\Roaming\chromedrivers32.exe

          Filesize

          406KB

          MD5

          0b757d38d347d1f763f59ab7f0423ae8

          SHA1

          fcf1b343ab5c7f9ac72fc6c85b3c478c5875f577

          SHA256

          2105710d19c34b91be3a37c24ab4a4835dcdc606c0f2d8b487beb0d24e336124

          SHA512

          0b9661590897256242ddc4ea43d069999e1ddca9d7fed671a6aa31a60f0da4bd820b8bb6c2502fa1b7979dea932375e2363e882e31379935751af1cdf2ce7d94

        • C:\Users\Admin\AppData\Roaming\chromedrivers32.exe

          Filesize

          406KB

          MD5

          0b757d38d347d1f763f59ab7f0423ae8

          SHA1

          fcf1b343ab5c7f9ac72fc6c85b3c478c5875f577

          SHA256

          2105710d19c34b91be3a37c24ab4a4835dcdc606c0f2d8b487beb0d24e336124

          SHA512

          0b9661590897256242ddc4ea43d069999e1ddca9d7fed671a6aa31a60f0da4bd820b8bb6c2502fa1b7979dea932375e2363e882e31379935751af1cdf2ce7d94

        • C:\Users\Admin\AppData\Roaming\chromedrivers32.exe

          Filesize

          406KB

          MD5

          0b757d38d347d1f763f59ab7f0423ae8

          SHA1

          fcf1b343ab5c7f9ac72fc6c85b3c478c5875f577

          SHA256

          2105710d19c34b91be3a37c24ab4a4835dcdc606c0f2d8b487beb0d24e336124

          SHA512

          0b9661590897256242ddc4ea43d069999e1ddca9d7fed671a6aa31a60f0da4bd820b8bb6c2502fa1b7979dea932375e2363e882e31379935751af1cdf2ce7d94

        • memory/880-166-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/880-162-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/1176-161-0x0000000000000000-mapping.dmp

        • memory/1180-154-0x0000000006AF0000-0x0000000006CB2000-memory.dmp

          Filesize

          1.8MB

        • memory/1180-153-0x0000000005C70000-0x0000000005CD6000-memory.dmp

          Filesize

          408KB

        • memory/1180-142-0x00000000005C0000-0x00000000005E0000-memory.dmp

          Filesize

          128KB

        • memory/1180-135-0x0000000000400000-0x0000000000420000-memory.dmp

          Filesize

          128KB

        • memory/1180-144-0x00000000052D0000-0x00000000058E8000-memory.dmp

          Filesize

          6.1MB

        • memory/1180-145-0x0000000004CE0000-0x0000000004CF2000-memory.dmp

          Filesize

          72KB

        • memory/1180-146-0x0000000004E10000-0x0000000004F1A000-memory.dmp

          Filesize

          1.0MB

        • memory/1180-147-0x0000000004D40000-0x0000000004D7C000-memory.dmp

          Filesize

          240KB

        • memory/1180-148-0x0000000005080000-0x00000000050F6000-memory.dmp

          Filesize

          472KB

        • memory/1180-149-0x00000000051A0000-0x0000000005232000-memory.dmp

          Filesize

          584KB

        • memory/1180-150-0x0000000005EA0000-0x0000000006444000-memory.dmp

          Filesize

          5.6MB

        • memory/1180-151-0x0000000005280000-0x000000000529E000-memory.dmp

          Filesize

          120KB

        • memory/1180-136-0x000000000041ADAE-mapping.dmp

        • memory/1180-156-0x0000000006A70000-0x0000000006AC0000-memory.dmp

          Filesize

          320KB

        • memory/1180-155-0x0000000007860000-0x0000000007D8C000-memory.dmp

          Filesize

          5.2MB

        • memory/1556-171-0x0000000000000000-mapping.dmp

        • memory/1640-159-0x0000000000000000-mapping.dmp

        • memory/2964-169-0x0000000000000000-mapping.dmp

        • memory/3012-172-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/3012-175-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/3016-141-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/3016-130-0x00000000009F0000-0x0000000000A58000-memory.dmp

          Filesize

          416KB

        • memory/3016-134-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/3124-133-0x0000000000000000-mapping.dmp

        • memory/3396-131-0x0000000000000000-mapping.dmp

        • memory/3828-152-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/3828-143-0x00007FFF9B510000-0x00007FFF9BFD1000-memory.dmp

          Filesize

          10.8MB

        • memory/3828-140-0x0000015AAA210000-0x0000015AAA256000-memory.dmp

          Filesize

          280KB

        • memory/3828-137-0x0000000000000000-mapping.dmp

        • memory/3892-160-0x0000000000000000-mapping.dmp

        • memory/4108-170-0x0000000000000000-mapping.dmp

        • memory/4124-132-0x0000000000000000-mapping.dmp

        • memory/4456-164-0x000000000041ADAE-mapping.dmp

        • memory/4592-174-0x000000000041ADAE-mapping.dmp