Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-06-2022 09:18
Static task
static1
Behavioral task
behavioral1
Sample
c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe
Resource
win10v2004-20220414-en
General
-
Target
c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe
-
Size
871KB
-
MD5
a33ffa539d35983e470e67e722b80c38
-
SHA1
42568a103dfce00691c6177772cb74c1683cad10
-
SHA256
c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa5ba68811c9b5693ae86
-
SHA512
9d4235ea23bfc12aec194dfdbba1c1a05796e40d6f13b2fa43f73e7a544d2bec888e405e0f35270c356e21fa7a35740f0057262528f43061a5649b61d5d1b467
Malware Config
Extracted
redline
1
109.107.172.33:37679
-
auth_value
c6427f7951ed507d26d241ad4f19d1a6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/964-72-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/964-73-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/964-74-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/964-75-0x000000000041AD7A-mapping.dmp family_redline behavioral1/memory/964-77-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/964-79-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
Installer_ovl_sig.exepid process 972 Installer_ovl_sig.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exeInstaller_ovl_sig.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Set value (str) \REGISTRY\USER\S-1-5-21-790309383-526510583-3802439154-1000\Software\Microsoft\Windows\CurrentVersion\Run\DOSBox = "\"C:\\Users\\Admin\\AppData\\Roaming\\DOSB\\DOSBox.exe\"" Installer_ovl_sig.exe Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Installer_ovl_sig.exedescription pid process target process PID 972 set thread context of 964 972 Installer_ovl_sig.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 1772 timeout.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
powershell.exeInstaller_ovl_sig.exeInstallUtil.exepid process 936 powershell.exe 972 Installer_ovl_sig.exe 972 Installer_ovl_sig.exe 972 Installer_ovl_sig.exe 964 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
powershell.exeInstaller_ovl_sig.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 936 powershell.exe Token: SeDebugPrivilege 972 Installer_ovl_sig.exe Token: SeDebugPrivilege 964 InstallUtil.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exeInstaller_ovl_sig.execmd.exedescription pid process target process PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 1464 wrote to memory of 972 1464 c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe Installer_ovl_sig.exe PID 972 wrote to memory of 936 972 Installer_ovl_sig.exe powershell.exe PID 972 wrote to memory of 936 972 Installer_ovl_sig.exe powershell.exe PID 972 wrote to memory of 936 972 Installer_ovl_sig.exe powershell.exe PID 972 wrote to memory of 936 972 Installer_ovl_sig.exe powershell.exe PID 972 wrote to memory of 540 972 Installer_ovl_sig.exe cmd.exe PID 972 wrote to memory of 540 972 Installer_ovl_sig.exe cmd.exe PID 972 wrote to memory of 540 972 Installer_ovl_sig.exe cmd.exe PID 972 wrote to memory of 540 972 Installer_ovl_sig.exe cmd.exe PID 540 wrote to memory of 1772 540 cmd.exe timeout.exe PID 540 wrote to memory of 1772 540 cmd.exe timeout.exe PID 540 wrote to memory of 1772 540 cmd.exe timeout.exe PID 540 wrote to memory of 1772 540 cmd.exe timeout.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 1636 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe PID 972 wrote to memory of 964 972 Installer_ovl_sig.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe"C:\Users\Admin\AppData\Local\Temp\c3dd01734e71fb98a201ee38d6dffb724ccb79c2041aa.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Installer_ovl_sig.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Installer_ovl_sig.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Start-Sleep -Seconds 8;Start-Sleep -Seconds 10;3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 373⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 374⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Installer_ovl_sig.exeFilesize
362.6MB
MD57a83d80e4ad9fcd1d47c4327e1717649
SHA16ec747c0ca8b5d85c30bf0e7708610d74e4b3567
SHA25667a47e7385060b787efeb924f628e755411a5ccd3440447811c3da12b8000251
SHA512a5b6b8b7b69022c5322d1a7480591f8293b66a3f6cbdda37ad79459751980f268ac3e030d6d97152eadbe73ec6344fbdd6aa78e9d7ffcb75c820487ec8182db3
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Installer_ovl_sig.exeFilesize
362.6MB
MD57a83d80e4ad9fcd1d47c4327e1717649
SHA16ec747c0ca8b5d85c30bf0e7708610d74e4b3567
SHA25667a47e7385060b787efeb924f628e755411a5ccd3440447811c3da12b8000251
SHA512a5b6b8b7b69022c5322d1a7480591f8293b66a3f6cbdda37ad79459751980f268ac3e030d6d97152eadbe73ec6344fbdd6aa78e9d7ffcb75c820487ec8182db3
-
memory/540-67-0x0000000000000000-mapping.dmp
-
memory/936-62-0x00000000717D0000-0x0000000071D7B000-memory.dmpFilesize
5.7MB
-
memory/936-63-0x00000000717D0000-0x0000000071D7B000-memory.dmpFilesize
5.7MB
-
memory/936-59-0x0000000000000000-mapping.dmp
-
memory/936-60-0x0000000075381000-0x0000000075383000-memory.dmpFilesize
8KB
-
memory/936-61-0x00000000717D0000-0x0000000071D7B000-memory.dmpFilesize
5.7MB
-
memory/964-70-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/964-72-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/964-79-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/964-77-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/964-75-0x000000000041AD7A-mapping.dmp
-
memory/964-74-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/964-69-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/964-73-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/972-55-0x0000000000000000-mapping.dmp
-
memory/972-58-0x0000000000EE0000-0x0000000000F20000-memory.dmpFilesize
256KB
-
memory/972-66-0x00000000048E0000-0x000000000492C000-memory.dmpFilesize
304KB
-
memory/972-65-0x00000000056B0000-0x0000000005772000-memory.dmpFilesize
776KB
-
memory/1464-54-0x000007FEFBD01000-0x000007FEFBD03000-memory.dmpFilesize
8KB
-
memory/1772-68-0x0000000000000000-mapping.dmp