Analysis
-
max time kernel
152s -
max time network
171s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-06-2022 07:41
Behavioral task
behavioral1
Sample
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe
Resource
win7-20220414-en
General
-
Target
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe
-
Size
7.1MB
-
MD5
a776b0fb7cc1b3870f6234a12fbfb377
-
SHA1
7b3f180a2af62f06b8162e7290287202d6d80b41
-
SHA256
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2
-
SHA512
f95909227004c610c52ca1d65ed3e8aff27dd5750c55b6a31f931e5c3e4089f305e648cb33f3be94e350625feaf7716f58b99bb541c60292ea7dd1d7d17b4f42
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2088-135-0x00000000003B0000-0x0000000000EAA000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe -
Processes:
resource yara_rule behavioral2/memory/2088-135-0x00000000003B0000-0x0000000000EAA000-memory.dmp vmprotect -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe -
Processes:
resource yara_rule behavioral2/memory/2088-135-0x00000000003B0000-0x0000000000EAA000-memory.dmp themida -
Processes:
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exepid process 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exepid process 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe 2088 3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe"C:\Users\Admin\AppData\Local\Temp\3239ffaad610ff9934720350efe132dd9ca3fd8d1d812a67d1449c531e5782f2.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
PID:2088
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2088-130-0x00000000003B0000-0x0000000000EAA000-memory.dmpFilesize
11.0MB
-
memory/2088-131-0x00000000003B0000-0x0000000000EAA000-memory.dmpFilesize
11.0MB
-
memory/2088-134-0x00000000774C0000-0x0000000077663000-memory.dmpFilesize
1.6MB
-
memory/2088-135-0x00000000003B0000-0x0000000000EAA000-memory.dmpFilesize
11.0MB
-
memory/2088-136-0x0000000006360000-0x0000000006904000-memory.dmpFilesize
5.6MB
-
memory/2088-137-0x0000000005E90000-0x0000000005F22000-memory.dmpFilesize
584KB
-
memory/2088-138-0x0000000006F30000-0x0000000007548000-memory.dmpFilesize
6.1MB
-
memory/2088-139-0x00000000062F0000-0x0000000006302000-memory.dmpFilesize
72KB
-
memory/2088-140-0x0000000006BF0000-0x0000000006CFA000-memory.dmpFilesize
1.0MB
-
memory/2088-141-0x0000000006B40000-0x0000000006B7C000-memory.dmpFilesize
240KB
-
memory/2088-142-0x00000000003B0000-0x0000000000EAA000-memory.dmpFilesize
11.0MB
-
memory/2088-143-0x00000000003B0000-0x0000000000EAA000-memory.dmpFilesize
11.0MB
-
memory/2088-144-0x00000000774C0000-0x0000000077663000-memory.dmpFilesize
1.6MB