Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
23-06-2022 05:58
Static task
static1
Behavioral task
behavioral1
Sample
Pallet Mould MMS Request Order-220622.js
Resource
win7-20220414-en
General
-
Target
Pallet Mould MMS Request Order-220622.js
-
Size
323KB
-
MD5
73a4f7e471f47640742447c9613248cb
-
SHA1
bd554c8f425a9f688ab08917deac4a01d8812047
-
SHA256
64e720c53e8c90e2fb1bf2480637cd245fbf71b2e1ce3f419bb062352d21a767
-
SHA512
d48146902099a0c941bc52685dd4f4d0fab32b2d0d2ec8186616d01b19ee440b1880ba51cac02c5603c6163eea08798407e6949decbcfeb9781da3caf773cf4f
Malware Config
Extracted
redline
firstfile
103.153.79.195:24688
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\ot.exe family_redline C:\Users\Admin\AppData\Local\Temp\ot.exe family_redline behavioral2/memory/4520-135-0x0000000000F20000-0x0000000000F3E000-memory.dmp family_redline -
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
suricata: ET MALWARE EXE Download Request To Wordpress Folder Likely Malicious
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Blocklisted process makes network request 19 IoCs
Processes:
wscript.exewscript.exeflow pid process 5 1364 wscript.exe 8 4700 wscript.exe 10 1364 wscript.exe 12 1364 wscript.exe 16 4700 wscript.exe 17 4700 wscript.exe 25 4700 wscript.exe 39 4700 wscript.exe 43 4700 wscript.exe 46 4700 wscript.exe 50 4700 wscript.exe 53 4700 wscript.exe 54 4700 wscript.exe 55 4700 wscript.exe 56 4700 wscript.exe 57 4700 wscript.exe 58 4700 wscript.exe 59 4700 wscript.exe 60 4700 wscript.exe -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
ot.exepid process 4520 ot.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
wscript.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Control Panel\International\Geo\Nation wscript.exe -
Drops startup file 2 IoCs
Processes:
wscript.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cTCbdmxVaY.js wscript.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\cTCbdmxVaY.js wscript.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
wscript.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\Software\Microsoft\Windows\CurrentVersion\Run wscript.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\YVBPFHTJIQ = "\"C:\\Users\\Admin\\AppData\\Roaming\\cTCbdmxVaY.js\"" wscript.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ot.exepid process 4520 ot.exe 4520 ot.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ot.exedescription pid process Token: SeDebugPrivilege 4520 ot.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
wscript.exedescription pid process target process PID 1364 wrote to memory of 4700 1364 wscript.exe wscript.exe PID 1364 wrote to memory of 4700 1364 wscript.exe wscript.exe PID 1364 wrote to memory of 4520 1364 wscript.exe ot.exe PID 1364 wrote to memory of 4520 1364 wscript.exe ot.exe PID 1364 wrote to memory of 4520 1364 wscript.exe ot.exe
Processes
-
C:\Windows\system32\wscript.exewscript.exe "C:\Users\Admin\AppData\Local\Temp\Pallet Mould MMS Request Order-220622.js"1⤵
- Blocklisted process makes network request
- Checks computer location settings
- Suspicious use of WriteProcessMemory
PID:1364 -
C:\Windows\System32\wscript.exe"C:\Windows\System32\wscript.exe" //B "C:\Users\Admin\AppData\Roaming\cTCbdmxVaY.js"2⤵
- Blocklisted process makes network request
- Drops startup file
- Adds Run key to start application
PID:4700 -
C:\Users\Admin\AppData\Local\Temp\ot.exe"C:\Users\Admin\AppData\Local\Temp\ot.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4520
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ot.exeFilesize
95KB
MD5c50bf647703bcc0dff7ac82bec360565
SHA150ed555e1b6db733c1536931958c33e77c5817d6
SHA2561699f740bdcdb3778ca69d53dc9c5fa58edfe1a610cbaa935c40ac73f0c0bad2
SHA51281a3442c45b6b4d450cdb6fe03c406f99018b8f9faf378f9f1f35f8893d91bf7f1d5dcbae464b82e83ce529634c6ad6ceefa1369ce337c57c8aca737937f31c0
-
C:\Users\Admin\AppData\Local\Temp\ot.exeFilesize
95KB
MD5c50bf647703bcc0dff7ac82bec360565
SHA150ed555e1b6db733c1536931958c33e77c5817d6
SHA2561699f740bdcdb3778ca69d53dc9c5fa58edfe1a610cbaa935c40ac73f0c0bad2
SHA51281a3442c45b6b4d450cdb6fe03c406f99018b8f9faf378f9f1f35f8893d91bf7f1d5dcbae464b82e83ce529634c6ad6ceefa1369ce337c57c8aca737937f31c0
-
C:\Users\Admin\AppData\Roaming\cTCbdmxVaY.jsFilesize
117KB
MD56f9a6d27e187b06e52400a4706bb8534
SHA1287e663903d52b0cfb261826cf4c16948149aae7
SHA256d7504dcb980027e4c2d23b2fe2594294e2ad424ed9c33b58496d39bde5c05d44
SHA512c69ed1e4e59bc4ca19b52551cb5533921e952005fda3c8b824584c8274175dc1a1bc573cd71d373e2c496e14c0aa01ebbde222fa1aeb787bd9e82c7278ffbfb4
-
memory/4520-138-0x0000000005900000-0x000000000593C000-memory.dmpFilesize
240KB
-
memory/4520-140-0x0000000006E90000-0x0000000007052000-memory.dmpFilesize
1.8MB
-
memory/4520-135-0x0000000000F20000-0x0000000000F3E000-memory.dmpFilesize
120KB
-
memory/4520-136-0x0000000005FD0000-0x00000000065E8000-memory.dmpFilesize
6.1MB
-
memory/4520-137-0x00000000058A0000-0x00000000058B2000-memory.dmpFilesize
72KB
-
memory/4520-146-0x0000000007530000-0x000000000754E000-memory.dmpFilesize
120KB
-
memory/4520-139-0x0000000005BB0000-0x0000000005CBA000-memory.dmpFilesize
1.0MB
-
memory/4520-132-0x0000000000000000-mapping.dmp
-
memory/4520-141-0x0000000007590000-0x0000000007ABC000-memory.dmpFilesize
5.2MB
-
memory/4520-142-0x0000000006E20000-0x0000000006E86000-memory.dmpFilesize
408KB
-
memory/4520-143-0x0000000008070000-0x0000000008614000-memory.dmpFilesize
5.6MB
-
memory/4520-144-0x0000000007390000-0x0000000007422000-memory.dmpFilesize
584KB
-
memory/4520-145-0x0000000007430000-0x00000000074A6000-memory.dmpFilesize
472KB
-
memory/4700-130-0x0000000000000000-mapping.dmp