Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
28-06-2022 00:53
General
-
Target
a1cabc41c47bc8c55ec51ecd17dbcd1e43db85dc00450872cbfeccc7b1932d45.exe
-
Size
227KB
-
MD5
50d681b70823812ed7a9bed0e0c7da16
-
SHA1
cdbae43b6289b7f1b7c8f34dc68aafacd44162da
-
SHA256
a1cabc41c47bc8c55ec51ecd17dbcd1e43db85dc00450872cbfeccc7b1932d45
-
SHA512
057684fd30e543a439325eadc2cbf1705eb0a4db9e756c8ca3c817ce22e7fe58a5bfd7408e52949bb2ea876797f7ed29559c2a33346f20bd73bb65af7601d662
Malware Config
Extracted
redline
mario2
193.106.191.129:80
-
auth_value
4ef7e3fec3a418b2f0233b604d0560d9
Signatures
-
RecordBreaker
RecordBreaker is an information stealer capable of downloading and executing secondary payloads written in C++.
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
-
suricata: ET MALWARE Generic Stealer Config Download Request
suricata: ET MALWARE Generic Stealer Config Download Request
-
suricata: ET MALWARE Win32/RecordBreaker CnC Checkin
suricata: ET MALWARE Win32/RecordBreaker CnC Checkin
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
-
Program crash 1 IoCs
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
-
Suspicious behavior: MapViewOfSection 5 IoCs
-
Suspicious use of AdjustPrivilegeToken 23 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1cabc41c47bc8c55ec51ecd17dbcd1e43db85dc00450872cbfeccc7b1932d45.exe"C:\Users\Admin\AppData\Local\Temp\a1cabc41c47bc8c55ec51ecd17dbcd1e43db85dc00450872cbfeccc7b1932d45.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\5C78.exeC:\Users\Admin\AppData\Local\Temp\5C78.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\8E95.exeC:\Users\Admin\AppData\Local\Temp\8E95.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe1⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1532 -s 8682⤵
- Program crash
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 176 -p 1532 -ip 15321⤵
-
C:\Windows\explorer.exeC:\Windows\explorer.exe1⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD5df9cc49add3e01f23c63b0f73469f752
SHA16f8199ae9280e13671f5eb5715b093cd93f6732e
SHA256b18d30fdfaa2f3469131da279fe2a64ed3cf6c1cbc8785ea1ba6e7596ae85419
SHA51209100b76b4d0ba5a417da4a68977ed0a9eba8563cc5866e0cf912234ebded7598c482967e1812c143868c43c49eb882f82588dfafc041698b814c564decfc9b5
-
Filesize
1.6MB
MD5df9cc49add3e01f23c63b0f73469f752
SHA16f8199ae9280e13671f5eb5715b093cd93f6732e
SHA256b18d30fdfaa2f3469131da279fe2a64ed3cf6c1cbc8785ea1ba6e7596ae85419
SHA51209100b76b4d0ba5a417da4a68977ed0a9eba8563cc5866e0cf912234ebded7598c482967e1812c143868c43c49eb882f82588dfafc041698b814c564decfc9b5
-
Filesize
6.6MB
MD5a840af25865513286606284b38490add
SHA13ab6eaaa2457f3afc1a37645152a91efa95751af
SHA25626923ba499b7c445e86e76c616dee82cd5699de4bdfcf61d3e09562b36f2fbad
SHA512fec4a023ac03aa0733d6e4f11dd9f79c1329b2b73acd543e85b96d2fd32de4374a26250dd36f82919e32bd022fa3e753c8bf09cdb9e92670314ba0f7ef38ceb6
-
Filesize
6.6MB
MD5a840af25865513286606284b38490add
SHA13ab6eaaa2457f3afc1a37645152a91efa95751af
SHA25626923ba499b7c445e86e76c616dee82cd5699de4bdfcf61d3e09562b36f2fbad
SHA512fec4a023ac03aa0733d6e4f11dd9f79c1329b2b73acd543e85b96d2fd32de4374a26250dd36f82919e32bd022fa3e753c8bf09cdb9e92670314ba0f7ef38ceb6
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4.0MB
-
Filesize
1.3MB
-
Filesize
1.3MB
-
Filesize
4.0MB
-
Filesize
1.3MB
-
Filesize
428KB
-
Filesize
428KB
-
Filesize
464KB
-
Filesize
1.0MB
-
Filesize
584KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
320KB
-
Filesize
120KB
-
Filesize
5.6MB
-
Filesize
240KB
-
Filesize
128KB
-
Filesize
128KB
-
Filesize
472KB
-
Filesize
6.1MB
-
Filesize
72KB
-
Filesize
408KB
-
Filesize
2.2MB
-
Filesize
52KB
-
Filesize
36KB
-
Filesize
2.2MB
-
Filesize
10.4MB
-
Filesize
10.4MB
-
Filesize
48KB