Analysis
-
max time kernel
91s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
29-06-2022 15:10
Static task
static1
Behavioral task
behavioral1
Sample
ExpressVPN.exe
Resource
win7-20220414-en
General
-
Target
ExpressVPN.exe
-
Size
186KB
-
MD5
2620c49e134e1d07fbefe1d3700d72a5
-
SHA1
592f0a98c0143750393635bcf419736c1498f1c1
-
SHA256
7e9e6feb29bbd8c51fb07675a8083b2613ae20b5f121e49d1489432cf00d7a67
-
SHA512
dce4326cde61a37a1e65316cc1419089caa456d0b2f959585c1c982abd62f29031c37e6f86bcdca19a0c50fe4ab69ad2b6f73901c5c8fa38ef5703ab4169a265
Malware Config
Extracted
redline
2
23.88.39.22:43679
-
auth_value
06ade036180b58333a41a7537c92df05
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/532-134-0x0000000000000000-mapping.dmp family_redline behavioral2/memory/532-135-0x0000000000400000-0x0000000000422000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
ExpressVPN.exedescription pid process target process PID 3440 set thread context of 532 3440 ExpressVPN.exe ExpressVPN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ExpressVPN.exedescription pid process Token: SeDebugPrivilege 532 ExpressVPN.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
ExpressVPN.exedescription pid process target process PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe PID 3440 wrote to memory of 532 3440 ExpressVPN.exe ExpressVPN.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExpressVPN.exe"C:\Users\Admin\AppData\Local\Temp\ExpressVPN.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ExpressVPN.exeC:\Users\Admin\AppData\Local\Temp\ExpressVPN.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\ExpressVPN.exe.logFilesize
700B
MD5e5352797047ad2c91b83e933b24fbc4f
SHA19bf8ac99b6cbf7ce86ce69524c25e3df75b4d772
SHA256b4643874d42d232c55bfbb75c36da41809d0c9ba4b2a203049aa82950345325c
SHA512dd2fc1966c8b3c9511f14801d1ce8110d6bca276a58216b5eeb0a3cfbb0cc8137ea14efbf790e63736230141da456cbaaa4e5c66f2884d4cfe68f499476fd827
-
memory/532-139-0x00000000077A0000-0x00000000077DC000-memory.dmpFilesize
240KB
-
memory/532-138-0x0000000007870000-0x000000000797A000-memory.dmpFilesize
1.0MB
-
memory/532-143-0x000000000A380000-0x000000000A8AC000-memory.dmpFilesize
5.2MB
-
memory/532-134-0x0000000000000000-mapping.dmp
-
memory/532-135-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/532-136-0x0000000005DF0000-0x0000000006408000-memory.dmpFilesize
6.1MB
-
memory/532-137-0x0000000007710000-0x0000000007722000-memory.dmpFilesize
72KB
-
memory/532-142-0x0000000009C80000-0x0000000009E42000-memory.dmpFilesize
1.8MB
-
memory/532-141-0x0000000008790000-0x0000000008822000-memory.dmpFilesize
584KB
-
memory/532-140-0x0000000008580000-0x00000000085E6000-memory.dmpFilesize
408KB
-
memory/3440-130-0x0000000000490000-0x00000000004C6000-memory.dmpFilesize
216KB
-
memory/3440-132-0x0000000004F50000-0x0000000004F6E000-memory.dmpFilesize
120KB
-
memory/3440-133-0x0000000007C20000-0x00000000081C4000-memory.dmpFilesize
5.6MB
-
memory/3440-131-0x0000000007560000-0x00000000075D6000-memory.dmpFilesize
472KB