Analysis
-
max time kernel
99s -
max time network
113s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
01-07-2022 04:54
Static task
static1
Behavioral task
behavioral1
Sample
4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe
Resource
win10-20220414-en
General
-
Target
4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe
-
Size
27KB
-
MD5
81f50fe47ac1b8b6f31be0b0f131c985
-
SHA1
6f13ad3a8edc7cdc1420eeca600c3614bb23ddb6
-
SHA256
4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a
-
SHA512
3b2a3703f6a0482cb3e013ccc236fd1af3434faf5b9644695aa18c017c3b5e735bee0ea53f1860802385388b1c885772ef1aa42694b449cb43200599be6a4f34
Malware Config
Extracted
redline
build
172.93.213.137:7525
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3732-291-0x000000000041972E-mapping.dmp family_redline behavioral1/memory/3732-324-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exedescription pid process target process PID 1184 set thread context of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
powershell.exe4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exeInstallUtil.exepid process 648 powershell.exe 648 powershell.exe 648 powershell.exe 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe 3732 InstallUtil.exe 3732 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe Token: SeDebugPrivilege 648 powershell.exe Token: SeDebugPrivilege 3732 InstallUtil.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exedescription pid process target process PID 1184 wrote to memory of 648 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe powershell.exe PID 1184 wrote to memory of 648 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe powershell.exe PID 1184 wrote to memory of 648 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe powershell.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe PID 1184 wrote to memory of 3732 1184 4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe"C:\Users\Admin\AppData\Local\Temp\4166e18c7fd477f49df50800f77f4c5328ac8ecb5ab561a2031061312fe4c59a.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-203-0x0000000000000000-mapping.dmp
-
memory/648-239-0x00000000010E0000-0x0000000001116000-memory.dmpFilesize
216KB
-
memory/648-244-0x00000000070F0000-0x0000000007718000-memory.dmpFilesize
6.2MB
-
memory/648-259-0x0000000006E90000-0x0000000006EB2000-memory.dmpFilesize
136KB
-
memory/648-263-0x0000000006F30000-0x0000000006F96000-memory.dmpFilesize
408KB
-
memory/648-285-0x0000000008E70000-0x0000000008E8A000-memory.dmpFilesize
104KB
-
memory/648-284-0x0000000009740000-0x0000000009DB8000-memory.dmpFilesize
6.5MB
-
memory/648-270-0x0000000008280000-0x00000000082CB000-memory.dmpFilesize
300KB
-
memory/648-269-0x00000000079A0000-0x00000000079BC000-memory.dmpFilesize
112KB
-
memory/648-266-0x00000000079C0000-0x0000000007D10000-memory.dmpFilesize
3.3MB
-
memory/648-265-0x0000000007720000-0x0000000007786000-memory.dmpFilesize
408KB
-
memory/1184-157-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-164-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-124-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-125-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-126-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-128-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-127-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-129-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-130-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-131-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-132-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-133-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-134-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-136-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-135-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-139-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-138-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-137-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-140-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-141-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-142-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-143-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-144-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-145-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-146-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-147-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-148-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-149-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-150-0x00000000009C0000-0x00000000009CC000-memory.dmpFilesize
48KB
-
memory/1184-151-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-152-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-153-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-154-0x0000000005870000-0x0000000005D6E000-memory.dmpFilesize
5.0MB
-
memory/1184-155-0x0000000005270000-0x0000000005302000-memory.dmpFilesize
584KB
-
memory/1184-156-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-122-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-158-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-159-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-161-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-162-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-160-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-123-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-163-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-165-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-166-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-167-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-168-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-170-0x0000000002D70000-0x0000000002D7A000-memory.dmpFilesize
40KB
-
memory/1184-169-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-171-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-172-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-173-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-174-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-175-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-176-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-177-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-178-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-179-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-180-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-181-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-182-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-121-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-120-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-119-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-118-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-117-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-116-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-183-0x0000000077E40000-0x0000000077FCE000-memory.dmpFilesize
1.6MB
-
memory/1184-190-0x0000000006430000-0x00000000064F8000-memory.dmpFilesize
800KB
-
memory/1184-191-0x0000000006580000-0x00000000065F6000-memory.dmpFilesize
472KB
-
memory/1184-192-0x0000000005850000-0x000000000586E000-memory.dmpFilesize
120KB
-
memory/1184-193-0x00000000067C0000-0x000000000680C000-memory.dmpFilesize
304KB
-
memory/3732-291-0x000000000041972E-mapping.dmp
-
memory/3732-324-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3732-327-0x0000000005580000-0x0000000005B86000-memory.dmpFilesize
6.0MB
-
memory/3732-329-0x0000000004FA0000-0x0000000004FB2000-memory.dmpFilesize
72KB
-
memory/3732-334-0x0000000005000000-0x000000000503E000-memory.dmpFilesize
248KB
-
memory/3732-344-0x0000000005040000-0x000000000508B000-memory.dmpFilesize
300KB
-
memory/3732-346-0x00000000052A0000-0x00000000053AA000-memory.dmpFilesize
1.0MB
-
memory/3732-375-0x00000000062A0000-0x0000000006462000-memory.dmpFilesize
1.8MB
-
memory/3732-376-0x00000000069A0000-0x0000000006ECC000-memory.dmpFilesize
5.2MB