Analysis
-
max time kernel
91s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-07-2022 02:35
Static task
static1
Behavioral task
behavioral1
Sample
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe
Resource
win10v2004-20220414-en
General
-
Target
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe
-
Size
25KB
-
MD5
6834926c30fd22ac84c7644f591368fe
-
SHA1
1604ee348152008cbf7559b477139557531ce141
-
SHA256
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456
-
SHA512
16309e049e62b7fda55e64821e3b7164b88a9405a7edca12f9e97ca8afba22c63fb7e7e130ce5a3aee95b67bc466a105b26a64f202c595f17e3d0080c6e7a035
Malware Config
Extracted
redline
build
172.93.213.137:7525
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3828-145-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\Control Panel\International\Geo\Nation e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exedescription pid process target process PID 2748 set thread context of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exee88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exeInstallUtil.exepid process 2236 powershell.exe 2236 powershell.exe 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe 3828 InstallUtil.exe 3828 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe Token: SeDebugPrivilege 2236 powershell.exe Token: SeDebugPrivilege 3828 InstallUtil.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exedescription pid process target process PID 2748 wrote to memory of 2236 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe powershell.exe PID 2748 wrote to memory of 2236 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe powershell.exe PID 2748 wrote to memory of 2236 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe powershell.exe PID 2748 wrote to memory of 2108 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 2108 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 2108 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe PID 2748 wrote to memory of 3828 2748 e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe"C:\Users\Admin\AppData\Local\Temp\e88c0fce057fa8b8ede91c4a7dad3d1ac44d778ee07c53867d0a43c27b80b456.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2108-143-0x0000000000000000-mapping.dmp
-
memory/2236-142-0x0000000006330000-0x000000000634A000-memory.dmpFilesize
104KB
-
memory/2236-141-0x0000000007490000-0x0000000007B0A000-memory.dmpFilesize
6.5MB
-
memory/2236-134-0x0000000000000000-mapping.dmp
-
memory/2236-135-0x0000000002860000-0x0000000002896000-memory.dmpFilesize
216KB
-
memory/2236-136-0x00000000050D0000-0x00000000056F8000-memory.dmpFilesize
6.2MB
-
memory/2236-137-0x0000000004D60000-0x0000000004D82000-memory.dmpFilesize
136KB
-
memory/2236-138-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/2236-139-0x00000000057E0000-0x0000000005846000-memory.dmpFilesize
408KB
-
memory/2236-140-0x0000000005E40000-0x0000000005E5E000-memory.dmpFilesize
120KB
-
memory/2748-130-0x0000000000DE0000-0x0000000000DEC000-memory.dmpFilesize
48KB
-
memory/2748-131-0x0000000005D20000-0x00000000062C4000-memory.dmpFilesize
5.6MB
-
memory/2748-133-0x0000000005640000-0x000000000564A000-memory.dmpFilesize
40KB
-
memory/2748-132-0x0000000005680000-0x0000000005712000-memory.dmpFilesize
584KB
-
memory/3828-153-0x00000000061B0000-0x00000000061CE000-memory.dmpFilesize
120KB
-
memory/3828-145-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3828-146-0x0000000004F90000-0x00000000055A8000-memory.dmpFilesize
6.1MB
-
memory/3828-147-0x0000000004850000-0x0000000004862000-memory.dmpFilesize
72KB
-
memory/3828-148-0x00000000048B0000-0x00000000048EC000-memory.dmpFilesize
240KB
-
memory/3828-149-0x0000000004B70000-0x0000000004C7A000-memory.dmpFilesize
1.0MB
-
memory/3828-150-0x0000000005BD0000-0x0000000005D92000-memory.dmpFilesize
1.8MB
-
memory/3828-151-0x00000000062D0000-0x00000000067FC000-memory.dmpFilesize
5.2MB
-
memory/3828-152-0x00000000060B0000-0x0000000006126000-memory.dmpFilesize
472KB
-
memory/3828-144-0x0000000000000000-mapping.dmp