Analysis
-
max time kernel
129s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Ursu.588815.10992.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Ursu.588815.10992.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.Variant.Ursu.588815.10992.exe
-
Size
525KB
-
MD5
15f43d61bee241657b1ad10d6aa11e57
-
SHA1
83e96ecb233bd270b4f002c55aa28e92306650ef
-
SHA256
538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
-
SHA512
0e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
Malware Config
Extracted
redline
wizzy
107.182.128.57:48273
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2488-132-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Executes dropped EXE 2 IoCs
Processes:
chromer.exechromer.exepid process 320 chromer.exe 1484 chromer.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 3 IoCs
Processes:
SecuriteInfo.com.Variant.Ursu.588815.10992.exechromer.exechromer.exedescription pid process target process PID 1944 set thread context of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 320 set thread context of 4132 320 chromer.exe vbc.exe PID 1484 set thread context of 3220 1484 chromer.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 3 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exepid process 2944 schtasks.exe 4524 schtasks.exe 4604 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
vbc.exevbc.exevbc.exepid process 2488 vbc.exe 2488 vbc.exe 4132 vbc.exe 4132 vbc.exe 3220 vbc.exe 3220 vbc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
SecuriteInfo.com.Variant.Ursu.588815.10992.exevbc.exechromer.exevbc.exechromer.exevbc.exedescription pid process Token: SeDebugPrivilege 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe Token: SeDebugPrivilege 2488 vbc.exe Token: SeDebugPrivilege 320 chromer.exe Token: SeDebugPrivilege 4132 vbc.exe Token: SeDebugPrivilege 1484 chromer.exe Token: SeDebugPrivilege 3220 vbc.exe -
Suspicious use of WriteProcessMemory 60 IoCs
Processes:
SecuriteInfo.com.Variant.Ursu.588815.10992.execmd.exechromer.execmd.exechromer.execmd.exedescription pid process target process PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 2488 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 1944 wrote to memory of 3376 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 3376 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 3376 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 2076 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 2076 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 2076 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 2204 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 2204 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 1944 wrote to memory of 2204 1944 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 2076 wrote to memory of 2944 2076 cmd.exe schtasks.exe PID 2076 wrote to memory of 2944 2076 cmd.exe schtasks.exe PID 2076 wrote to memory of 2944 2076 cmd.exe schtasks.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 4132 320 chromer.exe vbc.exe PID 320 wrote to memory of 1936 320 chromer.exe cmd.exe PID 320 wrote to memory of 1936 320 chromer.exe cmd.exe PID 320 wrote to memory of 1936 320 chromer.exe cmd.exe PID 320 wrote to memory of 2084 320 chromer.exe cmd.exe PID 320 wrote to memory of 2084 320 chromer.exe cmd.exe PID 320 wrote to memory of 2084 320 chromer.exe cmd.exe PID 320 wrote to memory of 1900 320 chromer.exe cmd.exe PID 320 wrote to memory of 1900 320 chromer.exe cmd.exe PID 320 wrote to memory of 1900 320 chromer.exe cmd.exe PID 2084 wrote to memory of 4524 2084 cmd.exe schtasks.exe PID 2084 wrote to memory of 4524 2084 cmd.exe schtasks.exe PID 2084 wrote to memory of 4524 2084 cmd.exe schtasks.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 3220 1484 chromer.exe vbc.exe PID 1484 wrote to memory of 4528 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 4528 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 4528 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 924 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 924 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 924 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 3564 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 3564 1484 chromer.exe cmd.exe PID 1484 wrote to memory of 3564 1484 chromer.exe cmd.exe PID 924 wrote to memory of 4604 924 cmd.exe schtasks.exe PID 924 wrote to memory of 4604 924 cmd.exe schtasks.exe PID 924 wrote to memory of 4604 924 cmd.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.588815.10992.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.588815.10992.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.588815.10992.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeC:\Users\Admin\AppData\Roaming\chromer\chromer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeC:\Users\Admin\AppData\Roaming\chromer\chromer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chromer.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.logFilesize
2KB
MD54c8c34591a3015cc34b80764317cbefb
SHA191bf9007a29907b9d51773e5c06f00fafc36a5db
SHA256a1c4c2025c1bf329cde8e3ec7e3062695e5b77f0229b4b15a5e4a077b2b5a5ff
SHA51265e5ef29bc5dd99850488f32d6c8d91b940f20ce8b12e00f849e72fd75b3de3fde81ebc9e41d2561b839620cb6a7523ace2a4fd755c54498ee1492d1468c73fb
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
memory/320-150-0x0000000000AD0000-0x0000000000B5A000-memory.dmpFilesize
552KB
-
memory/924-163-0x0000000000000000-mapping.dmp
-
memory/1900-155-0x0000000000000000-mapping.dmp
-
memory/1936-153-0x0000000000000000-mapping.dmp
-
memory/1944-130-0x0000000000090000-0x000000000011A000-memory.dmpFilesize
552KB
-
memory/2076-134-0x0000000000000000-mapping.dmp
-
memory/2084-154-0x0000000000000000-mapping.dmp
-
memory/2204-135-0x0000000000000000-mapping.dmp
-
memory/2488-138-0x00000000050F0000-0x0000000005102000-memory.dmpFilesize
72KB
-
memory/2488-137-0x0000000005880000-0x0000000005E98000-memory.dmpFilesize
6.1MB
-
memory/2488-145-0x0000000006950000-0x00000000069E2000-memory.dmpFilesize
584KB
-
memory/2488-146-0x0000000007650000-0x0000000007BF4000-memory.dmpFilesize
5.6MB
-
memory/2488-147-0x0000000006A10000-0x0000000006A2E000-memory.dmpFilesize
120KB
-
memory/2488-143-0x00000000063F0000-0x0000000006456000-memory.dmpFilesize
408KB
-
memory/2488-142-0x0000000006B70000-0x000000000709C000-memory.dmpFilesize
5.2MB
-
memory/2488-141-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/2488-131-0x0000000000000000-mapping.dmp
-
memory/2488-140-0x0000000005400000-0x000000000550A000-memory.dmpFilesize
1.0MB
-
memory/2488-139-0x0000000005150000-0x000000000518C000-memory.dmpFilesize
240KB
-
memory/2488-144-0x00000000067E0000-0x0000000006856000-memory.dmpFilesize
472KB
-
memory/2488-132-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/2944-136-0x0000000000000000-mapping.dmp
-
memory/3220-160-0x0000000000000000-mapping.dmp
-
memory/3376-133-0x0000000000000000-mapping.dmp
-
memory/3564-164-0x0000000000000000-mapping.dmp
-
memory/4132-151-0x0000000000000000-mapping.dmp
-
memory/4524-157-0x0000000000000000-mapping.dmp
-
memory/4528-162-0x0000000000000000-mapping.dmp
-
memory/4604-165-0x0000000000000000-mapping.dmp