Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
06-07-2022 09:58
Static task
static1
Behavioral task
behavioral1
Sample
SecuriteInfo.com.Variant.Ursu.588815.10992.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
SecuriteInfo.com.Variant.Ursu.588815.10992.exe
Resource
win10v2004-20220414-en
General
-
Target
SecuriteInfo.com.Variant.Ursu.588815.10992.exe
-
Size
525KB
-
MD5
15f43d61bee241657b1ad10d6aa11e57
-
SHA1
83e96ecb233bd270b4f002c55aa28e92306650ef
-
SHA256
538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
-
SHA512
0e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
Malware Config
Extracted
redline
wizzy
107.182.128.57:48273
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2120-135-0x0000000000F40000-0x0000000000F5E000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
chromer.exechromer.exechromer.exepid process 2972 chromer.exe 1840 chromer.exe 3936 chromer.exe -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 42 ipinfo.io 43 ipinfo.io -
Suspicious use of SetThreadContext 4 IoCs
Processes:
SecuriteInfo.com.Variant.Ursu.588815.10992.exechromer.exechromer.exechromer.exedescription pid process target process PID 3280 set thread context of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 2972 set thread context of 3620 2972 chromer.exe vbc.exe PID 1840 set thread context of 4644 1840 chromer.exe vbc.exe PID 3936 set thread context of 4248 3936 chromer.exe vbc.exe -
Creates scheduled task(s) 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exeschtasks.exeschtasks.exepid process 3468 schtasks.exe 4368 schtasks.exe 4388 schtasks.exe 4924 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
vbc.exevbc.exevbc.exevbc.exepid process 3620 vbc.exe 3620 vbc.exe 2120 vbc.exe 2120 vbc.exe 4644 vbc.exe 4644 vbc.exe 4248 vbc.exe 4248 vbc.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
Processes:
SecuriteInfo.com.Variant.Ursu.588815.10992.exevbc.exechromer.exevbc.exechromer.exevbc.exechromer.exevbc.exedescription pid process Token: SeDebugPrivilege 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe Token: SeDebugPrivilege 2120 vbc.exe Token: SeDebugPrivilege 2972 chromer.exe Token: SeDebugPrivilege 3620 vbc.exe Token: SeDebugPrivilege 1840 chromer.exe Token: SeDebugPrivilege 4644 vbc.exe Token: SeDebugPrivilege 3936 chromer.exe Token: SeDebugPrivilege 4248 vbc.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
SecuriteInfo.com.Variant.Ursu.588815.10992.execmd.exechromer.execmd.exechromer.execmd.exechromer.exedescription pid process target process PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 2120 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe vbc.exe PID 3280 wrote to memory of 3976 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 3976 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 3976 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 4828 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 4828 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 4828 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 744 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 744 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 3280 wrote to memory of 744 3280 SecuriteInfo.com.Variant.Ursu.588815.10992.exe cmd.exe PID 4828 wrote to memory of 4388 4828 cmd.exe schtasks.exe PID 4828 wrote to memory of 4388 4828 cmd.exe schtasks.exe PID 4828 wrote to memory of 4388 4828 cmd.exe schtasks.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 3620 2972 chromer.exe vbc.exe PID 2972 wrote to memory of 976 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 976 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 976 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 3472 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 3472 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 3472 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 1096 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 1096 2972 chromer.exe cmd.exe PID 2972 wrote to memory of 1096 2972 chromer.exe cmd.exe PID 3472 wrote to memory of 4924 3472 cmd.exe schtasks.exe PID 3472 wrote to memory of 4924 3472 cmd.exe schtasks.exe PID 3472 wrote to memory of 4924 3472 cmd.exe schtasks.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 4644 1840 chromer.exe vbc.exe PID 1840 wrote to memory of 3388 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 3388 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 3388 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 860 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 860 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 860 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 740 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 740 1840 chromer.exe cmd.exe PID 1840 wrote to memory of 740 1840 chromer.exe cmd.exe PID 860 wrote to memory of 3468 860 cmd.exe schtasks.exe PID 860 wrote to memory of 3468 860 cmd.exe schtasks.exe PID 860 wrote to memory of 3468 860 cmd.exe schtasks.exe PID 3936 wrote to memory of 4248 3936 chromer.exe vbc.exe PID 3936 wrote to memory of 4248 3936 chromer.exe vbc.exe PID 3936 wrote to memory of 4248 3936 chromer.exe vbc.exe PID 3936 wrote to memory of 4248 3936 chromer.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.588815.10992.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.588815.10992.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Variant.Ursu.588815.10992.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeC:\Users\Admin\AppData\Roaming\chromer\chromer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeC:\Users\Admin\AppData\Roaming\chromer\chromer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeC:\Users\Admin\AppData\Roaming\chromer\chromer.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c mkdir "C:\Users\Admin\AppData\Roaming\chromer"2⤵
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c schtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f2⤵
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "Nafifas" /tr "'C:\Users\Admin\AppData\Roaming\chromer\chromer.exe'" /f3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c copy "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe" "C:\Users\Admin\AppData\Roaming\chromer\chromer.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\chromer.exe.logFilesize
425B
MD54eaca4566b22b01cd3bc115b9b0b2196
SHA1e743e0792c19f71740416e7b3c061d9f1336bf94
SHA25634ba0ab8d1850e7825763f413142a333ccbc05fa2b5499a28a7d27b8a1c5b4bb
SHA512bc2b1bf45203e3bb3009a7d37617b8f0f7ffa613680b32de2b963e39d2cf1650614d7035a0cf78f35a4f5cb17a2a439e2e07deaefd2a4275a62efd0a5c0184a1
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\vbc.exe.logFilesize
2KB
MD5c0ced3fd9b42a0142448d507f6a4c2af
SHA1cb66ee9d9920cc61bb982709c15e448bc45de0a9
SHA2561af3fb7e6be9a8ddfaddc28f4f2d4cf99f1fa06d57747ec1d8b1442bb2785037
SHA5121a655235898051f13a58d417b284c51746f5acbe6fd5e7de74d537bfdf14b44e978e6581b8872c0d790d8048ad8836ea8b8be805fb993e2852301620dad92100
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
C:\Users\Admin\AppData\Roaming\chromer\chromer.exeFilesize
525KB
MD515f43d61bee241657b1ad10d6aa11e57
SHA183e96ecb233bd270b4f002c55aa28e92306650ef
SHA256538e65ae9a73e15bd98c8fd0b5ecce5aaecdeb5e36a12a416a56a78c3cfbb3c8
SHA5120e8a516e1439ec1a871d2afba0140a38f2ac8f4f13ad2283d334edf01537aa147023abf81957118b347c7634a05651fb26177e634ba8882d79c35754cfac9e5a
-
memory/740-164-0x0000000000000000-mapping.dmp
-
memory/744-136-0x0000000000000000-mapping.dmp
-
memory/860-163-0x0000000000000000-mapping.dmp
-
memory/976-147-0x0000000000000000-mapping.dmp
-
memory/1096-149-0x0000000000000000-mapping.dmp
-
memory/2120-141-0x00000000059D0000-0x0000000005ADA000-memory.dmpFilesize
1.0MB
-
memory/2120-138-0x0000000005D20000-0x0000000006338000-memory.dmpFilesize
6.1MB
-
memory/2120-140-0x0000000005740000-0x000000000577C000-memory.dmpFilesize
240KB
-
memory/2120-139-0x0000000003170000-0x0000000003182000-memory.dmpFilesize
72KB
-
memory/2120-131-0x0000000000000000-mapping.dmp
-
memory/2120-135-0x0000000000F40000-0x0000000000F5E000-memory.dmpFilesize
120KB
-
memory/2180-170-0x0000000000000000-mapping.dmp
-
memory/2972-144-0x00000000004D0000-0x000000000055A000-memory.dmpFilesize
552KB
-
memory/3280-130-0x0000000000270000-0x00000000002FA000-memory.dmpFilesize
552KB
-
memory/3348-171-0x0000000000000000-mapping.dmp
-
memory/3388-162-0x0000000000000000-mapping.dmp
-
memory/3468-166-0x0000000000000000-mapping.dmp
-
memory/3472-148-0x0000000000000000-mapping.dmp
-
memory/3572-172-0x0000000000000000-mapping.dmp
-
memory/3620-153-0x00000000060F0000-0x0000000006156000-memory.dmpFilesize
408KB
-
memory/3620-154-0x0000000006600000-0x0000000006692000-memory.dmpFilesize
584KB
-
memory/3620-155-0x00000000066A0000-0x0000000006716000-memory.dmpFilesize
472KB
-
memory/3620-157-0x0000000006840000-0x000000000685E000-memory.dmpFilesize
120KB
-
memory/3620-152-0x0000000006860000-0x0000000006D8C000-memory.dmpFilesize
5.2MB
-
memory/3620-156-0x0000000007340000-0x00000000078E4000-memory.dmpFilesize
5.6MB
-
memory/3620-151-0x0000000006160000-0x0000000006322000-memory.dmpFilesize
1.8MB
-
memory/3620-145-0x0000000000000000-mapping.dmp
-
memory/3976-133-0x0000000000000000-mapping.dmp
-
memory/4248-168-0x0000000000000000-mapping.dmp
-
memory/4368-173-0x0000000000000000-mapping.dmp
-
memory/4388-137-0x0000000000000000-mapping.dmp
-
memory/4644-160-0x0000000000000000-mapping.dmp
-
memory/4828-134-0x0000000000000000-mapping.dmp
-
memory/4924-150-0x0000000000000000-mapping.dmp