Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
17-07-2022 02:07
Static task
static1
Behavioral task
behavioral1
Sample
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe
Resource
win10v2004-20220414-en
General
-
Target
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe
-
Size
1.4MB
-
MD5
b630bd574756df49465fe6d7fb41e7d3
-
SHA1
628dd252c4a5e611093e722166e65c1d9ca55a80
-
SHA256
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c
-
SHA512
e1b10edc631ff4650bc6a930e8ac30e9c02197997a22ce84e905d3c1a77e0bdb18afa78236a6e5840bf23cd1723920dd1aad96abea2a3afdf6aca2a82d10524d
Malware Config
Extracted
redline
@JABKA9983
92.255.85.137:41320
-
auth_value
507a0c408947972b94cf44475f601269
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/1932-63-0x0000000000090000-0x00000000000B0000-memory.dmp family_redline behavioral1/memory/1932-68-0x00000000000AAE9E-mapping.dmp family_redline behavioral1/memory/1932-70-0x0000000000090000-0x00000000000B0000-memory.dmp family_redline behavioral1/memory/1932-71-0x0000000000090000-0x00000000000B0000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe -
Processes:
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exedescription pid process target process PID 1656 set thread context of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exedescription pid process target process PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe PID 1656 wrote to memory of 1932 1656 52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe AppLaunch.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe"C:\Users\Admin\AppData\Local\Temp\52b848abe5f067ac4822925b859d8f58cd416a3ec8dd6457aaafae794632ba1c.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1656-60-0x0000000000400000-0x00000000007B0000-memory.dmpFilesize
3.7MB
-
memory/1656-55-0x0000000000400000-0x00000000007B0000-memory.dmpFilesize
3.7MB
-
memory/1656-56-0x0000000000400000-0x00000000007B0000-memory.dmpFilesize
3.7MB
-
memory/1656-57-0x0000000000400000-0x00000000007B0000-memory.dmpFilesize
3.7MB
-
memory/1656-58-0x0000000000400000-0x00000000007B0000-memory.dmpFilesize
3.7MB
-
memory/1656-59-0x0000000000880000-0x00000000008E0000-memory.dmpFilesize
384KB
-
memory/1656-54-0x0000000075CD1000-0x0000000075CD3000-memory.dmpFilesize
8KB
-
memory/1656-69-0x0000000000400000-0x00000000007B0000-memory.dmpFilesize
3.7MB
-
memory/1932-63-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/1932-61-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/1932-68-0x00000000000AAE9E-mapping.dmp
-
memory/1932-70-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB
-
memory/1932-71-0x0000000000090000-0x00000000000B0000-memory.dmpFilesize
128KB