Analysis
-
max time kernel
85s -
max time network
114s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
30-07-2022 12:27
Static task
static1
Behavioral task
behavioral1
Sample
Installer.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
Installer.exe
Resource
win10v2004-20220721-en
General
-
Target
Installer.exe
-
Size
700.0MB
-
MD5
40d4f96d2d61e133fb1e5ed913519d1a
-
SHA1
c568b67141ad743982b06ccd1cdbb28450971c63
-
SHA256
338c709ef0a8f67f35d7482ad902486e0d2bf2eb5c4ec88822fff879ea410ca3
-
SHA512
dbca0f7032299078279580efa349758e7f305d3c3c7748b7ab8adb971e6bf12c46f12a2e1a468d542bcf701a6261d818f6e2a8b13ad005adae3cd8a1fb8ad4da
Malware Config
Extracted
redline
mix2
185.215.113.98:8942
-
auth_value
0c8a87333f20ae8c0f5b594039fbada9
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4636-134-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
Installer.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2660308776-3705150086-26593515-1000\Control Panel\International\Geo\Nation Installer.exe -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Installer.exedescription pid process target process PID 4620 set thread context of 4636 4620 Installer.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2568 timeout.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Installer.exeInstallUtil.exepid process 4620 Installer.exe 4620 Installer.exe 4636 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
InstallUtil.exedescription pid process Token: SeDebugPrivilege 4636 InstallUtil.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
Installer.execmd.exedescription pid process target process PID 4620 wrote to memory of 1528 4620 Installer.exe cmd.exe PID 4620 wrote to memory of 1528 4620 Installer.exe cmd.exe PID 4620 wrote to memory of 1528 4620 Installer.exe cmd.exe PID 1528 wrote to memory of 2568 1528 cmd.exe timeout.exe PID 1528 wrote to memory of 2568 1528 cmd.exe timeout.exe PID 1528 wrote to memory of 2568 1528 cmd.exe timeout.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe PID 4620 wrote to memory of 4636 4620 Installer.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Installer.exe"C:\Users\Admin\AppData\Local\Temp\Installer.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 202⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 203⤵
- Delays execution with timeout.exe
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1528-131-0x0000000000000000-mapping.dmp
-
memory/2568-132-0x0000000000000000-mapping.dmp
-
memory/4620-130-0x0000000000D50000-0x0000000000E38000-memory.dmpFilesize
928KB
-
memory/4636-138-0x0000000005280000-0x00000000052BC000-memory.dmpFilesize
240KB
-
memory/4636-140-0x0000000005640000-0x00000000056D2000-memory.dmpFilesize
584KB
-
memory/4636-135-0x0000000005780000-0x0000000005D98000-memory.dmpFilesize
6.1MB
-
memory/4636-136-0x0000000005220000-0x0000000005232000-memory.dmpFilesize
72KB
-
memory/4636-137-0x0000000005350000-0x000000000545A000-memory.dmpFilesize
1.0MB
-
memory/4636-133-0x0000000000000000-mapping.dmp
-
memory/4636-139-0x0000000006350000-0x00000000068F4000-memory.dmpFilesize
5.6MB
-
memory/4636-134-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4636-141-0x00000000056E0000-0x0000000005746000-memory.dmpFilesize
408KB
-
memory/4636-142-0x0000000006220000-0x0000000006296000-memory.dmpFilesize
472KB
-
memory/4636-143-0x0000000006B30000-0x0000000006B4E000-memory.dmpFilesize
120KB
-
memory/4636-144-0x0000000006D10000-0x0000000006D60000-memory.dmpFilesize
320KB
-
memory/4636-145-0x0000000006F30000-0x00000000070F2000-memory.dmpFilesize
1.8MB
-
memory/4636-146-0x0000000007B70000-0x000000000809C000-memory.dmpFilesize
5.2MB