Overview

overview

10

Static

static

Installer/Setup.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    99s
  • max time network
    107s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220721-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05/08/2022, 00:59

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Installer/Setup.exe

  • Size

    4.8MB

  • MD5

    e802a10b92d452355473e7098127cd6a

  • SHA1

    fcf838237925661f674be8b121c4989c091ed9fd

  • SHA256

    ffa88e2f4c4cffc25cfa7e87f7b8685e5e31f3dfa372e9e0a4c5d85f880dbb94

  • SHA512

    b5f2255f8507b9c5fb1671500c6a1b4b3a34428552e494f8c4a6a9713304c18d79a930f6b3716971c903c4cd79a681b5bc998cff835b2e5794cc081b2ca27128

Score
10/10
redlineytstealerccinfostealerspywarestealerupx

Malware Config

Extracted

Family

redline

Botnet

cc

C2

31.41.244.109:3590

Attributes
  • auth_value

    7c92cd877c035439a140a8047908d9e1

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

    stealerytstealer
  • YTStealer payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • UPX packed file 4 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

    upx
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Program crash 1 IoCs
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of FindShellTrayWindow 47 IoCs
  • Suspicious use of SendNotifyMessage 47 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Installer\Setup.exe
    "C:\Users\Admin\AppData\Local\Temp\Installer\Setup.exe"
    1⤵
    • Suspicious use of WriteProcessMemory
    PID:2416
    • C:\Users\Admin\AppData\Roaming\yaeblan_v0.7b_123231_windows_64.exe
      C:\Users\Admin\AppData\Roaming\yaeblan_v0.7b_123231_windows_64.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:2036
      • C:\Windows\system32\cmd.exe
        C:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Roaming\yaeblan_v0.7b_123231_windows_64.exe
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:162124
        • C:\Windows\system32\choice.exe
          choice /C Y /N /D Y /T 0
          4⤵
            PID:162168
      • C:\Users\Admin\AppData\Roaming\companycrypt.exe
        C:\Users\Admin\AppData\Roaming\companycrypt.exe
        2⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:828
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
          3⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:161928
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -pss -s 444 -p 162356 -ip 162356
      1⤵
        PID:2740
      • C:\Windows\system32\WerFault.exe
        C:\Windows\system32\WerFault.exe -u -p 162356 -s 776
        1⤵
        • Program crash
        PID:3320
      • C:\Windows\system32\taskmgr.exe
        "C:\Windows\system32\taskmgr.exe" /4
        1⤵
        • Checks SCSI registry key(s)
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        PID:3176

      Network

      MITRE ATT&CK Enterprise v6

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Roaming\companycrypt.exe
        Filesize

        2.6MB

        MD5

        2d6b9e7e7fdef424fc88363720cfd0e1

        SHA1

        7574c3a3263dd70c70a5f23f7384417e883b1e0b

        SHA256

        39c1d35936b3f12d2e56f7bd492a3b6bd1eb89f10d813bc17cbf27ebff827463

        SHA512

        7127c35d2fc46f4066086cd0695055732818c9b59cf4dbdb0787f0db01382ac8aa2e5cadebf9f4d398e4c81216a98f880601efc5f7a19e2b83f9e45b2bbe73e5

        Download Submit

      • C:\Users\Admin\AppData\Roaming\companycrypt.exe
        Filesize

        2.6MB

        MD5

        2d6b9e7e7fdef424fc88363720cfd0e1

        SHA1

        7574c3a3263dd70c70a5f23f7384417e883b1e0b

        SHA256

        39c1d35936b3f12d2e56f7bd492a3b6bd1eb89f10d813bc17cbf27ebff827463

        SHA512

        7127c35d2fc46f4066086cd0695055732818c9b59cf4dbdb0787f0db01382ac8aa2e5cadebf9f4d398e4c81216a98f880601efc5f7a19e2b83f9e45b2bbe73e5

        Download Submit

      • C:\Users\Admin\AppData\Roaming\yaeblan_v0.7b_123231_windows_64.exe
        Filesize

        4.0MB

        MD5

        9ea2e282fbec5301f574b7860156376b

        SHA1

        997da7e453500b7efe7f92e19b8686a282c42e83

        SHA256

        9cb41dfabb8a0179cc046f174c27e3106c14c4518eccec7b36a3533655559908

        SHA512

        a5dfb350e22bea6c4469364bcd4d88d09c748694c8b118cca167c5e45874ed47c70da30f470174e534370bc01732f3440ac92781ac8781325e1ef743c3211c17

        Download Submit

      • C:\Users\Admin\AppData\Roaming\yaeblan_v0.7b_123231_windows_64.exe
        Filesize

        4.0MB

        MD5

        9ea2e282fbec5301f574b7860156376b

        SHA1

        997da7e453500b7efe7f92e19b8686a282c42e83

        SHA256

        9cb41dfabb8a0179cc046f174c27e3106c14c4518eccec7b36a3533655559908

        SHA512

        a5dfb350e22bea6c4469364bcd4d88d09c748694c8b118cca167c5e45874ed47c70da30f470174e534370bc01732f3440ac92781ac8781325e1ef743c3211c17

        Download Submit

      • memory/2036-149-0x0000000000960000-0x0000000001739000-memory.dmp

        Filesize

        13.8MB

        Download

      • memory/2036-136-0x0000000000960000-0x0000000001739000-memory.dmp

        Filesize

        13.8MB

        Download

      • memory/161928-152-0x0000000005E70000-0x0000000006414000-memory.dmp

        Filesize

        5.6MB

        Download

      • memory/161928-138-0x00000000003D0000-0x00000000003F0000-memory.dmp

        Filesize

        128KB

        Download

      • memory/161928-144-0x0000000004CA0000-0x0000000004CB2000-memory.dmp

        Filesize

        72KB

        Download

      • memory/161928-145-0x0000000004DD0000-0x0000000004EDA000-memory.dmp

        Filesize

        1.0MB

        Download

      • memory/161928-146-0x0000000004D00000-0x0000000004D3C000-memory.dmp

        Filesize

        240KB

        Download

      • memory/161928-156-0x0000000007840000-0x0000000007D6C000-memory.dmp

        Filesize

        5.2MB

        Download

      • memory/161928-155-0x0000000006AE0000-0x0000000006CA2000-memory.dmp

        Filesize

        1.8MB

        Download

      • memory/161928-143-0x0000000005200000-0x0000000005818000-memory.dmp

        Filesize

        6.1MB

        Download

      • memory/161928-150-0x0000000005050000-0x00000000050C6000-memory.dmp

        Filesize

        472KB

        Download

      • memory/161928-151-0x0000000005820000-0x00000000058B2000-memory.dmp

        Filesize

        584KB

        Download

      • memory/161928-153-0x00000000051B0000-0x00000000051CE000-memory.dmp

        Filesize

        120KB

        Download

      • memory/161928-154-0x0000000005C30000-0x0000000005C96000-memory.dmp

        Filesize

        408KB

        Download