Analysis
-
max time kernel
150s -
max time network
142s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
05-08-2022 07:19
Static task
static1
General
-
Target
4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe
-
Size
211KB
-
MD5
baec9b40c3e4e67b18d3e65e2254d48c
-
SHA1
cba8f35fa9db4e67d800211ff017a65243b4e074
-
SHA256
4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d
-
SHA512
8c0addad974a25e19041f6f1f692b9cfd16e731e04f7c0a088c6fa18e8837c79574f11e203192f717df6aa22e53b1f0366b01329ad6ac7815656f193be3b4936
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
7C35.exepid process 3320 7C35.exe -
Deletes itself 1 IoCs
Processes:
pid process 2544 -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI 4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exepid process 2212 4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe 2212 4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 2544 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 2544 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exepid process 2212 4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
7C35.exedescription pid process Token: SeDebugPrivilege 3320 7C35.exe Token: SeShutdownPrivilege 2544 Token: SeCreatePagefilePrivilege 2544 Token: SeShutdownPrivilege 2544 Token: SeCreatePagefilePrivilege 2544 -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
description pid process target process PID 2544 wrote to memory of 3320 2544 7C35.exe PID 2544 wrote to memory of 3320 2544 7C35.exe PID 2544 wrote to memory of 3320 2544 7C35.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe"C:\Users\Admin\AppData\Local\Temp\4b64dcf88672644d50fc8c61722b0aa2e1c997dea3e2de6636867ccfc2564a8d.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\7C35.exeC:\Users\Admin\AppData\Local\Temp\7C35.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7C35.exeFilesize
314KB
MD5d950886d34c90b4dc56940f81c173673
SHA1ce9bebd70e093127b66a27ee7eb8362e1e4c084d
SHA2560a0357b12286be5331dcc812e1e8b2062b81aad1fa69543fa2d6a02c50fffb21
SHA512ac76630f6a4c6f35537c8488e4fbe35fd57eacf8ef18de63a2c75b59ed8613e444170705455d15459d843ac8d870f60f4185b552a4d76579b624ce924f57675a
-
C:\Users\Admin\AppData\Local\Temp\7C35.exeFilesize
314KB
MD5d950886d34c90b4dc56940f81c173673
SHA1ce9bebd70e093127b66a27ee7eb8362e1e4c084d
SHA2560a0357b12286be5331dcc812e1e8b2062b81aad1fa69543fa2d6a02c50fffb21
SHA512ac76630f6a4c6f35537c8488e4fbe35fd57eacf8ef18de63a2c75b59ed8613e444170705455d15459d843ac8d870f60f4185b552a4d76579b624ce924f57675a
-
memory/2212-117-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-118-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-119-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-120-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-121-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-122-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-123-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-124-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-125-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-126-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-127-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-128-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-129-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-130-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-131-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-132-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-133-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-134-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-135-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-136-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-137-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-138-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-139-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-141-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-140-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-143-0x0000000002756000-0x0000000002766000-memory.dmpFilesize
64KB
-
memory/2212-144-0x0000000002620000-0x0000000002629000-memory.dmpFilesize
36KB
-
memory/2212-145-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-142-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-146-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-147-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-149-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-150-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-151-0x0000000000400000-0x00000000024BB000-memory.dmpFilesize
32.7MB
-
memory/2212-148-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/2212-152-0x0000000000400000-0x00000000024BB000-memory.dmpFilesize
32.7MB
-
memory/3320-155-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-156-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-153-0x0000000000000000-mapping.dmp
-
memory/3320-157-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-160-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-164-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-165-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-166-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-167-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-168-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-170-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-169-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-163-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-161-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-159-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-158-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-171-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-176-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-177-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-175-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-179-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-180-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-178-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-174-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-173-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-172-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-181-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-182-0x0000000002746000-0x0000000002771000-memory.dmpFilesize
172KB
-
memory/3320-183-0x00000000040D0000-0x0000000004108000-memory.dmpFilesize
224KB
-
memory/3320-184-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-185-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-188-0x0000000000400000-0x00000000024D4000-memory.dmpFilesize
32.8MB
-
memory/3320-187-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-186-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-189-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-190-0x0000000076F40000-0x00000000770CE000-memory.dmpFilesize
1.6MB
-
memory/3320-198-0x00000000044F0000-0x0000000004520000-memory.dmpFilesize
192KB
-
memory/3320-203-0x0000000006D70000-0x000000000726E000-memory.dmpFilesize
5.0MB
-
memory/3320-205-0x0000000004690000-0x00000000046C0000-memory.dmpFilesize
192KB
-
memory/3320-216-0x0000000007880000-0x0000000007E86000-memory.dmpFilesize
6.0MB
-
memory/3320-217-0x0000000006C50000-0x0000000006C62000-memory.dmpFilesize
72KB
-
memory/3320-218-0x0000000007270000-0x000000000737A000-memory.dmpFilesize
1.0MB
-
memory/3320-221-0x0000000006CC0000-0x0000000006CFE000-memory.dmpFilesize
248KB
-
memory/3320-229-0x0000000006D10000-0x0000000006D5B000-memory.dmpFilesize
300KB
-
memory/3320-253-0x00000000086C0000-0x0000000008736000-memory.dmpFilesize
472KB
-
memory/3320-254-0x0000000008740000-0x00000000087D2000-memory.dmpFilesize
584KB
-
memory/3320-257-0x0000000008960000-0x000000000897E000-memory.dmpFilesize
120KB
-
memory/3320-258-0x00000000089E0000-0x0000000008A46000-memory.dmpFilesize
408KB
-
memory/3320-266-0x0000000008D10000-0x0000000008D60000-memory.dmpFilesize
320KB
-
memory/3320-267-0x0000000008ED0000-0x0000000009092000-memory.dmpFilesize
1.8MB
-
memory/3320-268-0x00000000090B0000-0x00000000095DC000-memory.dmpFilesize
5.2MB
-
memory/3320-271-0x0000000002746000-0x0000000002771000-memory.dmpFilesize
172KB
-
memory/3320-272-0x0000000000400000-0x00000000024D4000-memory.dmpFilesize
32.8MB
-
memory/3320-277-0x0000000002746000-0x0000000002771000-memory.dmpFilesize
172KB
-
memory/3320-278-0x0000000000400000-0x00000000024D4000-memory.dmpFilesize
32.8MB