Analysis
-
max time kernel
105s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
08-08-2022 08:29
Static task
static1
Behavioral task
behavioral1
Sample
8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe
Resource
win7-20220715-en
General
-
Target
8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe
-
Size
413KB
-
MD5
127768b759970c351b9d9947c97a3c83
-
SHA1
5c7cca03e0cd8af8a5bb2c70a48f917965ae9514
-
SHA256
8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b
-
SHA512
b324d7ff35c2ab81ccee687d32af9e9f30b2a75182a5cf9244061069ffcf3718df5c7b06c40819e772309f6aaba2cfe987e13c821c85471c6bb1a437fa06dffd
Malware Config
Extracted
redline
1
207.32.218.115:4162
-
auth_value
58f3be996f732af4b1f9624e1a783249
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/1976-55-0x000000001AA90000-0x000000001AAB0000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
tmpD0C.tmp.exepid process 1672 tmpD0C.tmp.exe -
Loads dropped DLL 5 IoCs
Processes:
WerFault.exepid process 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe 796 WerFault.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 796 1672 WerFault.exe tmpD0C.tmp.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exepid process 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exedescription pid process Token: SeDebugPrivilege 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exetmpD0C.tmp.exedescription pid process target process PID 1976 wrote to memory of 1672 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe tmpD0C.tmp.exe PID 1976 wrote to memory of 1672 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe tmpD0C.tmp.exe PID 1976 wrote to memory of 1672 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe tmpD0C.tmp.exe PID 1976 wrote to memory of 1672 1976 8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe tmpD0C.tmp.exe PID 1672 wrote to memory of 796 1672 tmpD0C.tmp.exe WerFault.exe PID 1672 wrote to memory of 796 1672 tmpD0C.tmp.exe WerFault.exe PID 1672 wrote to memory of 796 1672 tmpD0C.tmp.exe WerFault.exe PID 1672 wrote to memory of 796 1672 tmpD0C.tmp.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe"C:\Users\Admin\AppData\Local\Temp\8f53ac20b7777477c10ecbe163968c472457d3819ebafb20f232c5b1a448eb1b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1672 -s 443⤵
- Loads dropped DLL
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
\Users\Admin\AppData\Local\Temp\tmpD0C.tmp.exeFilesize
52KB
MD5d8e1495b46cded57eb1423b8bb789834
SHA1db64bc20550e51c602dbb92d07c8f02842efebcc
SHA256aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
SHA5128b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
-
memory/796-58-0x0000000000000000-mapping.dmp
-
memory/1672-56-0x0000000000000000-mapping.dmp
-
memory/1976-54-0x000000013FDC0000-0x000000013FE2C000-memory.dmpFilesize
432KB
-
memory/1976-55-0x000000001AA90000-0x000000001AAB0000-memory.dmpFilesize
128KB