Analysis
- max time kernel
42s - max time network
45s - platform
windows7_x64 - resource
win7-20220718-en - resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system - submitted
10/08/2022, 11:11
Static task
static1
Behavioral task
behavioral1
Sample
0f825e504d181de431550ae732e1bc49.exe
Resource
win7-20220718-en
windows7-x64
12 signatures
150 seconds
General
- Target 0f825e504d181de431550ae732e1bc49.exe
- Size 399KB
- Sample220810-m99weabce7
- SHA256 1c097578d9587bd8a233bd383ec71123b03c75b582dcc7e8f5c085e05d32cd3d
- MD5 0f825e504d181de431550ae732e1bc49
- SHA1 829eee9072fec9a8cd750add714b3fde39c4034b
- SHA512 f516b5a6987fcc36bdec18590a2cb8d563afe0bdf20ad641a72a98eb21051a7e62d698000606807dbcd335f1edf0843a0885444bb891068d360bc5ce44cd5ca3
- MD5 SHA1 SHA512
Malware Config
Extracted
Family
-
redline
Botnet
-
1
C2
-
194.156.99.113:46237
Attributes
-
auth_value
46329fc87924eb6eaf95dbb680b20dbd
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/1884-55-0x0000000001D60000-0x0000000001D80000-memory.dmp family_redline - Executes dropped EXE 1 IoCs
pid Process 628 tmpFB60.tmp.exe - Loads dropped DLL 5 IoCs
pid Process 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe 1116 WerFault.exe - Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
pid pid_target Process procid_target 1116 628 WerFault.exe 28 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe 1884 0f825e504d181de431550ae732e1bc49.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1884 0f825e504d181de431550ae732e1bc49.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1884 wrote to memory of 628 1884 0f825e504d181de431550ae732e1bc49.exe 28 PID 1884 wrote to memory of 628 1884 0f825e504d181de431550ae732e1bc49.exe 28 PID 1884 wrote to memory of 628 1884 0f825e504d181de431550ae732e1bc49.exe 28 PID 1884 wrote to memory of 628 1884 0f825e504d181de431550ae732e1bc49.exe 28 PID 628 wrote to memory of 1116 628 tmpFB60.tmp.exe 29 PID 628 wrote to memory of 1116 628 tmpFB60.tmp.exe 29 PID 628 wrote to memory of 1116 628 tmpFB60.tmp.exe 29 PID 628 wrote to memory of 1116 628 tmpFB60.tmp.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0f825e504d181de431550ae732e1bc49.exe"C:\Users\Admin\AppData\Local\Temp\0f825e504d181de431550ae732e1bc49.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 628 -s 443⤵
- Loads dropped DLL
- Program crash
PID:1116
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe
- Size 52KB
- SHA256 aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
- MD5 d8e1495b46cded57eb1423b8bb789834
- SHA1 db64bc20550e51c602dbb92d07c8f02842efebcc
- SHA512 8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
- SSDEEP 768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe
- Size 52KB
- SHA256 aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
- MD5 d8e1495b46cded57eb1423b8bb789834
- SHA1 db64bc20550e51c602dbb92d07c8f02842efebcc
- SHA512 8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
- SSDEEP 768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe
- Size 52KB
- SHA256 aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
- MD5 d8e1495b46cded57eb1423b8bb789834
- SHA1 db64bc20550e51c602dbb92d07c8f02842efebcc
- SHA512 8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
- SSDEEP 768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe
- Size 52KB
- SHA256 aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
- MD5 d8e1495b46cded57eb1423b8bb789834
- SHA1 db64bc20550e51c602dbb92d07c8f02842efebcc
- SHA512 8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
- SSDEEP 768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe
- Size 52KB
- SHA256 aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
- MD5 d8e1495b46cded57eb1423b8bb789834
- SHA1 db64bc20550e51c602dbb92d07c8f02842efebcc
- SHA512 8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
- SSDEEP 768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT
- MD5 SHA1 SHA512 SSDEEP
- Path \Users\Admin\AppData\Local\Temp\tmpFB60.tmp.exe
- Size 52KB
- SHA256 aa2d97b5be06be67ec04774ad681da6113ee2b4929c0539929bbac19926682c8
- MD5 d8e1495b46cded57eb1423b8bb789834
- SHA1 db64bc20550e51c602dbb92d07c8f02842efebcc
- SHA512 8b785d7f8d5fdf12dd9a5414050d403e861fd3f9ac09bceebc57b2f178c6f145389783ed1035b5e6f9b627b3d4d978f3ad9bf8195d92e20f585ef92667e4cabb
- SSDEEP 768:kbx1xSQBLHSq0ItD/hf3aLFLPnWQUQ7x6ziT:kb5SyHRJD/hf3aLlKcxeiT
- MD5 SHA1 SHA512 SSDEEP