Analysis
-
max time kernel
53s -
max time network
58s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
13-08-2022 06:13
Static task
static1
Behavioral task
behavioral1
Sample
bcbd2fe43df8ff15d3e4503438a54951.exe
Resource
win7-20220812-en
General
-
Target
bcbd2fe43df8ff15d3e4503438a54951.exe
-
Size
3.9MB
-
MD5
bcbd2fe43df8ff15d3e4503438a54951
-
SHA1
2c3848c520573916606777df889ab7e0f9a84ea3
-
SHA256
dde8987c6126117794a9922ce253a735bd113100a8e56412b518bd9349e70d83
-
SHA512
b72ee7273a6869b0f90b35a6e944c2c92030d3a219504e70ceaa843b592ef97331cc621c4bf0aca2daa78017b94a0402211c7d2f0becca7926ee97c30be3959d
Malware Config
Extracted
redline
185.215.113.83:60722
-
auth_value
a1b687bd55ee0ce016df2e017a162814
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4184-132-0x0000000000400000-0x0000000000A9F000-memory.dmp family_redline behavioral2/memory/214820-137-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
YTStealer payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4944-164-0x0000000000F60000-0x0000000001D39000-memory.dmp family_ytstealer -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Starter.exestart.exepid process 3960 Starter.exe 4944 start.exe -
Processes:
resource yara_rule C:\Users\Admin\AppData\Local\Temp\start.exe upx C:\Users\Admin\AppData\Local\Temp\start.exe upx behavioral2/memory/4944-162-0x0000000000F60000-0x0000000001D39000-memory.dmp upx behavioral2/memory/4944-164-0x0000000000F60000-0x0000000001D39000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bcbd2fe43df8ff15d3e4503438a54951.exedescription pid process target process PID 4184 set thread context of 214820 4184 bcbd2fe43df8ff15d3e4503438a54951.exe AppLaunch.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
AppLaunch.exestart.exepid process 214820 AppLaunch.exe 4944 start.exe 4944 start.exe 4944 start.exe 4944 start.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
AppLaunch.exeStarter.exedescription pid process Token: SeDebugPrivilege 214820 AppLaunch.exe Token: SeDebugPrivilege 3960 Starter.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
bcbd2fe43df8ff15d3e4503438a54951.exeAppLaunch.exestart.execmd.exedescription pid process target process PID 4184 wrote to memory of 214820 4184 bcbd2fe43df8ff15d3e4503438a54951.exe AppLaunch.exe PID 4184 wrote to memory of 214820 4184 bcbd2fe43df8ff15d3e4503438a54951.exe AppLaunch.exe PID 4184 wrote to memory of 214820 4184 bcbd2fe43df8ff15d3e4503438a54951.exe AppLaunch.exe PID 4184 wrote to memory of 214820 4184 bcbd2fe43df8ff15d3e4503438a54951.exe AppLaunch.exe PID 4184 wrote to memory of 214820 4184 bcbd2fe43df8ff15d3e4503438a54951.exe AppLaunch.exe PID 214820 wrote to memory of 3960 214820 AppLaunch.exe Starter.exe PID 214820 wrote to memory of 3960 214820 AppLaunch.exe Starter.exe PID 214820 wrote to memory of 3960 214820 AppLaunch.exe Starter.exe PID 214820 wrote to memory of 4944 214820 AppLaunch.exe start.exe PID 214820 wrote to memory of 4944 214820 AppLaunch.exe start.exe PID 4944 wrote to memory of 5052 4944 start.exe cmd.exe PID 4944 wrote to memory of 5052 4944 start.exe cmd.exe PID 5052 wrote to memory of 3404 5052 cmd.exe choice.exe PID 5052 wrote to memory of 3404 5052 cmd.exe choice.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bcbd2fe43df8ff15d3e4503438a54951.exe"C:\Users\Admin\AppData\Local\Temp\bcbd2fe43df8ff15d3e4503438a54951.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Starter.exe"C:\Users\Admin\AppData\Local\Temp\Starter.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\start.exe"C:\Users\Admin\AppData\Local\Temp\start.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /C choice /C Y /N /D Y /T 0 &Del C:\Users\Admin\AppData\Local\Temp\start.exe4⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\choice.exechoice /C Y /N /D Y /T 05⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Starter.exeFilesize
18KB
MD53d41fe66e7592eb35c5ef99a83fce2a4
SHA15dc2984ceb1a169b5571267159c43f1b0e5d757d
SHA2567c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198
SHA5129ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285
-
C:\Users\Admin\AppData\Local\Temp\Starter.exeFilesize
18KB
MD53d41fe66e7592eb35c5ef99a83fce2a4
SHA15dc2984ceb1a169b5571267159c43f1b0e5d757d
SHA2567c58039db066e640a338ac6180adcf0b45cbfb9adaa7ae3b279d4628159c4198
SHA5129ac687f2278f19265ae361eee6bbbe0234fed0d9b16c9f4524af8c9e1e131a51fddfa0a19cbbda9feb0b5ccf22ffaad97d5c425f179cb7d920dba66ad7f4e285
-
C:\Users\Admin\AppData\Local\Temp\start.exeFilesize
4.0MB
MD5b09ec6718a34a70a182f3412b89f6777
SHA1e730645db18339897aeddb4f21ce662911e03444
SHA25621c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2
SHA5125d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881
-
C:\Users\Admin\AppData\Local\Temp\start.exeFilesize
4.0MB
MD5b09ec6718a34a70a182f3412b89f6777
SHA1e730645db18339897aeddb4f21ce662911e03444
SHA25621c2f78a2ba5891c4dbdc1b50283844c7720ecd3f1187fb9269015524cad2da2
SHA5125d0f9eb9fcfe8a5d6c42db552d35411116ec0b405e747537a75fd50fb6e9f1d1fc1bf95c169c5ef7c2d217b7cc5d647a6ed36f130e0382a71f919c5e09ec7881
-
memory/3404-165-0x0000000000000000-mapping.dmp
-
memory/3960-158-0x0000000004CE0000-0x0000000004CEA000-memory.dmpFilesize
40KB
-
memory/3960-157-0x0000000000460000-0x000000000046A000-memory.dmpFilesize
40KB
-
memory/3960-154-0x0000000000000000-mapping.dmp
-
memory/4184-132-0x0000000000400000-0x0000000000A9F000-memory.dmpFilesize
6.6MB
-
memory/4944-159-0x0000000000000000-mapping.dmp
-
memory/4944-162-0x0000000000F60000-0x0000000001D39000-memory.dmpFilesize
13.8MB
-
memory/4944-164-0x0000000000F60000-0x0000000001D39000-memory.dmpFilesize
13.8MB
-
memory/5052-163-0x0000000000000000-mapping.dmp
-
memory/214820-145-0x0000000004A60000-0x0000000004A9C000-memory.dmpFilesize
240KB
-
memory/214820-147-0x0000000004E80000-0x0000000004F12000-memory.dmpFilesize
584KB
-
memory/214820-152-0x00000000072A0000-0x0000000007462000-memory.dmpFilesize
1.8MB
-
memory/214820-151-0x0000000006360000-0x00000000063B0000-memory.dmpFilesize
320KB
-
memory/214820-150-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/214820-149-0x0000000005560000-0x000000000557E000-memory.dmpFilesize
120KB
-
memory/214820-148-0x0000000005AF0000-0x0000000006094000-memory.dmpFilesize
5.6MB
-
memory/214820-153-0x00000000079A0000-0x0000000007ECC000-memory.dmpFilesize
5.2MB
-
memory/214820-146-0x0000000004D60000-0x0000000004DD6000-memory.dmpFilesize
472KB
-
memory/214820-144-0x0000000004AF0000-0x0000000004BFA000-memory.dmpFilesize
1.0MB
-
memory/214820-143-0x00000000049C0000-0x00000000049D2000-memory.dmpFilesize
72KB
-
memory/214820-142-0x0000000004F20000-0x0000000005538000-memory.dmpFilesize
6.1MB
-
memory/214820-137-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/214820-136-0x0000000000000000-mapping.dmp