Analysis
-
max time kernel
30s -
max time network
32s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
19-08-2022 17:45
General
-
Target
svshost.exe
-
Size
386KB
-
MD5
2a8dd671fac039b821faacc048a8e06b
-
SHA1
95bd9f2bfa523e0e17478a66b730c6b4710bf96b
-
SHA256
65b243019fd5622a750ae253899284b44be6338b7f268d971c0dd847d74a4c80
-
SHA512
a1d9a0175723ba249a20edca94e7bf2325080c415e0208d0d4e7e7e540c72d5cdfbee211444408e894e9659d1886e0c5dbcd531e185ae8df13f83500ae4460d9
Malware Config
Extracted
redline
1877
overthinker1877.duckdns.org:60732
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4372-148-0x0000000000A80000-0x0000000000AE6000-memory.dmp family_redline C:\Users\Admin\AppData\Local\Temp\svchosts.exe family_redline C:\Users\Admin\AppData\Local\Temp\svchosts.exe family_redline behavioral1/memory/2708-265-0x00000000002A0000-0x00000000002D8000-memory.dmp family_redline -
Executes dropped EXE 3 IoCs
Processes:
svchosts.exesvchost.exesvshosts.exepid process 2708 svchosts.exe 4572 svchost.exe 1184 svshosts.exe -
Loads dropped DLL 2 IoCs
Processes:
svshosts.exepid process 1184 svshosts.exe 1184 svshosts.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchosts.exepid process 2708 svchosts.exe 2708 svchosts.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
svchosts.exedescription pid process Token: SeDebugPrivilege 2708 svchosts.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
svshost.exedescription pid process target process PID 4372 wrote to memory of 2708 4372 svshost.exe svchosts.exe PID 4372 wrote to memory of 2708 4372 svshost.exe svchosts.exe PID 4372 wrote to memory of 2708 4372 svshost.exe svchosts.exe PID 4372 wrote to memory of 4572 4372 svshost.exe svchost.exe PID 4372 wrote to memory of 4572 4372 svshost.exe svchost.exe PID 4372 wrote to memory of 4572 4372 svshost.exe svchost.exe PID 4372 wrote to memory of 1184 4372 svshost.exe svshosts.exe PID 4372 wrote to memory of 1184 4372 svshost.exe svshosts.exe PID 4372 wrote to memory of 1184 4372 svshost.exe svshosts.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\svshost.exe"C:\Users\Admin\AppData\Local\Temp\svshost.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exe"C:\Users\Admin\AppData\Local\Temp\svchosts.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\svchost.exe"C:\Users\Admin\AppData\Local\Temp\svchost.exe"2⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\svshosts.exe"C:\Users\Admin\AppData\Local\Temp\svshosts.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
14KB
MD5a48a3480a972dd6d21782f543ea1c2f3
SHA1d71d29a0b4666a59b0758e45ef5d6977dc07f97a
SHA256ea66c460d1e6f7b2fcf3582cdb2c81228f7efe0283b55887084c6a32bc9f4890
SHA512f90b8ddf0275a6aeec7e9f3f603826e451e475204290b0984d53f4aa169f98486c25b792753f3021c15dbd7c739eecd10d1023d8b4e8634ee75ed008f1dc8f50
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
14KB
MD5a48a3480a972dd6d21782f543ea1c2f3
SHA1d71d29a0b4666a59b0758e45ef5d6977dc07f97a
SHA256ea66c460d1e6f7b2fcf3582cdb2c81228f7efe0283b55887084c6a32bc9f4890
SHA512f90b8ddf0275a6aeec7e9f3f603826e451e475204290b0984d53f4aa169f98486c25b792753f3021c15dbd7c739eecd10d1023d8b4e8634ee75ed008f1dc8f50
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exeFilesize
205KB
MD5b3503746bb7f1d30755c9f4a26ce0a2c
SHA12490c2a6b3fad0711993c8bb16aab2d21cefac6f
SHA25690706da9b2d8dca13b4823cb9b6c95bde3df92ac336826722b33cfe495d2e300
SHA512142841d0e5a51212af7f7ae6cd083eb5daa2e5542f3c8294524ff8c722a4dcbe8462bf647f928ba3b3edb4d36638a4be5a83ad5762e9b8e66429f6006901b72c
-
C:\Users\Admin\AppData\Local\Temp\svchosts.exeFilesize
205KB
MD5b3503746bb7f1d30755c9f4a26ce0a2c
SHA12490c2a6b3fad0711993c8bb16aab2d21cefac6f
SHA25690706da9b2d8dca13b4823cb9b6c95bde3df92ac336826722b33cfe495d2e300
SHA512142841d0e5a51212af7f7ae6cd083eb5daa2e5542f3c8294524ff8c722a4dcbe8462bf647f928ba3b3edb4d36638a4be5a83ad5762e9b8e66429f6006901b72c
-
C:\Users\Admin\AppData\Local\Temp\svshosts.exeFilesize
159KB
MD50468aeb5cdadca0da63cb44b88ec4ca4
SHA190649e464438b5519683253bce862b576a61a67e
SHA2567ffb1aa685c2c01dff9ccf00d7fcec0be8699e79a55837ad6d8d1997afe9f22a
SHA512d6339860a625cef9d8702e6ad8e196d6d96574c61f2192b083a313da9ca6060c690de381ffe1fc2877dac89be6320b758aa792814a67c572d8990d200c5549be
-
C:\Users\Admin\AppData\Local\Temp\svshosts.exeFilesize
159KB
MD50468aeb5cdadca0da63cb44b88ec4ca4
SHA190649e464438b5519683253bce862b576a61a67e
SHA2567ffb1aa685c2c01dff9ccf00d7fcec0be8699e79a55837ad6d8d1997afe9f22a
SHA512d6339860a625cef9d8702e6ad8e196d6d96574c61f2192b083a313da9ca6060c690de381ffe1fc2877dac89be6320b758aa792814a67c572d8990d200c5549be
-
\ProgramData\mozglue.dllFilesize
133KB
MD58f73c08a9660691143661bf7332c3c27
SHA137fa65dd737c50fda710fdbde89e51374d0c204a
SHA2563fe6b1c54b8cf28f571e0c5d6636b4069a8ab00b4f11dd842cfec00691d0c9cd
SHA5120042ecf9b3571bb5eba2de893e8b2371df18f7c5a589f52ee66e4bfbaa15a5b8b7cc6a155792aaa8988528c27196896d5e82e1751c998bacea0d92395f66ad89
-
\ProgramData\nss3.dllFilesize
1.2MB
MD5bfac4e3c5908856ba17d41edcd455a51
SHA18eec7e888767aa9e4cca8ff246eb2aacb9170428
SHA256e2935b5b28550d47dc971f456d6961f20d1633b4892998750140e0eaa9ae9d78
SHA5122565bab776c4d732ffb1f9b415992a4c65b81bcd644a9a1df1333a269e322925fc1df4f76913463296efd7c88ef194c3056de2f1ca1357d7b5fe5ff0da877a66
-
memory/1184-178-0x0000000000000000-mapping.dmp
-
memory/1184-186-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/1184-187-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/1184-184-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/1184-182-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/2708-278-0x0000000004AD0000-0x0000000004AE2000-memory.dmpFilesize
72KB
-
memory/2708-297-0x0000000004DE0000-0x0000000004EEA000-memory.dmpFilesize
1.0MB
-
memory/2708-265-0x00000000002A0000-0x00000000002D8000-memory.dmpFilesize
224KB
-
memory/2708-274-0x00000000051A0000-0x00000000057A6000-memory.dmpFilesize
6.0MB
-
memory/2708-330-0x00000000062A0000-0x0000000006316000-memory.dmpFilesize
472KB
-
memory/2708-336-0x0000000007010000-0x0000000007076000-memory.dmpFilesize
408KB
-
memory/2708-285-0x0000000004B30000-0x0000000004B6E000-memory.dmpFilesize
248KB
-
memory/2708-295-0x0000000004B90000-0x0000000004BDB000-memory.dmpFilesize
300KB
-
memory/2708-167-0x0000000000000000-mapping.dmp
-
memory/2708-334-0x00000000063F0000-0x000000000640E000-memory.dmpFilesize
120KB
-
memory/2708-173-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/2708-326-0x0000000005F50000-0x0000000006112000-memory.dmpFilesize
1.8MB
-
memory/2708-172-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/2708-171-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/2708-170-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/2708-169-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/2708-327-0x0000000006650000-0x0000000006B7C000-memory.dmpFilesize
5.2MB
-
memory/4372-138-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-142-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-148-0x0000000000A80000-0x0000000000AE6000-memory.dmpFilesize
408KB
-
memory/4372-149-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-150-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-151-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-152-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-153-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-154-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-155-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-156-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-157-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-158-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-159-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-160-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-161-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-162-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-163-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-164-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-165-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-166-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-146-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-145-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-144-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-143-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-125-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-141-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-140-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-139-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-117-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-116-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-147-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-118-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-119-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-120-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-137-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-183-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-136-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-135-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-121-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-134-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-133-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-132-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-131-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-130-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-122-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-129-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-123-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-128-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-127-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-124-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4372-126-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4572-177-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4572-282-0x0000000005940000-0x00000000059D2000-memory.dmpFilesize
584KB
-
memory/4572-275-0x0000000006100000-0x00000000065FE000-memory.dmpFilesize
5.0MB
-
memory/4572-259-0x0000000000B40000-0x0000000000B4A000-memory.dmpFilesize
40KB
-
memory/4572-185-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4572-181-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4572-179-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4572-176-0x0000000077520000-0x00000000776AE000-memory.dmpFilesize
1.6MB
-
memory/4572-174-0x0000000000000000-mapping.dmp