Analysis
-
max time kernel
106s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
07-09-2022 17:38
Static task
static1
Behavioral task
behavioral1
Sample
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe
Resource
win10v2004-20220901-en
General
-
Target
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe
-
Size
7.5MB
-
MD5
c1b44db2990ba08e43d65fa81e154449
-
SHA1
9216a86f23f7cf335e2e98c147aa5f312717eecd
-
SHA256
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42
-
SHA512
c5f68344ee1c973270305215704aba551acf9efad0a7b19980068c3c1444e2ad5b244015894dffcee9278e094f2a66f538d7b3e0e19b7ec921058748752f1d4a
-
SSDEEP
196608:+F+hlISnMzMMbIVE58i1J3/vjN6FS1xv5Rq9ZuzPt:c+l/wkVESi1xv/5Y9Z+
Malware Config
Extracted
redline
3108_RUZKI
213.219.247.199:9452
-
auth_value
f71fed1cd094e4e1eb7ad1c53e542bca
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4860-139-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Control Panel\International\Geo\Nation 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exedescription pid process target process PID 3740 set thread context of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 3080 ipconfig.exe 4600 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 4860 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe Token: SeDebugPrivilege 4860 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exedescription pid process target process PID 3740 wrote to memory of 3080 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe ipconfig.exe PID 3740 wrote to memory of 3080 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe ipconfig.exe PID 3740 wrote to memory of 3080 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe ipconfig.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4860 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe RegAsm.exe PID 3740 wrote to memory of 4600 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe ipconfig.exe PID 3740 wrote to memory of 4600 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe ipconfig.exe PID 3740 wrote to memory of 4600 3740 6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe"C:\Users\Admin\AppData\Local\Temp\6cca9fef66cc8fdb27871f8fb01e870734343c5c3fa480f5518d5d02e90afd42.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /release2⤵
- Gathers network information
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /renew2⤵
- Gathers network information
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3080-137-0x0000000000000000-mapping.dmp
-
memory/3740-132-0x0000000000070000-0x00000000007F8000-memory.dmpFilesize
7.5MB
-
memory/3740-133-0x0000000005B20000-0x000000000604C000-memory.dmpFilesize
5.2MB
-
memory/3740-134-0x0000000005690000-0x0000000005722000-memory.dmpFilesize
584KB
-
memory/3740-135-0x0000000006600000-0x0000000006BA4000-memory.dmpFilesize
5.6MB
-
memory/3740-136-0x0000000005950000-0x00000000059EC000-memory.dmpFilesize
624KB
-
memory/4600-140-0x0000000000000000-mapping.dmp
-
memory/4860-139-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4860-138-0x0000000000000000-mapping.dmp
-
memory/4860-141-0x0000000005A50000-0x0000000006068000-memory.dmpFilesize
6.1MB
-
memory/4860-142-0x0000000005480000-0x0000000005492000-memory.dmpFilesize
72KB
-
memory/4860-143-0x00000000055B0000-0x00000000056BA000-memory.dmpFilesize
1.0MB
-
memory/4860-144-0x00000000054E0000-0x000000000551C000-memory.dmpFilesize
240KB
-
memory/4860-145-0x0000000005840000-0x00000000058A6000-memory.dmpFilesize
408KB
-
memory/4860-146-0x0000000006370000-0x00000000063E6000-memory.dmpFilesize
472KB
-
memory/4860-147-0x00000000067A0000-0x00000000067BE000-memory.dmpFilesize
120KB
-
memory/4860-148-0x00000000070C0000-0x0000000007282000-memory.dmpFilesize
1.8MB