Analysis
-
max time kernel
78s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
12-09-2022 19:26
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220812-en
General
-
Target
file.exe
-
Size
358KB
-
MD5
5ca78e4191699df68c9b08460c9f7a2a
-
SHA1
c419ffa4098ac2b5cd06a71d08bf8360c1e70631
-
SHA256
6b17d488dbf2b4ca6d6a8f0bd38ef68d006e3a3991b597f9be1cc56728038962
-
SHA512
3ff62786f59b3796416e4eb13707b3470d57560a45ef79392a15ea0c68f00b80fbf74b6aa06eb03e39738780ec9a4b82cd9327da036e87849bf8d9dd99441eaa
-
SSDEEP
6144:OlzcfHp87wQqTBguSyR8X6yTULyWFfxZ/j1nO8TYG0bAG+qQ6xT+UhbnKj7BPa+Q:Ol+JNN+uSyKXFTqFfxZ/j1nO8TYG0bAh
Malware Config
Extracted
redline
5
79.110.62.196:26277
-
auth_value
febe6965b41d2583ad2bb6b5aa23cfd5
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/948-54-0x0000000000020000-0x0000000000080000-memory.dmp family_redline -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
Processes:
Updater.exeoobeldr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ Updater.exe Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ oobeldr.exe -
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
Processes:
Updater.exeoobeldr.exepid process 1504 Updater.exe 1744 oobeldr.exe -
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
Updater.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion Updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion Updater.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion oobeldr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion oobeldr.exe -
Loads dropped DLL 1 IoCs
Processes:
file.exepid process 948 file.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Processes:
Updater.exeoobeldr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Updater.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA oobeldr.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
Processes:
Updater.exeoobeldr.exepid process 1504 Updater.exe 1744 oobeldr.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
file.exeUpdater.exeoobeldr.exepid process 948 file.exe 948 file.exe 1504 Updater.exe 1744 oobeldr.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 948 file.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
file.exeUpdater.exetaskeng.exeoobeldr.exedescription pid process target process PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 948 wrote to memory of 1504 948 file.exe Updater.exe PID 1504 wrote to memory of 1560 1504 Updater.exe schtasks.exe PID 1504 wrote to memory of 1560 1504 Updater.exe schtasks.exe PID 1504 wrote to memory of 1560 1504 Updater.exe schtasks.exe PID 1504 wrote to memory of 1560 1504 Updater.exe schtasks.exe PID 1780 wrote to memory of 1744 1780 taskeng.exe oobeldr.exe PID 1780 wrote to memory of 1744 1780 taskeng.exe oobeldr.exe PID 1780 wrote to memory of 1744 1780 taskeng.exe oobeldr.exe PID 1780 wrote to memory of 1744 1780 taskeng.exe oobeldr.exe PID 1744 wrote to memory of 432 1744 oobeldr.exe schtasks.exe PID 1744 wrote to memory of 432 1744 oobeldr.exe schtasks.exe PID 1744 wrote to memory of 432 1744 oobeldr.exe schtasks.exe PID 1744 wrote to memory of 432 1744 oobeldr.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
-
C:\Windows\system32\taskeng.exetaskeng.exe {F94F8FBB-FB94-41BA-B596-3E780A5E743A} S-1-5-21-3845472200-3839195424-595303356-1000:ZERMMMDR\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeC:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe/C /create /F /sc minute /mo 1 /tn "Telemetry Logging" /tr "C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exe"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
C:\Users\Admin\AppData\Roaming\Microsoft\Protect\oobeldr.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
2.8MB
MD5ecfae3cc8a7ba2e4681a378864658af6
SHA1a84beb327be022f600aed467c2029b4301756dca
SHA25620239b724322bdef1aa4adbdfaa03a90d1f18a5b3b8bcfb16dec10a5823ac0fd
SHA51233ce30cdcfb7b86cdd86e3f9ba7ff97ea168001eca76e0c05f14555a25ce200f2e661b03e8ab762b4a9330bfd794b6366912768a4cce7f88c60c9a2a5717abda
-
memory/432-74-0x0000000000000000-mapping.dmp
-
memory/948-55-0x00000000004E0000-0x00000000004E6000-memory.dmpFilesize
24KB
-
memory/948-54-0x0000000000020000-0x0000000000080000-memory.dmpFilesize
384KB
-
memory/948-56-0x0000000074AB1000-0x0000000074AB3000-memory.dmpFilesize
8KB
-
memory/1504-67-0x0000000076E90000-0x0000000077010000-memory.dmpFilesize
1.5MB
-
memory/1504-65-0x00000000013E0000-0x000000000189C000-memory.dmpFilesize
4.7MB
-
memory/1504-66-0x00000000013E0000-0x000000000189C000-memory.dmpFilesize
4.7MB
-
memory/1504-58-0x0000000000000000-mapping.dmp
-
memory/1504-61-0x00000000013E0000-0x000000000189C000-memory.dmpFilesize
4.7MB
-
memory/1504-62-0x0000000076E90000-0x0000000077010000-memory.dmpFilesize
1.5MB
-
memory/1560-64-0x0000000000000000-mapping.dmp
-
memory/1744-72-0x0000000000E10000-0x00000000012CC000-memory.dmpFilesize
4.7MB
-
memory/1744-73-0x0000000076E90000-0x0000000077010000-memory.dmpFilesize
1.5MB
-
memory/1744-69-0x0000000000000000-mapping.dmp
-
memory/1744-75-0x0000000000E10000-0x00000000012CC000-memory.dmpFilesize
4.7MB
-
memory/1744-76-0x0000000000E10000-0x00000000012CC000-memory.dmpFilesize
4.7MB
-
memory/1744-77-0x0000000076E90000-0x0000000077010000-memory.dmpFilesize
1.5MB
-
memory/1744-78-0x0000000000E10000-0x00000000012CC000-memory.dmpFilesize
4.7MB