Analysis
-
max time kernel
55s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
14-09-2022 13:51
General
-
Target
Cd1qizCvE_ROlgUiLj9URIqZ.exe
-
Size
137KB
-
MD5
1cd36877d5e6e6fafa38f1c9f21cedf3
-
SHA1
e02d4dfad2a1a82a5bc5f6125bb421a02c42d363
-
SHA256
d273fc08938b54321f5d01dfa9200573efdf9d6fb9a2daf038aedd9d1f85ad65
-
SHA512
98756c55b5a2d2497c854edd0a8b47cd36a22467280989ab3cc520b68307d08f91346f594453c6bbba73d296faca46bc7d996caf3fb0e261587efbb6c207569a
-
SSDEEP
3072:UYO/ZMTF5tgoYzdxIwqaasDVVCDFWLRPChaSSc6l:UYMZMB5tgomWwqaasyQpChc
Malware Config
Extracted
redline
nam6.2
103.89.90.61:34589
-
auth_value
4040fe7c77de89cf1a6f4cebd515c54c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2796-153-0x0000000000190000-0x00000000001B8000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 31 IoCs
Processes:
taskmgr.exeCd1qizCvE_ROlgUiLj9URIqZ.exepid process 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 2796 Cd1qizCvE_ROlgUiLj9URIqZ.exe 4504 taskmgr.exe 2796 Cd1qizCvE_ROlgUiLj9URIqZ.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
taskmgr.exeCd1qizCvE_ROlgUiLj9URIqZ.exedescription pid process Token: SeDebugPrivilege 4504 taskmgr.exe Token: SeSystemProfilePrivilege 4504 taskmgr.exe Token: SeCreateGlobalPrivilege 4504 taskmgr.exe Token: SeDebugPrivilege 2796 Cd1qizCvE_ROlgUiLj9URIqZ.exe -
Suspicious use of FindShellTrayWindow 42 IoCs
Processes:
taskmgr.exepid process 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe -
Suspicious use of SendNotifyMessage 41 IoCs
Processes:
taskmgr.exepid process 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe 4504 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Cd1qizCvE_ROlgUiLj9URIqZ.exe"C:\Users\Admin\AppData\Local\Temp\Cd1qizCvE_ROlgUiLj9URIqZ.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2796-120-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-121-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-122-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-123-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-124-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-125-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-126-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-127-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-128-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-129-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-130-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-131-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-132-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-133-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-134-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-135-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-136-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-137-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-138-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-139-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-140-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-141-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-142-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-143-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-144-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-145-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-146-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-147-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-148-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-149-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-150-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-151-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-152-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-153-0x0000000000190000-0x00000000001B8000-memory.dmpFilesize
160KB
-
memory/2796-154-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-155-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-156-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-157-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-158-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-159-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-160-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-161-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-162-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-163-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-164-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-165-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-166-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-167-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-168-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-169-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-170-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-171-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-172-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-173-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-174-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-175-0x0000000005670000-0x0000000005C76000-memory.dmpFilesize
6.0MB
-
memory/2796-176-0x0000000005C80000-0x0000000005D8A000-memory.dmpFilesize
1.0MB
-
memory/2796-177-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-178-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-179-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-180-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-181-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-182-0x00000000055E0000-0x00000000055F2000-memory.dmpFilesize
72KB
-
memory/2796-183-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-184-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-185-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-186-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-187-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2796-189-0x00000000070D0000-0x000000000710E000-memory.dmpFilesize
248KB
-
memory/2796-191-0x00000000050F0000-0x000000000513B000-memory.dmpFilesize
300KB
-
memory/2796-195-0x0000000007610000-0x0000000007B0E000-memory.dmpFilesize
5.0MB
-
memory/2796-197-0x0000000005300000-0x0000000005366000-memory.dmpFilesize
408KB
-
memory/2796-204-0x0000000007110000-0x00000000071A2000-memory.dmpFilesize
584KB
-
memory/2796-205-0x00000000071B0000-0x0000000007226000-memory.dmpFilesize
472KB
-
memory/2796-206-0x00000000053C0000-0x0000000005410000-memory.dmpFilesize
320KB
-
memory/2796-207-0x0000000008CE0000-0x0000000008EA2000-memory.dmpFilesize
1.8MB
-
memory/2796-208-0x00000000093E0000-0x000000000990C000-memory.dmpFilesize
5.2MB