Analysis
-
max time kernel
94s -
max time network
140s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
19-09-2022 12:09
Static task
static1
Behavioral task
behavioral1
Sample
bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe
Resource
win10-20220812-en
General
-
Target
bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe
-
Size
1.1MB
-
MD5
60c91bf6960a8103919656fbe7da5cdc
-
SHA1
3609a2b98d28f4715e323e000c876c2468d2895c
-
SHA256
bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051
-
SHA512
2ed01e68396007532cace1acaf9c8578af33b3fc9e9474ba93a87e4cf6be50754de1e8f250c060b13662e60776365c8eb22a3eabac87e81743cf3f1d35023c93
-
SSDEEP
24576:We9O5TV7pKJktsJ6+jHg/XJUHhz9V6/7TDP:2TV1XgHgvJEh5V6/7
Malware Config
Extracted
redline
3108_RUZKI
213.219.247.199:9452
-
auth_value
f71fed1cd094e4e1eb7ad1c53e542bca
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/588-273-0x000000000041ADD2-mapping.dmp family_redline behavioral1/memory/588-306-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exedescription pid process target process PID 1524 set thread context of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exebf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exeInstallUtil.exepid process 5012 powershell.exe 5012 powershell.exe 5012 powershell.exe 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe 588 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exepowershell.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe Token: SeDebugPrivilege 5012 powershell.exe Token: SeDebugPrivilege 588 InstallUtil.exe -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exedescription pid process target process PID 1524 wrote to memory of 5012 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe powershell.exe PID 1524 wrote to memory of 5012 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe powershell.exe PID 1524 wrote to memory of 5012 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe powershell.exe PID 1524 wrote to memory of 3240 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 3240 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 3240 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 4028 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 4028 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 4028 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 664 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 664 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 664 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe PID 1524 wrote to memory of 588 1524 bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe"C:\Users\Admin\AppData\Local\Temp\bf69921a8293c830267b93751b85c3b88f6262c371423ae40fe500b20184f051.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAANQAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-273-0x000000000041ADD2-mapping.dmp
-
memory/588-306-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/588-327-0x00000000056C0000-0x0000000005CC6000-memory.dmpFilesize
6.0MB
-
memory/588-328-0x0000000005120000-0x0000000005132000-memory.dmpFilesize
72KB
-
memory/588-329-0x0000000005250000-0x000000000535A000-memory.dmpFilesize
1.0MB
-
memory/588-354-0x0000000007AB0000-0x0000000007FDC000-memory.dmpFilesize
5.2MB
-
memory/588-353-0x0000000006DE0000-0x0000000006FA2000-memory.dmpFilesize
1.8MB
-
memory/588-343-0x0000000005DD0000-0x0000000005DEE000-memory.dmpFilesize
120KB
-
memory/588-339-0x00000000061D0000-0x00000000066CE000-memory.dmpFilesize
5.0MB
-
memory/588-338-0x00000000055F0000-0x0000000005682000-memory.dmpFilesize
584KB
-
memory/588-334-0x00000000051C0000-0x000000000520B000-memory.dmpFilesize
300KB
-
memory/588-332-0x0000000005180000-0x00000000051BE000-memory.dmpFilesize
248KB
-
memory/1524-157-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-162-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-125-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-126-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-127-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-129-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-128-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-130-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-131-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-132-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-133-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-134-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-135-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-136-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-137-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-138-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-139-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-140-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-141-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-142-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-143-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-144-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-145-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-146-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-147-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-148-0x0000000000780000-0x000000000089A000-memory.dmpFilesize
1.1MB
-
memory/1524-149-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-150-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-151-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-152-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-153-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-154-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-155-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-156-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-123-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-158-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-159-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-160-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-161-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-124-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-163-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-164-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-165-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-166-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-167-0x0000000005040000-0x00000000050F6000-memory.dmpFilesize
728KB
-
memory/1524-168-0x00000000051E0000-0x0000000005228000-memory.dmpFilesize
288KB
-
memory/1524-169-0x00000000052A0000-0x0000000005332000-memory.dmpFilesize
584KB
-
memory/1524-170-0x00000000054B0000-0x00000000054D2000-memory.dmpFilesize
136KB
-
memory/1524-171-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-172-0x00000000054E0000-0x0000000005830000-memory.dmpFilesize
3.3MB
-
memory/1524-173-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-174-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-175-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-176-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-177-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-178-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-179-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-180-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-181-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-182-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-183-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-184-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-185-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-116-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-117-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-118-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-119-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-120-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-122-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/1524-121-0x00000000770F0000-0x000000007727E000-memory.dmpFilesize
1.6MB
-
memory/5012-247-0x0000000007DC0000-0x0000000007E26000-memory.dmpFilesize
408KB
-
memory/5012-246-0x00000000074C0000-0x0000000007526000-memory.dmpFilesize
408KB
-
memory/5012-227-0x0000000007690000-0x0000000007CB8000-memory.dmpFilesize
6.2MB
-
memory/5012-222-0x00000000049D0000-0x0000000004A06000-memory.dmpFilesize
216KB
-
memory/5012-186-0x0000000000000000-mapping.dmp
-
memory/5012-250-0x0000000007E50000-0x0000000007E6C000-memory.dmpFilesize
112KB
-
memory/5012-251-0x0000000007E70000-0x0000000007EBB000-memory.dmpFilesize
300KB
-
memory/5012-255-0x0000000008530000-0x00000000085A6000-memory.dmpFilesize
472KB
-
memory/5012-266-0x0000000009D20000-0x000000000A398000-memory.dmpFilesize
6.5MB
-
memory/5012-267-0x00000000092D0000-0x00000000092EA000-memory.dmpFilesize
104KB