Analysis

  • max time kernel
    71s
  • max time network
    55s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    18-10-2022 22:00

General

  • Target

    chrom.exe

  • Size

    3.9MB

  • MD5

    d60909eb4d445d948740877e759b7b83

  • SHA1

    dc8a672358fa25efbcefb5e4074aab7acdb413a6

  • SHA256

    2d241ce3d2981c29545a11c13ec0ecd7e021759d35dea0c762bb0c63bb1b555d

  • SHA512

    d10292ff78b4e14569d8b96170d0da905b1beb45a1bd76ff7fe7d43b5b72ef079bae7ce68c01759f46b5fb4fc60d367c1cc78fbc676b3adca947f45f58c18242

  • SSDEEP

    98304:FvJ7zh1f+X5wDg+kkq/0j+TdWRRsuwaxhYDU4PQv2Vph2XpR:RPl+XWkkqMaTdWb0aDv2VpC

Malware Config

Extracted

Family

redline

Botnet

Crypt_Mastif

C2

194.36.177.60:81

Attributes
  • auth_value

    26018289184445b16046125f5e616df6

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 6 IoCs
  • YTStealer

    YTStealer is a malware designed to steal YouTube authentication cookies.

  • YTStealer payload 2 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 1 IoCs
  • UPX packed file 5 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Loads dropped DLL 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\chrom.exe
    "C:\Users\Admin\AppData\Local\Temp\chrom.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:864
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1744
    • C:\Users\Admin\AppData\Local\Temp\chrom.exe
      C:\Users\Admin\AppData\Local\Temp\chrom.exe
      2⤵
      • Loads dropped DLL
      • Modifies system certificate store
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:956
      • C:\Users\Admin\AppData\Local\Temp\22windows_64.exe
        "C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"
        3⤵
        • Executes dropped EXE
        PID:548

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\22windows_64.exe
    Filesize

    4.0MB

    MD5

    eaaad4f36853f423ee62272e125708ff

    SHA1

    71c045b6a66fef5dd1f20faefbce8df88c890788

    SHA256

    1901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901

    SHA512

    05292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431

  • \Users\Admin\AppData\Local\Temp\22windows_64.exe
    Filesize

    4.0MB

    MD5

    eaaad4f36853f423ee62272e125708ff

    SHA1

    71c045b6a66fef5dd1f20faefbce8df88c890788

    SHA256

    1901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901

    SHA512

    05292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431

  • \Users\Admin\AppData\Local\Temp\22windows_64.exe
    Filesize

    4.0MB

    MD5

    eaaad4f36853f423ee62272e125708ff

    SHA1

    71c045b6a66fef5dd1f20faefbce8df88c890788

    SHA256

    1901ae31080f9b8f7c419290eab011086a00355a0451e9f634f545f771753901

    SHA512

    05292ae056faf45359b62d8feb6926c1144623e997df0893b9a74e423b84761f2ab6e3786c7fc5d7784e3ae9bff7c2e21166cbb7723f6315538357e674587431

  • memory/548-79-0x0000000001390000-0x00000000021A2000-memory.dmp
    Filesize

    14.1MB

  • memory/548-78-0x0000000001390000-0x00000000021A2000-memory.dmp
    Filesize

    14.1MB

  • memory/548-76-0x0000000000000000-mapping.dmp
  • memory/864-54-0x0000000000940000-0x0000000000D26000-memory.dmp
    Filesize

    3.9MB

  • memory/864-55-0x0000000000800000-0x00000000008B6000-memory.dmp
    Filesize

    728KB

  • memory/864-56-0x0000000076321000-0x0000000076323000-memory.dmp
    Filesize

    8KB

  • memory/864-57-0x00000000023D0000-0x0000000002462000-memory.dmp
    Filesize

    584KB

  • memory/956-68-0x00000000004221FA-mapping.dmp
  • memory/956-66-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/956-65-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/956-70-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/956-72-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/956-67-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/956-63-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/956-62-0x0000000000400000-0x0000000000428000-memory.dmp
    Filesize

    160KB

  • memory/1744-61-0x000000006F760000-0x000000006FD0B000-memory.dmp
    Filesize

    5.7MB

  • memory/1744-60-0x000000006F760000-0x000000006FD0B000-memory.dmp
    Filesize

    5.7MB

  • memory/1744-58-0x0000000000000000-mapping.dmp