Analysis
-
max time kernel
152s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
20-10-2022 17:39
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v2004-20220812-en
General
-
Target
file.exe
-
Size
368KB
-
MD5
d896bb5d82c5b8f7f32cf4bbbd8d58d3
-
SHA1
edd21146086ebd68b4974d75eefe46b81eb91db3
-
SHA256
64ab4ef26c1ba7198236df31bef06dbab47ca17f0abd81823a39d244327ba1ab
-
SHA512
8ddea7f4293ee802c5efee47c5a9168be2c90e21a175546e514c80e769219a5e6e7cc0416468d56c45340986d84b97c264671774e20aec857a4fdc862e66fab8
-
SSDEEP
1536:rrae78zjORCDGwfdCSog01313gs5gcXqr:BahKyd2n31Z5pqr
Malware Config
Extracted
redline
Nigh
80.66.87.20:80
-
auth_value
dab8506635d1dc134af4ebaedf4404eb
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4188-154-0x0000000000400000-0x0000000000428000-memory.dmp family_redline -
Executes dropped EXE 6 IoCs
Processes:
SETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exeSETUP_~1.EXESETUP_~1.EXESETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exepid process 2380 SETUP_~1.EXE 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe 1604 SETUP_~1.EXE 920 SETUP_~1.EXE 4188 SETUP_~1.EXE 4700 Nuktvijioppmpfdjkrcwhoprojections_s.exe -
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
SETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation SETUP_~1.EXE Key value queried \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Control Panel\International\Geo\Nation Nuktvijioppmpfdjkrcwhoprojections_s.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
file.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce file.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" file.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 2 IoCs
Processes:
SETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exedescription pid process target process PID 2380 set thread context of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 3312 set thread context of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
powershell.exeSETUP_~1.EXEpowershell.exeSETUP_~1.EXEpid process 1840 powershell.exe 1840 powershell.exe 2380 SETUP_~1.EXE 2380 SETUP_~1.EXE 2380 SETUP_~1.EXE 2380 SETUP_~1.EXE 4128 powershell.exe 4128 powershell.exe 4188 SETUP_~1.EXE 4188 SETUP_~1.EXE -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
SETUP_~1.EXEpowershell.exeNuktvijioppmpfdjkrcwhoprojections_s.exeSETUP_~1.EXEpowershell.exedescription pid process Token: SeDebugPrivilege 2380 SETUP_~1.EXE Token: SeDebugPrivilege 1840 powershell.exe Token: SeDebugPrivilege 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Token: SeDebugPrivilege 4188 SETUP_~1.EXE Token: SeDebugPrivilege 4128 powershell.exe -
Suspicious use of WriteProcessMemory 30 IoCs
Processes:
file.exeSETUP_~1.EXENuktvijioppmpfdjkrcwhoprojections_s.exedescription pid process target process PID 2240 wrote to memory of 2380 2240 file.exe SETUP_~1.EXE PID 2240 wrote to memory of 2380 2240 file.exe SETUP_~1.EXE PID 2240 wrote to memory of 2380 2240 file.exe SETUP_~1.EXE PID 2380 wrote to memory of 1840 2380 SETUP_~1.EXE powershell.exe PID 2380 wrote to memory of 1840 2380 SETUP_~1.EXE powershell.exe PID 2380 wrote to memory of 1840 2380 SETUP_~1.EXE powershell.exe PID 2380 wrote to memory of 3312 2380 SETUP_~1.EXE Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 2380 wrote to memory of 3312 2380 SETUP_~1.EXE Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 2380 wrote to memory of 1604 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 1604 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 1604 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 920 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 920 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 920 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 2380 wrote to memory of 4188 2380 SETUP_~1.EXE SETUP_~1.EXE PID 3312 wrote to memory of 4128 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe powershell.exe PID 3312 wrote to memory of 4128 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe powershell.exe PID 3312 wrote to memory of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 3312 wrote to memory of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 3312 wrote to memory of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 3312 wrote to memory of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 3312 wrote to memory of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe PID 3312 wrote to memory of 4700 3312 Nuktvijioppmpfdjkrcwhoprojections_s.exe Nuktvijioppmpfdjkrcwhoprojections_s.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE2⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exe"C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exe"3⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exeC:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exe4⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Nuktvijioppmpfdjkrcwhoprojections_s.exe.logFilesize
1KB
MD5165bccf3bb1841eaf1a73ff52d65f59e
SHA18450f78886ff5ee9f0a1590582ed455624ae7eca
SHA256d063952c091e25214469458e65b33da9ef9b413ede9cc2b8a5c28970bb1a5b69
SHA512519d9ffd811bea83a16c234e25172ea186932c45b7004a309d536d0b3b465cc9c3409afc0fdf481fa215a395e305bbb5f2e209f6e0139875d710f23ff38fd5a4
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.logFilesize
1KB
MD5e87e48b105757e1c7563d1c719059733
SHA128a3f2b2e0672da2b531f4757d2b20b53032dafc
SHA2560aaf22dc84cc3fcfe53de7ccfed8e662247dfb7f1a9967032c88790d0c663461
SHA512bf19c5743143aee914a453c41189c722c9b90a5b8bf299cecf3e1f97656d32cd209ecb74da8aebc89bb41c27d189f73aaaabbc64fe383410c95dc76ad4218968
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\ModuleAnalysisCacheFilesize
53KB
MD506ad34f9739c5159b4d92d702545bd49
SHA19152a0d4f153f3f40f7e606be75f81b582ee0c17
SHA256474813b625f00710f29fa3b488235a6a22201851efb336bddf60d7d24a66bfba
SHA512c272cd28ae164d465b779163ba9eca6a28261376414c6bbdfbd9f2128adb7f7ff1420e536b4d6000d0301ded2ec9036bc5c657588458bff41f176bdce8d74f92
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractiveFilesize
16KB
MD5dd03246458f2e2482ffb06316917763b
SHA117643d75612c50750ed8ba4f1262f022077097c2
SHA25679e2415caeaca9bbaf59bae1540c47355bfec009c6f69f28fbabe32ce8d3087a
SHA51239264a4661d1348a477768a148701cb02edf1c58fca726d38c4a4abb977b200988a8e065b8596bcda3c93855759c97f906926a697c27343d21020a6fded7d50d
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXEFilesize
214.6MB
MD5baf3b26e5290c2b658e0993ac4bacaf5
SHA1296f6dc637defc0ee638793aac6ed9a09b8f0515
SHA2569214a72501ec76cbc19ee9cace68f48afb864164652be3124a7ab05b9a37d655
SHA5124d7f8623a2af090134d1d3815d53a2980d83f84312458191234a462fdfd69f73fbdf83d8887518a6b6b804b9fb52cff3701a2b99cee9bf9c1bb15e565137d58f
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exeFilesize
5KB
MD51478b815565de4723822479760dd551a
SHA14ec2ed62384a8d15dc56073cd0791cf711355404
SHA25632698160fed7ce9defc0775cbcf932d14ce9c11ee4ce63232b852e0f32e87a1f
SHA512116040b609402ef26a53c9e6eb5866e584f0e35c47db110f97f38cebfd1a4287ed7069f3459f6bb3ef40637cea65d99410703c46dcc228313772c20c0bd5f315
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exeFilesize
5KB
MD51478b815565de4723822479760dd551a
SHA14ec2ed62384a8d15dc56073cd0791cf711355404
SHA25632698160fed7ce9defc0775cbcf932d14ce9c11ee4ce63232b852e0f32e87a1f
SHA512116040b609402ef26a53c9e6eb5866e584f0e35c47db110f97f38cebfd1a4287ed7069f3459f6bb3ef40637cea65d99410703c46dcc228313772c20c0bd5f315
-
C:\Users\Admin\AppData\Local\Temp\Nuktvijioppmpfdjkrcwhoprojections_s.exeFilesize
5KB
MD51478b815565de4723822479760dd551a
SHA14ec2ed62384a8d15dc56073cd0791cf711355404
SHA25632698160fed7ce9defc0775cbcf932d14ce9c11ee4ce63232b852e0f32e87a1f
SHA512116040b609402ef26a53c9e6eb5866e584f0e35c47db110f97f38cebfd1a4287ed7069f3459f6bb3ef40637cea65d99410703c46dcc228313772c20c0bd5f315
-
memory/920-151-0x0000000000000000-mapping.dmp
-
memory/1604-149-0x0000000000000000-mapping.dmp
-
memory/1840-144-0x0000000006700000-0x000000000671A000-memory.dmpFilesize
104KB
-
memory/1840-139-0x0000000005360000-0x0000000005988000-memory.dmpFilesize
6.2MB
-
memory/1840-137-0x0000000000000000-mapping.dmp
-
memory/1840-143-0x00000000079B0000-0x000000000802A000-memory.dmpFilesize
6.5MB
-
memory/1840-142-0x00000000062C0000-0x00000000062DE000-memory.dmpFilesize
120KB
-
memory/1840-141-0x0000000005C70000-0x0000000005CD6000-memory.dmpFilesize
408KB
-
memory/1840-140-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/1840-138-0x0000000004CF0000-0x0000000004D26000-memory.dmpFilesize
216KB
-
memory/2380-132-0x0000000000000000-mapping.dmp
-
memory/2380-135-0x00000000001E0000-0x00000000001E8000-memory.dmpFilesize
32KB
-
memory/2380-136-0x0000000005A50000-0x0000000005A72000-memory.dmpFilesize
136KB
-
memory/3312-145-0x0000000000000000-mapping.dmp
-
memory/3312-180-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB
-
memory/3312-158-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB
-
memory/3312-148-0x0000000000D00000-0x0000000000D06000-memory.dmpFilesize
24KB
-
memory/3312-165-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB
-
memory/3312-162-0x0000000002E80000-0x0000000002EA2000-memory.dmpFilesize
136KB
-
memory/4128-163-0x0000000000000000-mapping.dmp
-
memory/4128-168-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB
-
memory/4128-175-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB
-
memory/4128-164-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB
-
memory/4188-172-0x0000000007D30000-0x000000000825C000-memory.dmpFilesize
5.2MB
-
memory/4188-174-0x0000000006F20000-0x0000000006F70000-memory.dmpFilesize
320KB
-
memory/4188-169-0x0000000006C00000-0x0000000006C92000-memory.dmpFilesize
584KB
-
memory/4188-170-0x0000000007250000-0x00000000077F4000-memory.dmpFilesize
5.6MB
-
memory/4188-171-0x0000000006F70000-0x0000000007132000-memory.dmpFilesize
1.8MB
-
memory/4188-160-0x0000000005270000-0x0000000005282000-memory.dmpFilesize
72KB
-
memory/4188-173-0x0000000007140000-0x00000000071B6000-memory.dmpFilesize
472KB
-
memory/4188-159-0x0000000005340000-0x000000000544A000-memory.dmpFilesize
1.0MB
-
memory/4188-161-0x00000000052E0000-0x000000000531C000-memory.dmpFilesize
240KB
-
memory/4188-153-0x0000000000000000-mapping.dmp
-
memory/4188-154-0x0000000000400000-0x0000000000428000-memory.dmpFilesize
160KB
-
memory/4188-157-0x00000000057C0000-0x0000000005DD8000-memory.dmpFilesize
6.1MB
-
memory/4700-176-0x0000000140000000-0x0000000140056000-memory.dmpFilesize
344KB
-
memory/4700-177-0x0000000140000000-mapping.dmp
-
memory/4700-181-0x00007FFAD91A0000-0x00007FFAD9C61000-memory.dmpFilesize
10.8MB