Resubmissions

22/12/2022, 00:38

221222-azdc8sdf64 8

04/11/2022, 18:34

221104-w73hzsbgal 10

04/11/2022, 17:36

221104-v6p1tsbcbp 10

Analysis

  • max time kernel
    147s
  • max time network
    151s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    04/11/2022, 17:36

General

  • Target

    7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe

  • Size

    427KB

  • MD5

    c34729173ecc820eb7674431597d78be

  • SHA1

    884f343876a8bb0ebac63c28191c22c6f69590f8

  • SHA256

    7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0

  • SHA512

    f9c93a0c6f55217016fe5ba550e9948662901b9240662708ac93074bf9692427b73ce10864927026b118aeb6622a47cfa04976bbc9b482a31aef21a5c96786a0

  • SSDEEP

    3072:yvGyYiSDnt1Et5CmPo8VGAnxoctr6Byd4TUISI:24UCp6n756BmlI

Malware Config

Extracted

Family

redline

Botnet

Nigh

C2

80.66.87.20:80

Attributes
  • auth_value

    dab8506635d1dc134af4ebaedf4404eb

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 3 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe
    "C:\Users\Admin\AppData\Local\Temp\7ad55278a8285dace5bb637348e5990c356a7c35bbcb8e2d53fd3dc64573d4c0.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of WriteProcessMemory
    PID:2408
    • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
      C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2740
      • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
        "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMwA1AA==
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4156
      • C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe
        "C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:436
      • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
        C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE
        3⤵
        • Executes dropped EXE
        PID:3992

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\SETUP_~1.EXE.log

          Filesize

          1KB

          MD5

          94783fcf58c98f5ea0b416f441ad15eb

          SHA1

          979a7c39c6a5dbed314bc41a22c4ccdca6db206b

          SHA256

          117df0a0e80abf166ef148863dd82ba9e75c05b38ed3979d048f5fcc848ef905

          SHA512

          9301306461cb978e91761b24b1d04339c2bff71771431987cd8dc373387c12feb81dbdbf272da1f7c045eade4ffff1976885ca705ca7cf9a40a6c4a7553aa06c

        • C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe

          Filesize

          6KB

          MD5

          d0b53e53092311bc055630adf3e4ccdc

          SHA1

          bf66777607a1d968e3194fe047f9a0e03f249f28

          SHA256

          0cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e

          SHA512

          34ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6

        • C:\Users\Admin\AppData\Local\Temp\Hwqujbjwlyvggktrainingadministrator_s.exe

          Filesize

          6KB

          MD5

          d0b53e53092311bc055630adf3e4ccdc

          SHA1

          bf66777607a1d968e3194fe047f9a0e03f249f28

          SHA256

          0cdff2f53a06a63f46dd3e773c3ae99f1d29826975295407046d2d87f609fc3e

          SHA512

          34ecfda7dcad85b6e29fe4a51d7798517d1c2432879eee547e254d251c7f21a52616af58c1a5ce6d50a6a505cf2d03a8e46a3d3a441ca18df1aa86ed9bc546c6

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

          Filesize

          214.6MB

          MD5

          4786de75433835fdc9d3d08edf8116ca

          SHA1

          2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

          SHA256

          d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

          SHA512

          e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

          Filesize

          214.6MB

          MD5

          4786de75433835fdc9d3d08edf8116ca

          SHA1

          2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

          SHA256

          d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

          SHA512

          e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

        • C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\SETUP_~1.EXE

          Filesize

          214.6MB

          MD5

          4786de75433835fdc9d3d08edf8116ca

          SHA1

          2c6843f4b1992eeb9215c4d582a94c4ceb7284f9

          SHA256

          d70c8ccf220b6424009b114c1af14df7e472b368f3c72b186322eeb86604b4eb

          SHA512

          e828ee36882c3d95c4c86ee0bd396527d3eb89f036c706f6f108e2caf8c2e87f946dbaddfb71db9a386cb7c111622cbcdbe46feff0563a7f4cb4fd59f32c9ad9

        • memory/436-365-0x00000000000D0000-0x00000000000D8000-memory.dmp

          Filesize

          32KB

        • memory/2740-159-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-163-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-122-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-123-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-124-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-126-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-127-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-130-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-128-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-129-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-131-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-132-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-134-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-135-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-136-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-137-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-133-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-165-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-139-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-140-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-141-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-142-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-144-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-143-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-145-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-146-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-147-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-148-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-149-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-151-0x0000000000590000-0x00000000005A2000-memory.dmp

          Filesize

          72KB

        • memory/2740-150-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-153-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-152-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-154-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-156-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-155-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-157-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-158-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-120-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-160-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-164-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-162-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-121-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-161-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-138-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-166-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-167-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-168-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-169-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-170-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-171-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-172-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-173-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-174-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-178-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-179-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-177-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-176-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-175-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-180-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-181-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-182-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-196-0x0000000005820000-0x000000000590A000-memory.dmp

          Filesize

          936KB

        • memory/2740-197-0x0000000005A30000-0x0000000005AC2000-memory.dmp

          Filesize

          584KB

        • memory/2740-198-0x0000000005B00000-0x0000000005B22000-memory.dmp

          Filesize

          136KB

        • memory/2740-200-0x0000000005E70000-0x00000000061C0000-memory.dmp

          Filesize

          3.3MB

        • memory/2740-117-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-118-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/2740-119-0x0000000077460000-0x00000000775EE000-memory.dmp

          Filesize

          1.6MB

        • memory/3992-431-0x00000000052E0000-0x000000000531E000-memory.dmp

          Filesize

          248KB

        • memory/3992-433-0x0000000005460000-0x00000000054AB000-memory.dmp

          Filesize

          300KB

        • memory/3992-427-0x0000000005350000-0x000000000545A000-memory.dmp

          Filesize

          1.0MB

        • memory/3992-429-0x0000000005280000-0x0000000005292000-memory.dmp

          Filesize

          72KB

        • memory/3992-426-0x00000000057F0000-0x0000000005DF6000-memory.dmp

          Filesize

          6.0MB

        • memory/3992-375-0x0000000000400000-0x0000000000428000-memory.dmp

          Filesize

          160KB

        • memory/4156-272-0x0000000008100000-0x0000000008166000-memory.dmp

          Filesize

          408KB

        • memory/4156-273-0x0000000008350000-0x00000000083B6000-memory.dmp

          Filesize

          408KB

        • memory/4156-248-0x00000000052C0000-0x00000000052F6000-memory.dmp

          Filesize

          216KB

        • memory/4156-253-0x0000000007AD0000-0x00000000080F8000-memory.dmp

          Filesize

          6.2MB

        • memory/4156-277-0x0000000008790000-0x00000000087DB000-memory.dmp

          Filesize

          300KB

        • memory/4156-276-0x0000000007AB0000-0x0000000007ACC000-memory.dmp

          Filesize

          112KB

        • memory/4156-281-0x0000000008A60000-0x0000000008AD6000-memory.dmp

          Filesize

          472KB

        • memory/4156-292-0x000000000A280000-0x000000000A8F8000-memory.dmp

          Filesize

          6.5MB

        • memory/4156-293-0x0000000009830000-0x000000000984A000-memory.dmp

          Filesize

          104KB