Analysis
-
max time kernel
268s -
max time network
302s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
08-11-2022 12:19
Static task
static1
Behavioral task
behavioral1
Sample
anon1.c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
anon1.c.exe
Resource
win10v2004-20220812-en
General
-
Target
anon1.c.exe
-
Size
6.3MB
-
MD5
ec54635cd5ecaf1b3bfeaac4ad54f360
-
SHA1
78ce05e39cd35bb9f932dadf0d2dc7bb2783cb15
-
SHA256
04d31c61d53359359e896db066a150f94321c1fd788a9ef7cb6a3e08ab963761
-
SHA512
44043cdae43b0fe3e9c8a247e568925c5c8047fa425d61bfb428cb6376f9ba1d8bfa50b362657ca73a48c015f7fb1ea6b496a00d68473f6ee92eebbc17e5e236
-
SSDEEP
98304:F0fI8YvciV+yBm0XA7HCOaYh5JTrQOdauaHaSZSxT+yq1Dc0:F0oxLA7HJaW5tbauFgSx4
Malware Config
Extracted
raccoon
94c54520400750937a6f1bf6044f8667
http://194.37.80.221/
Extracted
redline
Test1
45.15.156.48:8285
-
auth_value
3ec6815aabd0bab316e997c1c7898294
Extracted
systembc
45.15.156.48:4254
146.70.53.169:4254
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/3028-152-0x0000000000360000-0x0000000000388000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 5 IoCs
Processes:
537MXN29.exe4etPA1W6.exezLlhcrne.exe537MXN29.exesvcupdater.exepid process 4200 537MXN29.exe 4068 4etPA1W6.exe 1560 zLlhcrne.exe 448 537MXN29.exe 2528 svcupdater.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
anon1.c.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Control Panel\International\Geo\Nation anon1.c.exe -
Loads dropped DLL 3 IoCs
Processes:
anon1.c.exepid process 1532 anon1.c.exe 1532 anon1.c.exe 1532 anon1.c.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
zLlhcrne.exedescription pid process target process PID 1560 set thread context of 3028 1560 zLlhcrne.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
537MXN29.exedescription ioc process File created C:\Windows\Tasks\wow64.job 537MXN29.exe File opened for modification C:\Windows\Tasks\wow64.job 537MXN29.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2308 4200 WerFault.exe 537MXN29.exe -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
GoLang User-Agent 3 IoCs
Uses default user-agent string defined by GoLang HTTP packages.
Processes:
description flow ioc HTTP User-Agent header 43 Go-http-client/1.1 HTTP User-Agent header 44 Go-http-client/1.1 HTTP User-Agent header 49 Go-http-client/1.1 -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
anon1.c.exevbc.exepid process 1532 anon1.c.exe 1532 anon1.c.exe 3028 vbc.exe 3028 vbc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
vbc.exedescription pid process Token: SeDebugPrivilege 3028 vbc.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
anon1.c.exe4etPA1W6.execmd.exezLlhcrne.exedescription pid process target process PID 1532 wrote to memory of 4200 1532 anon1.c.exe 537MXN29.exe PID 1532 wrote to memory of 4200 1532 anon1.c.exe 537MXN29.exe PID 1532 wrote to memory of 4200 1532 anon1.c.exe 537MXN29.exe PID 1532 wrote to memory of 4068 1532 anon1.c.exe 4etPA1W6.exe PID 1532 wrote to memory of 4068 1532 anon1.c.exe 4etPA1W6.exe PID 4068 wrote to memory of 1220 4068 4etPA1W6.exe cmd.exe PID 4068 wrote to memory of 1220 4068 4etPA1W6.exe cmd.exe PID 1220 wrote to memory of 2444 1220 cmd.exe schtasks.exe PID 1220 wrote to memory of 2444 1220 cmd.exe schtasks.exe PID 1532 wrote to memory of 1560 1532 anon1.c.exe zLlhcrne.exe PID 1532 wrote to memory of 1560 1532 anon1.c.exe zLlhcrne.exe PID 1532 wrote to memory of 1560 1532 anon1.c.exe zLlhcrne.exe PID 1560 wrote to memory of 3028 1560 zLlhcrne.exe vbc.exe PID 1560 wrote to memory of 3028 1560 zLlhcrne.exe vbc.exe PID 1560 wrote to memory of 3028 1560 zLlhcrne.exe vbc.exe PID 1560 wrote to memory of 3028 1560 zLlhcrne.exe vbc.exe PID 1560 wrote to memory of 3028 1560 zLlhcrne.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\anon1.c.exe"C:\Users\Admin\AppData\Local\Temp\anon1.c.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\537MXN29.exe"C:\Users\Admin\AppData\Roaming\537MXN29.exe"2⤵
- Executes dropped EXE
- Drops file in Windows directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4200 -s 7563⤵
- Program crash
-
C:\Users\Admin\AppData\Roaming\4etPA1W6.exe"C:\Users\Admin\AppData\Roaming\4etPA1W6.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd.exe /C schtasks /create /tn tfmMOxFVCU /tr C:\Users\Admin\AppData\Roaming\tfmMOxFVCU\svcupdater.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\schtasks.exeschtasks /create /tn tfmMOxFVCU /tr C:\Users\Admin\AppData\Roaming\tfmMOxFVCU\svcupdater.exe /st 00:00 /du 9999:59 /sc once /ri 1 /f4⤵
- Creates scheduled task(s)
-
C:\Users\Admin\AppData\Roaming\zLlhcrne.exe"C:\Users\Admin\AppData\Roaming\zLlhcrne.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Roaming\537MXN29.exeC:\Users\Admin\AppData\Roaming\537MXN29.exe start1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Roaming\tfmMOxFVCU\svcupdater.exeC:\Users\Admin\AppData\Roaming\tfmMOxFVCU\svcupdater.exe1⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 4200 -ip 42001⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\mozglue.dllFilesize
612KB
MD5f07d9977430e762b563eaadc2b94bbfa
SHA1da0a05b2b8d269fb73558dfcf0ed5c167f6d3877
SHA2564191faf7e5eb105a0f4c5c6ed3e9e9c71014e8aa39bbee313bc92d1411e9e862
SHA5126afd512e4099643bba3fc7700dd72744156b78b7bda10263ba1f8571d1e282133a433215a9222a7799f9824f244a2bc80c2816a62de1497017a4b26d562b7eaf
-
C:\Users\Admin\AppData\LocalLow\nss3.dllFilesize
1.9MB
MD5f67d08e8c02574cbc2f1122c53bfb976
SHA16522992957e7e4d074947cad63189f308a80fcf2
SHA256c65b7afb05ee2b2687e6280594019068c3d3829182dfe8604ce4adf2116cc46e
SHA5122e9d0a211d2b085514f181852fae6e7ca6aed4d29f396348bedb59c556e39621810a9a74671566a49e126ec73a60d0f781fa9085eb407df1eefd942c18853be5
-
C:\Users\Admin\AppData\LocalLow\sqlite3.dllFilesize
1.0MB
MD5dbf4f8dcefb8056dc6bae4b67ff810ce
SHA1bbac1dd8a07c6069415c04b62747d794736d0689
SHA25647b64311719000fa8c432165a0fdcdfed735d5b54977b052de915b1cbbbf9d68
SHA512b572ca2f2e4a5cc93e4fcc7a18c0ae6df888aa4c55bc7da591e316927a4b5cfcbdda6e60018950be891ff3b26f470cc5cce34d217c2d35074322ab84c32a25d1
-
C:\Users\Admin\AppData\Roaming\4etPA1W6.exeFilesize
4.8MB
MD527d2a70c1f2a5a6cdb5b5e87e976014d
SHA19b68a92a1e305f44ad040cc7ab5f4eb63ea58907
SHA256d062bf90cc1a1fb3b510a8aca6bc05bdf475e6a98c7a1b83fc13558ed70f134a
SHA512c1af2cbef681159e451cc5ce7ba3940b49726efb2aa49a10aa2a3ab5d14264ead7bedc93a2225cad5868438fea05f369c4b41466641568f34c324144aafca4f5
-
C:\Users\Admin\AppData\Roaming\4etPA1W6.exeFilesize
4.8MB
MD527d2a70c1f2a5a6cdb5b5e87e976014d
SHA19b68a92a1e305f44ad040cc7ab5f4eb63ea58907
SHA256d062bf90cc1a1fb3b510a8aca6bc05bdf475e6a98c7a1b83fc13558ed70f134a
SHA512c1af2cbef681159e451cc5ce7ba3940b49726efb2aa49a10aa2a3ab5d14264ead7bedc93a2225cad5868438fea05f369c4b41466641568f34c324144aafca4f5
-
C:\Users\Admin\AppData\Roaming\537MXN29.exeFilesize
322KB
MD58850b7c96abf365df3fd542cb17755c5
SHA190e77265727ab091e9ee48e82df170b8929998b4
SHA256cf93000b1ae58e02666a9c6e29002bdddd0d8c7e03a1a14ae1f3a1b8f62b14c5
SHA512d9645e871ba53be9617fb591cbd2dd7cb1c67b5a6ac4a4c2872e48a114808d55ec98fdfbdeee38fb1aad72138b690ccca8fcf03143f24b7054d6581cd8b5f933
-
C:\Users\Admin\AppData\Roaming\537MXN29.exeFilesize
322KB
MD58850b7c96abf365df3fd542cb17755c5
SHA190e77265727ab091e9ee48e82df170b8929998b4
SHA256cf93000b1ae58e02666a9c6e29002bdddd0d8c7e03a1a14ae1f3a1b8f62b14c5
SHA512d9645e871ba53be9617fb591cbd2dd7cb1c67b5a6ac4a4c2872e48a114808d55ec98fdfbdeee38fb1aad72138b690ccca8fcf03143f24b7054d6581cd8b5f933
-
C:\Users\Admin\AppData\Roaming\537MXN29.exeFilesize
322KB
MD58850b7c96abf365df3fd542cb17755c5
SHA190e77265727ab091e9ee48e82df170b8929998b4
SHA256cf93000b1ae58e02666a9c6e29002bdddd0d8c7e03a1a14ae1f3a1b8f62b14c5
SHA512d9645e871ba53be9617fb591cbd2dd7cb1c67b5a6ac4a4c2872e48a114808d55ec98fdfbdeee38fb1aad72138b690ccca8fcf03143f24b7054d6581cd8b5f933
-
C:\Users\Admin\AppData\Roaming\tfmMOxFVCU\svcupdater.exeFilesize
4.8MB
MD527d2a70c1f2a5a6cdb5b5e87e976014d
SHA19b68a92a1e305f44ad040cc7ab5f4eb63ea58907
SHA256d062bf90cc1a1fb3b510a8aca6bc05bdf475e6a98c7a1b83fc13558ed70f134a
SHA512c1af2cbef681159e451cc5ce7ba3940b49726efb2aa49a10aa2a3ab5d14264ead7bedc93a2225cad5868438fea05f369c4b41466641568f34c324144aafca4f5
-
C:\Users\Admin\AppData\Roaming\tfmMOxFVCU\svcupdater.exeFilesize
4.8MB
MD527d2a70c1f2a5a6cdb5b5e87e976014d
SHA19b68a92a1e305f44ad040cc7ab5f4eb63ea58907
SHA256d062bf90cc1a1fb3b510a8aca6bc05bdf475e6a98c7a1b83fc13558ed70f134a
SHA512c1af2cbef681159e451cc5ce7ba3940b49726efb2aa49a10aa2a3ab5d14264ead7bedc93a2225cad5868438fea05f369c4b41466641568f34c324144aafca4f5
-
C:\Users\Admin\AppData\Roaming\zLlhcrne.exeFilesize
2.4MB
MD525b80f714520a949e5ae6b95b0585ce8
SHA19265fb3f52d272fe4a034f45b5e9b49eefd28e09
SHA256b6fb44538c3a5ac766e0b3c2a51ca7e99f295adb761ff99a3ce11a45151277ba
SHA5120b1281cc3224f8bb10e3ea9306e96ef7dee1e17b2dd0e55b21602c5410a5bb98b17a309f9318d4b250f6db2897c6552fe0027969266c884447e2ba14cb80ff98
-
C:\Users\Admin\AppData\Roaming\zLlhcrne.exeFilesize
2.4MB
MD525b80f714520a949e5ae6b95b0585ce8
SHA19265fb3f52d272fe4a034f45b5e9b49eefd28e09
SHA256b6fb44538c3a5ac766e0b3c2a51ca7e99f295adb761ff99a3ce11a45151277ba
SHA5120b1281cc3224f8bb10e3ea9306e96ef7dee1e17b2dd0e55b21602c5410a5bb98b17a309f9318d4b250f6db2897c6552fe0027969266c884447e2ba14cb80ff98
-
memory/448-167-0x0000000002F4B000-0x0000000002F61000-memory.dmpFilesize
88KB
-
memory/448-166-0x0000000000400000-0x0000000002C3E000-memory.dmpFilesize
40.2MB
-
memory/448-165-0x0000000002F4B000-0x0000000002F61000-memory.dmpFilesize
88KB
-
memory/1220-145-0x0000000000000000-mapping.dmp
-
memory/1532-138-0x0000000000400000-0x0000000000DCA000-memory.dmpFilesize
9.8MB
-
memory/1532-134-0x0000000000400000-0x0000000000DCA000-memory.dmpFilesize
9.8MB
-
memory/1532-149-0x0000000000400000-0x0000000000DCA000-memory.dmpFilesize
9.8MB
-
memory/1532-132-0x0000000000400000-0x0000000000DCA000-memory.dmpFilesize
9.8MB
-
memory/1560-147-0x0000000000000000-mapping.dmp
-
memory/2444-146-0x0000000000000000-mapping.dmp
-
memory/3028-164-0x0000000004F40000-0x0000000004F7C000-memory.dmpFilesize
240KB
-
memory/3028-151-0x0000000000000000-mapping.dmp
-
memory/3028-161-0x0000000005460000-0x0000000005A78000-memory.dmpFilesize
6.1MB
-
memory/3028-162-0x0000000004FB0000-0x00000000050BA000-memory.dmpFilesize
1.0MB
-
memory/3028-163-0x0000000004EE0000-0x0000000004EF2000-memory.dmpFilesize
72KB
-
memory/3028-172-0x0000000007D90000-0x00000000082BC000-memory.dmpFilesize
5.2MB
-
memory/3028-171-0x0000000007690000-0x0000000007852000-memory.dmpFilesize
1.8MB
-
memory/3028-170-0x0000000005A80000-0x0000000005AE6000-memory.dmpFilesize
408KB
-
memory/3028-152-0x0000000000360000-0x0000000000388000-memory.dmpFilesize
160KB
-
memory/3028-168-0x0000000006030000-0x00000000065D4000-memory.dmpFilesize
5.6MB
-
memory/3028-169-0x00000000053B0000-0x0000000005442000-memory.dmpFilesize
584KB
-
memory/4068-142-0x0000000000000000-mapping.dmp
-
memory/4200-160-0x0000000000400000-0x0000000002C3E000-memory.dmpFilesize
40.2MB
-
memory/4200-157-0x0000000002D29000-0x0000000002D3F000-memory.dmpFilesize
88KB
-
memory/4200-158-0x00000000046F0000-0x00000000046F5000-memory.dmpFilesize
20KB
-
memory/4200-139-0x0000000000000000-mapping.dmp