Analysis
-
max time kernel
131s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
29-11-2022 18:36
Static task
static1
Behavioral task
behavioral1
Sample
driver.exe
Resource
win10-20220812-en
General
-
Target
driver.exe
-
Size
2.5MB
-
MD5
3a3fa6e19b606f700fa5a0d238de8915
-
SHA1
6211694e6cd50584f368b87f7c69bf2eda502c90
-
SHA256
1fc42b8450c8ffb2c4189e3064cd08edf0ff3259e9ccbb635dde6ae0782eae1a
-
SHA512
83c2c913f5147341c5334b05b207715e648b9778f1cd1a7af6888f714e7fe04585ba21cd9440a7a3e8c280c99acc8f8a397a400897ebae0fb0ecb60320eaf48b
-
SSDEEP
24576:KxTo3fi6zSaHcsFV03AQgs5ehYWTnxoQ/D2+mpS/5sqR91ldaHQqenA4jBmkg1gU:IT22ZePnxogDP/5fF7aHGg0j0
Malware Config
Extracted
redline
45.15.157.131:36457
-
auth_value
c3342eec6a24dd88f1e2d37af96605d8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3312-128-0x0000000000620000-0x0000000000648000-memory.dmp family_redline behavioral1/memory/3312-133-0x000000000064281E-mapping.dmp family_redline -
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Drops desktop.ini file(s) 1 IoCs
Processes:
bcastdvr.exedescription ioc process File opened for modification C:\Users\Admin\Videos\Captures\desktop.ini bcastdvr.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
driver.exedescription pid process target process PID 4496 set thread context of 3312 4496 driver.exe vbc.exe -
Drops file in Windows directory 2 IoCs
Processes:
taskmgr.exedescription ioc process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
taskmgr.exevbc.exepid process 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3312 vbc.exe 3360 taskmgr.exe 3360 taskmgr.exe 3312 vbc.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
taskmgr.exevbc.exedescription pid process Token: SeDebugPrivilege 3360 taskmgr.exe Token: SeSystemProfilePrivilege 3360 taskmgr.exe Token: SeCreateGlobalPrivilege 3360 taskmgr.exe Token: SeDebugPrivilege 3312 vbc.exe Token: 33 3360 taskmgr.exe Token: SeIncBasePriorityPrivilege 3360 taskmgr.exe -
Suspicious use of FindShellTrayWindow 38 IoCs
Processes:
taskmgr.exepid process 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe -
Suspicious use of SendNotifyMessage 38 IoCs
Processes:
taskmgr.exepid process 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe 3360 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
Processes:
driver.exedescription pid process target process PID 4496 wrote to memory of 3312 4496 driver.exe vbc.exe PID 4496 wrote to memory of 3312 4496 driver.exe vbc.exe PID 4496 wrote to memory of 3312 4496 driver.exe vbc.exe PID 4496 wrote to memory of 3312 4496 driver.exe vbc.exe PID 4496 wrote to memory of 3312 4496 driver.exe vbc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\driver.exe"C:\Users\Admin\AppData\Local\Temp\driver.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\vbc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\GamePanel.exe"C:\Windows\System32\GamePanel.exe" 000000000002021C /startuptips1⤵
-
C:\Windows\System32\bcastdvr.exe"C:\Windows\System32\bcastdvr.exe" -ServerName:Windows.Media.Capture.Internal.BroadcastDVRServer1⤵
- Drops desktop.ini file(s)
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3312-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-187-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-135-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-128-0x0000000000620000-0x0000000000648000-memory.dmpFilesize
160KB
-
memory/3312-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-322-0x000000000A840000-0x000000000A890000-memory.dmpFilesize
320KB
-
memory/3312-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-140-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-141-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-155-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-156-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-321-0x000000000A7C0000-0x000000000A836000-memory.dmpFilesize
472KB
-
memory/3312-229-0x000000000ACF0000-0x000000000B21C000-memory.dmpFilesize
5.2MB
-
memory/3312-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-179-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-182-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-183-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-184-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-185-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-186-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/3312-133-0x000000000064281E-mapping.dmp
-
memory/3312-189-0x0000000009310000-0x0000000009916000-memory.dmpFilesize
6.0MB
-
memory/3312-190-0x0000000008E20000-0x0000000008F2A000-memory.dmpFilesize
1.0MB
-
memory/3312-192-0x0000000008D50000-0x0000000008D62000-memory.dmpFilesize
72KB
-
memory/3312-194-0x0000000008F30000-0x0000000008F6E000-memory.dmpFilesize
248KB
-
memory/3312-196-0x0000000008D70000-0x0000000008DBB000-memory.dmpFilesize
300KB
-
memory/3312-206-0x0000000009E20000-0x000000000A31E000-memory.dmpFilesize
5.0MB
-
memory/3312-210-0x00000000090E0000-0x0000000009146000-memory.dmpFilesize
408KB
-
memory/3312-218-0x0000000009CC0000-0x0000000009D52000-memory.dmpFilesize
584KB
-
memory/3312-228-0x000000000A5F0000-0x000000000A7B2000-memory.dmpFilesize
1.8MB
-
memory/4496-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/4496-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB