Analysis
- max time kernel
144s - max time network
295s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
06/12/2022, 04:50
General
- Target e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe
- Size 7.1MB
- Sample221206-fgscbshe38
- SHA256 e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b
Malware Config
Extracted
-
systembc
-
89.22.236.225:4193
-
176.124.205.5:4193
Extracted
-
vidar
-
56.1
-
1569
-
https://t.me/dishasta
-
https://steamcommunity.com/profiles/76561199441933804
-
profile_id
1569
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Suspicious use of NtCreateUserProcessOtherParentProcess 2 IoCs
- SystemBC
SystemBC is a proxy and remote administration tool first seen in 2019.
- Vidar
Vidar is an infostealer based on Arkei stealer.
- .NET Reactor proctector 1 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 3 IoCs
- Accesses 2FA software files, possible credential harvesting 2 TTPs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Delays execution with timeout.exe 1 IoCs
- Runs ping.exe 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 31 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 37 IoCs
Processes
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\SYSWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SYSWOW64\fontview.exe"C:\Windows\SYSWOW64\fontview.exe"2⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 6 & del /f /q "C:\Windows\SysWOW64\fontview.exe" & exit3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout /t 64⤵
- Delays execution with timeout.exe
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe"C:\Users\Admin\AppData\Local\Temp\e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /tn COMSurrogate /f /sc onlogon /rl highest /tr "C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe"C:\Users\Admin\Bel migomota yexiquiv tisax-newanax fab cegom\Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"3⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngentask.exe"3⤵
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c chcp 65001 && ping 127.0.0.1 && DEL /F /S /Q /A "C:\Users\Admin\AppData\Local\Temp\e27ac6756cbebfb6679f7f6b8428aa24efca10a089aaf582f14b3b07ef1d044b.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\chcp.comchcp 650013⤵
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.13⤵
- Runs ping.exe
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe
Bovawata quaj kokeley gacebe meda loy bogodime vexevi.exe
mozglue.dll
nss3.dll
advapi32.dll
memory/1912-432-0x00000000072E0000-0x00000000078E6000-memory.dmp
memory/1912-628-0x0000000007C40000-0x0000000007CD2000-memory.dmp
memory/1912-639-0x0000000008CE0000-0x000000000920C000-memory.dmp
memory/1912-617-0x0000000007F10000-0x000000000840E000-memory.dmp
memory/1912-620-0x0000000007AE0000-0x0000000007B46000-memory.dmp
memory/1912-638-0x00000000085E0000-0x00000000087A2000-memory.dmp
memory/1912-410-0x0000000000870000-0x0000000000894000-memory.dmp
memory/1912-441-0x0000000006D50000-0x0000000006D9B000-memory.dmp
memory/1912-438-0x0000000006D10000-0x0000000006D4E000-memory.dmp
memory/1912-436-0x0000000006C70000-0x0000000006C82000-memory.dmp
memory/1912-434-0x0000000006DE0000-0x0000000006EEA000-memory.dmp
memory/1912-421-0x0000000006B00000-0x0000000006B56000-memory.dmp
memory/2220-568-0x0000000000880000-0x00000000008E0000-memory.dmp
memory/2220-519-0x0000000000880000-0x00000000008E0000-memory.dmp
memory/3500-183-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/3500-185-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/3500-186-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/3500-184-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4168-243-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4168-256-0x0000000002B70000-0x0000000002C70000-memory.dmp
memory/4168-300-0x000000000FA50000-0x000000000FAD0000-memory.dmp
memory/4168-351-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4168-360-0x0000000002B70000-0x0000000002C70000-memory.dmp
memory/4168-451-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4168-393-0x000000000FA50000-0x000000000FAD0000-memory.dmp
memory/4420-361-0x0000000000400000-0x0000000000407000-memory.dmp
memory/4528-146-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-231-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4528-161-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-163-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-162-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-164-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-165-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-166-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-167-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-169-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-170-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-168-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-171-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-172-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-173-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-174-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-175-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-176-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-177-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-178-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-179-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-181-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-159-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-158-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-157-0x0000000002D60000-0x0000000002E58000-memory.dmp
memory/4528-147-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-156-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-180-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-197-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4528-198-0x0000000002D60000-0x0000000002E58000-memory.dmp
memory/4528-151-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-153-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-155-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-121-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-160-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-154-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-152-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-150-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-149-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-148-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-120-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-145-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4528-144-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-143-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-142-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-141-0x0000000000400000-0x0000000000D33000-memory.dmp
memory/4528-140-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-139-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-138-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-135-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-137-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-136-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-134-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-133-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-132-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-131-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-130-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-129-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-128-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-127-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-126-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-125-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-124-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-123-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4528-122-0x0000000077530000-0x00000000776BE000-memory.dmp