Analysis
-
max time kernel
151s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
10-12-2022 07:45
Behavioral task
behavioral1
Sample
SoftwareSetupFile.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
SoftwareSetupFile.exe
Resource
win10v2004-20220901-en
General
-
Target
SoftwareSetupFile.exe
-
Size
700.0MB
-
MD5
49f4a57a1ad2255b9474257e34f1f204
-
SHA1
e6b336ba67764b9837c035bce8366638ea542b77
-
SHA256
f1486af3d0f89ddc4482a900740fe5716bf9b99021b77e9e41ea70f106d6f63c
-
SHA512
4e56dace8194752a557faa27b4a7c9ba273cbea6b8b1806d1a0b96376b34a3170b313a1f44ead6dbb528eb640e99b8b568e35ebbf058bba632926496ca5433c4
-
SSDEEP
196608:MpwRaY3FAaKEY2zyJ93w5DckiRi66MUZuBgVneTvcwH+pv5hxDtVQKwnl2/2hwn3:r
Malware Config
Extracted
redline
slabo krutish 2
78.47.191.142:63772
-
auth_value
f65ad1dc3b50bd274e38a201f0121669
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/2216-132-0x0000000000A40000-0x0000000000B6C000-memory.dmp agile_net -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 7 IoCs
Processes:
SoftwareSetupFile.exepid process 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
SoftwareSetupFile.exedescription pid process target process PID 2216 set thread context of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
SoftwareSetupFile.exepid process 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe 2216 SoftwareSetupFile.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
SoftwareSetupFile.exeaspnet_compiler.exedescription pid process Token: SeDebugPrivilege 2216 SoftwareSetupFile.exe Token: SeDebugPrivilege 4584 aspnet_compiler.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
SoftwareSetupFile.exedescription pid process target process PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe PID 2216 wrote to memory of 4584 2216 SoftwareSetupFile.exe aspnet_compiler.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\SoftwareSetupFile.exe"C:\Users\Admin\AppData\Local\Temp\SoftwareSetupFile.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET/Framework/v4.0.30319/aspnet_compiler.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2216-132-0x0000000000A40000-0x0000000000B6C000-memory.dmpFilesize
1.2MB
-
memory/2216-133-0x0000000005500000-0x0000000005592000-memory.dmpFilesize
584KB
-
memory/4584-134-0x0000000000000000-mapping.dmp
-
memory/4584-135-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB
-
memory/4584-136-0x0000000005A30000-0x0000000006048000-memory.dmpFilesize
6.1MB
-
memory/4584-137-0x0000000005530000-0x000000000563A000-memory.dmpFilesize
1.0MB
-
memory/4584-138-0x0000000005460000-0x0000000005472000-memory.dmpFilesize
72KB
-
memory/4584-139-0x0000000005640000-0x000000000567C000-memory.dmpFilesize
240KB
-
memory/4584-140-0x0000000006600000-0x0000000006BA4000-memory.dmpFilesize
5.6MB
-
memory/4584-141-0x0000000005980000-0x00000000059E6000-memory.dmpFilesize
408KB
-
memory/4584-142-0x0000000006D80000-0x0000000006F42000-memory.dmpFilesize
1.8MB
-
memory/4584-143-0x0000000007480000-0x00000000079AC000-memory.dmpFilesize
5.2MB