Analysis
-
max time kernel
49s -
max time network
60s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-es -
resource tags
arch:x64arch:x86image:win10v2004-20230220-eslocale:es-esos:windows10-2004-x64systemwindows -
submitted
12-03-2023 11:45
Static task
static1
Behavioral task
behavioral1
Sample
INSTALLER.exe
Resource
win10v2004-20230220-es
windows10-2004-x64
11 signatures
30 seconds
General
-
Target
INSTALLER.exe
-
Size
479.4MB
-
MD5
43419f7e188f034a4f89b113870581a0
-
SHA1
ca1762910a1169145ad49221ebf76b64e0db44b4
-
SHA256
2175df96480d4b2c408d0e5a01533f970ef6b46c5d66762e960e3d1d02498179
-
SHA512
d99e0cab1455b7b487d2a1657bff93c5caad0135f43421ed5124177525b8093883c7869b43106b14535bcb67fcdfef11026b494ccf78a90c2acf33c9e7c2f3a1
-
SSDEEP
49152:9YyZTz3ZgzgaZyqU1B2uFSBhopuQJcnomyGoFo20AtObf2ECPTMGNRZCq7vOz61D:dpqvU/2HfDacnoFVO4TMGvsqKE4lP99e
Score
10/10
Malware Config
Extracted
Family
redline
C2
82.115.223.140:31656
Attributes
-
auth_value
6a82f1fb90afb278c299e83d46279927
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Uses the VBS compiler for execution 1 TTPs
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3672 set thread context of 1672 3672 INSTALLER.exe 101 -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 3672 INSTALLER.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 1672 AddInProcess32.exe 1672 AddInProcess32.exe 1672 AddInProcess32.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3672 INSTALLER.exe Token: SeDebugPrivilege 4308 taskmgr.exe Token: SeSystemProfilePrivilege 4308 taskmgr.exe Token: SeCreateGlobalPrivilege 4308 taskmgr.exe Token: SeDebugPrivilege 1672 AddInProcess32.exe Token: 33 4308 taskmgr.exe Token: SeIncBasePriorityPrivilege 4308 taskmgr.exe -
Suspicious use of FindShellTrayWindow 50 IoCs
pid Process 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
pid Process 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe 4308 taskmgr.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 3672 wrote to memory of 2132 3672 INSTALLER.exe 91 PID 3672 wrote to memory of 2132 3672 INSTALLER.exe 91 PID 3672 wrote to memory of 5076 3672 INSTALLER.exe 92 PID 3672 wrote to memory of 5076 3672 INSTALLER.exe 92 PID 3672 wrote to memory of 864 3672 INSTALLER.exe 93 PID 3672 wrote to memory of 864 3672 INSTALLER.exe 93 PID 3672 wrote to memory of 1020 3672 INSTALLER.exe 94 PID 3672 wrote to memory of 1020 3672 INSTALLER.exe 94 PID 3672 wrote to memory of 2608 3672 INSTALLER.exe 95 PID 3672 wrote to memory of 2608 3672 INSTALLER.exe 95 PID 3672 wrote to memory of 4104 3672 INSTALLER.exe 96 PID 3672 wrote to memory of 4104 3672 INSTALLER.exe 96 PID 3672 wrote to memory of 5040 3672 INSTALLER.exe 97 PID 3672 wrote to memory of 5040 3672 INSTALLER.exe 97 PID 3672 wrote to memory of 4052 3672 INSTALLER.exe 100 PID 3672 wrote to memory of 4052 3672 INSTALLER.exe 100 PID 3672 wrote to memory of 4164 3672 INSTALLER.exe 99 PID 3672 wrote to memory of 4164 3672 INSTALLER.exe 99 PID 3672 wrote to memory of 4432 3672 INSTALLER.exe 98 PID 3672 wrote to memory of 4432 3672 INSTALLER.exe 98 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101 PID 3672 wrote to memory of 1672 3672 INSTALLER.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe"C:\Users\Admin\AppData\Local\Temp\INSTALLER.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"2⤵PID:2132
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"2⤵PID:5076
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"2⤵PID:864
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"2⤵PID:1020
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"2⤵PID:2608
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"2⤵PID:4104
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"2⤵PID:5040
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"2⤵PID:4432
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"2⤵PID:4164
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"2⤵PID:4052
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1672
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4308