Analysis
-
max time kernel
42s -
max time network
44s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
05-04-2023 12:48
Static task
static1
Behavioral task
behavioral1
Sample
LauncherSU.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
LauncherSU.exe
Resource
win10v2004-20230220-en
General
-
Target
LauncherSU.exe
-
Size
4.6MB
-
MD5
1ae71d2a00c2781136f0d041617131ad
-
SHA1
ac45f06da190a8fbf7e5f4e9f7d9afdd941e7df6
-
SHA256
7b483b575f88d063ec7d84405be25d5d29579133e9951e5f7b5e2b0d9632472f
-
SHA512
597ddab8dafc57121ac7b24f4517ae6c2bed20ff4563acfedb0c5f074188f1cae289d1a31a4b76ebd6ce14eeba5d309de1f79a26cf15e08eb93469989c640d91
-
SSDEEP
98304:P2fwb4rsly4guky5c4l0SsNL8eHNLqC0w9e+Zl/As4gXdu:swEsYM5OSsgAb/AVgX4
Malware Config
Extracted
redline
@OxPhOenix
77.220.212.176:35752
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2360-142-0x0000000000CA0000-0x0000000001022000-memory.dmp family_redline behavioral2/memory/2360-143-0x0000000000CA0000-0x0000000001022000-memory.dmp family_redline -
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2360-142-0x0000000000CA0000-0x0000000001022000-memory.dmp family_sectoprat behavioral2/memory/2360-143-0x0000000000CA0000-0x0000000001022000-memory.dmp family_sectoprat -
Executes dropped EXE 2 IoCs
Processes:
Updater.exeBBvVfoqwceAQmZX.exepid process 2360 Updater.exe 1860 BBvVfoqwceAQmZX.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
Updater.exepid process 2360 Updater.exe 2360 Updater.exe 2360 Updater.exe 2360 Updater.exe 2360 Updater.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3200 1860 WerFault.exe BBvVfoqwceAQmZX.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 25 IoCs
Processes:
taskmgr.exepid process 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
Updater.exetaskmgr.exedescription pid process Token: SeDebugPrivilege 2360 Updater.exe Token: SeDebugPrivilege 1964 taskmgr.exe Token: SeSystemProfilePrivilege 1964 taskmgr.exe Token: SeCreateGlobalPrivilege 1964 taskmgr.exe Token: 33 1964 taskmgr.exe Token: SeIncBasePriorityPrivilege 1964 taskmgr.exe -
Suspicious use of FindShellTrayWindow 51 IoCs
Processes:
taskmgr.exepid process 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe -
Suspicious use of SendNotifyMessage 50 IoCs
Processes:
taskmgr.exepid process 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe 1964 taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
Updater.exepid process 2360 Updater.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
LauncherSU.exedescription pid process target process PID 1816 wrote to memory of 2360 1816 LauncherSU.exe Updater.exe PID 1816 wrote to memory of 2360 1816 LauncherSU.exe Updater.exe PID 1816 wrote to memory of 2360 1816 LauncherSU.exe Updater.exe PID 1816 wrote to memory of 1860 1816 LauncherSU.exe BBvVfoqwceAQmZX.exe PID 1816 wrote to memory of 1860 1816 LauncherSU.exe BBvVfoqwceAQmZX.exe PID 1816 wrote to memory of 1860 1816 LauncherSU.exe BBvVfoqwceAQmZX.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\LauncherSU.exe"C:\Users\Admin\AppData\Local\Temp\LauncherSU.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeC:\Users\Admin\AppData\Local\Temp\Updater.exe2⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Roaming\BBvVfoqwceAQmZX.exeC:\Users\Admin\AppData\Roaming\BBvVfoqwceAQmZX.exe2⤵
- Executes dropped EXE
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1860 -s 6683⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 1860 -ip 18601⤵
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
1.1MB
MD573fb2d35e584c5b2a0bcee38de623547
SHA100112f9d61a13fbb6e2b5c74c3a7abcb09ff6b59
SHA256ceada29a20a20983b6589bfbf4ff321f0bb3bbf692bdf90eab1ad441cc50eaff
SHA512c3e956388816b6caa10f683d7973a0f6c1153c7abf005606d0b8381d85ea2a0beae0835ddd56524b52d54c9ab7b65d615a88100af6c4325ac88cfd66bad6f127
-
C:\Users\Admin\AppData\Local\Temp\Updater.exeFilesize
1.1MB
MD573fb2d35e584c5b2a0bcee38de623547
SHA100112f9d61a13fbb6e2b5c74c3a7abcb09ff6b59
SHA256ceada29a20a20983b6589bfbf4ff321f0bb3bbf692bdf90eab1ad441cc50eaff
SHA512c3e956388816b6caa10f683d7973a0f6c1153c7abf005606d0b8381d85ea2a0beae0835ddd56524b52d54c9ab7b65d615a88100af6c4325ac88cfd66bad6f127
-
C:\Users\Admin\AppData\Roaming\BBvVfoqwceAQmZX.exeFilesize
4.0MB
MD53b6317716a734b3fe08f868cd3382066
SHA1b8967872a389177ce632141599cda9ffbf9b0d4f
SHA256f5110fa71bdc19dff7f8335efe2dc948dcfd8a066e9acd80d438f6677ae956ba
SHA512f5ed6733b6848299a03631b64f98196667dd436b08ff4b3bde0c6f011d11cfbb34c0f3228ebeb3438a7c334fc331c9030c68597a9d21def453cb5198570924cb
-
C:\Users\Admin\AppData\Roaming\BBvVfoqwceAQmZX.exeFilesize
4.0MB
MD53b6317716a734b3fe08f868cd3382066
SHA1b8967872a389177ce632141599cda9ffbf9b0d4f
SHA256f5110fa71bdc19dff7f8335efe2dc948dcfd8a066e9acd80d438f6677ae956ba
SHA512f5ed6733b6848299a03631b64f98196667dd436b08ff4b3bde0c6f011d11cfbb34c0f3228ebeb3438a7c334fc331c9030c68597a9d21def453cb5198570924cb
-
memory/1860-145-0x0000000000400000-0x0000000000B75000-memory.dmpFilesize
7.5MB
-
memory/1860-148-0x0000000076D10000-0x0000000076F25000-memory.dmpFilesize
2.1MB
-
memory/1860-2088-0x0000000000400000-0x0000000000B75000-memory.dmpFilesize
7.5MB
-
memory/1964-2103-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2104-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2102-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2093-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2099-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2101-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2100-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2098-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2094-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/1964-2092-0x0000016283290000-0x0000016283291000-memory.dmpFilesize
4KB
-
memory/2360-143-0x0000000000CA0000-0x0000000001022000-memory.dmpFilesize
3.5MB
-
memory/2360-2091-0x0000000006080000-0x0000000006090000-memory.dmpFilesize
64KB
-
memory/2360-2090-0x0000000000CA0000-0x0000000001022000-memory.dmpFilesize
3.5MB
-
memory/2360-230-0x00000000061A0000-0x00000000062AA000-memory.dmpFilesize
1.0MB
-
memory/2360-172-0x0000000006080000-0x0000000006090000-memory.dmpFilesize
64KB
-
memory/2360-147-0x0000000005EE0000-0x0000000005F1C000-memory.dmpFilesize
240KB
-
memory/2360-146-0x0000000005E80000-0x0000000005E92000-memory.dmpFilesize
72KB
-
memory/2360-144-0x0000000006480000-0x0000000006A98000-memory.dmpFilesize
6.1MB
-
memory/2360-142-0x0000000000CA0000-0x0000000001022000-memory.dmpFilesize
3.5MB
-
memory/2360-139-0x0000000000CA0000-0x0000000001022000-memory.dmpFilesize
3.5MB