Overview

overview

10

Static

static

1

wyCdPrh7QF.exe

windows7-x64

10

wyCdPrh7QF.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    161s
  • max time network
    176s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    05-05-2023 11:18

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    wyCdPrh7QF.exe

  • Size

    1.0MB

  • MD5

    9f88f83efed561b5002940f8425d73bd

  • SHA1

    e211bc5df1d01ed150e5f4c727ae33c021a2011f

  • SHA256

    167645a3961ac8521e1db57b4a70c12adf03217b8f546fdd34c4fb770ccb4779

  • SHA512

    71fc4523d93f6a9f0ba48291e54528e18c969e1dd0d3d45c75ef90a64a1b9b1a12e14a5ae1a0b23e9a7b91f8576d7e4c8c252523d684e18f0cc0f95ab38bd7b6

  • SSDEEP

    24576:w0I5Wj1JZkaiSEZe1HOqJarhD85O/f6CDruxp6/XjtjWm:w0IEj1l131HOqJad85mSCDrCp6/0m

Score
10/10
redlineyoutubeevasioninfostealerpersistencetrojan

Malware Config

Extracted

Family

redline

Botnet

Youtube

C2

5.75.169.103:18374

Attributes
  • auth_value

    fa6349261c48cdab29f1787f5ed475fe

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Windows security bypass 2 TTPs 2 IoCs
    evasiontrojan
  • Looks for VirtualBox Guest Additions in registry 2 TTPs 2 IoCs
    evasion
  • Looks for VMWare Tools registry key 2 TTPs 2 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Checks BIOS information in registry 2 TTPs 4 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Checks computer location settings 2 TTPs 2 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 1 IoCs
  • Windows security modification 2 TTPs 3 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Maps connected drives based on registry 3 TTPs 4 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Delays execution with timeout.exe 1 IoCs
    evasion
  • Suspicious behavior: EnumeratesProcesses 25 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs
  • System policy modification 1 TTPs 1 IoCs
    evasion
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\wyCdPrh7QF.exe
    "C:\Users\Admin\AppData\Local\Temp\wyCdPrh7QF.exe"
    1⤵
    • Looks for VirtualBox Guest Additions in registry
    • Looks for VMWare Tools registry key
    • Checks BIOS information in registry
    • Checks computer location settings
    • Adds Run key to start application
    • Maps connected drives based on registry
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3672
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:396
      • C:\Windows\system32\schtasks.exe
        schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
        3⤵
        • Creates scheduled task(s)
        PID:1120
    • C:\Windows\system32\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpE6BB.tmp.bat""
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3988
      • C:\Windows\system32\timeout.exe
        timeout 3
        3⤵
        • Delays execution with timeout.exe
        PID:4392
      • C:\Users\Admin\AppData\Roaming\svchost.exe
        "C:\Users\Admin\AppData\Roaming\svchost.exe"
        3⤵
        • UAC bypass
        • Windows security bypass
        • Looks for VirtualBox Guest Additions in registry
        • Looks for VMWare Tools registry key
        • Sets service image path in registry
        • Checks BIOS information in registry
        • Checks computer location settings
        • Executes dropped EXE
        • Windows security modification
        • Checks whether UAC is enabled
        • Maps connected drives based on registry
        • Suspicious use of SetThreadContext
        • Suspicious behavior: LoadsDriver
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        • System policy modification
        PID:4168
        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
          "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\svchost.exe" -Force
          4⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:676
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe"
          4⤵
            PID:1388

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Scheduled Task

    1
    T1053

    Persistence

    Registry Run Keys / Startup Folder

    2
    T1060

    Scheduled Task

    1
    T1053

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Scheduled Task

    1
    T1053

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    3
    T1089

    Modify Registry

    6
    T1112

    Virtualization/Sandbox Evasion

    2
    T1497

    Credential Access

    Discovery

    Query Registry

    6
    T1012

    Virtualization/Sandbox Evasion

    2
    T1497

    System Information Discovery

    5
    T1082

    Peripheral Device Discovery

    1
    T1120

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lei4xsxu.bh4.ps1
      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

      Download Submit
    • C:\Users\Admin\AppData\Local\Temp\tmpE6BB.tmp.bat
      Filesize

      151B

      MD5

      8d8dd9e6e8d9104d4c40a64f31fdcbdf

      SHA1

      1e08454c9d4b5969044671163c9c5466e008e267

      SHA256

      b77f374516635356e12f51751f759dd825b654258e171243a2512e3156a17388

      SHA512

      5ee1f5c306435064b49ed558486796505bf2b5f063cb0a00772ce22e4df13e803fac6c198617568874f801a433cd2eaf031086d8561398010017a7996adef92f

      Download Submit
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      1.0MB

      MD5

      9f88f83efed561b5002940f8425d73bd

      SHA1

      e211bc5df1d01ed150e5f4c727ae33c021a2011f

      SHA256

      167645a3961ac8521e1db57b4a70c12adf03217b8f546fdd34c4fb770ccb4779

      SHA512

      71fc4523d93f6a9f0ba48291e54528e18c969e1dd0d3d45c75ef90a64a1b9b1a12e14a5ae1a0b23e9a7b91f8576d7e4c8c252523d684e18f0cc0f95ab38bd7b6

      Download Submit
    • C:\Users\Admin\AppData\Roaming\svchost.exe
      Filesize

      1.0MB

      MD5

      9f88f83efed561b5002940f8425d73bd

      SHA1

      e211bc5df1d01ed150e5f4c727ae33c021a2011f

      SHA256

      167645a3961ac8521e1db57b4a70c12adf03217b8f546fdd34c4fb770ccb4779

      SHA512

      71fc4523d93f6a9f0ba48291e54528e18c969e1dd0d3d45c75ef90a64a1b9b1a12e14a5ae1a0b23e9a7b91f8576d7e4c8c252523d684e18f0cc0f95ab38bd7b6

      Download Submit
    • memory/676-153-0x00000218C95D0000-0x00000218C95F2000-memory.dmp
      Filesize

      136KB

      Download
    • memory/676-158-0x00000218C94C0000-0x00000218C94D0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/676-162-0x00000218C94C0000-0x00000218C94D0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/676-159-0x00000218C94C0000-0x00000218C94D0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1388-164-0x000000000B580000-0x000000000BB98000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/1388-146-0x0000000000400000-0x0000000000430000-memory.dmp
      Filesize

      192KB

      Download
    • memory/1388-163-0x00000000053C0000-0x00000000053D0000-memory.dmp
      Filesize

      64KB

      Download
    • memory/1388-165-0x000000000D710000-0x000000000D81A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/1388-166-0x000000000D620000-0x000000000D632000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1388-167-0x000000000D680000-0x000000000D6BC000-memory.dmp
      Filesize

      240KB

      Download
    • memory/3672-134-0x000002D12BCD0000-0x000002D12BD46000-memory.dmp
      Filesize

      472KB

      Download
    • memory/3672-133-0x000002D111770000-0x000002D111874000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/3672-135-0x000002D12BEF0000-0x000002D12BF00000-memory.dmp
      Filesize

      64KB

      Download
    • memory/3672-136-0x000002D113440000-0x000002D11345E000-memory.dmp
      Filesize

      120KB

      Download