Analysis
-
max time kernel
57s -
max time network
60s -
platform
windows10-1703_x64 -
resource
win10-20230621-en -
resource tags
arch:x64arch:x86image:win10-20230621-enlocale:en-usos:windows10-1703-x64system -
submitted
29-06-2023 01:39
Static task
static1
Behavioral task
behavioral1
Sample
Setup_x32_x64.exe
Resource
win10-20230621-en
windows10-1703-x64
11 signatures
150 seconds
General
-
Target
Setup_x32_x64.exe
-
Size
748KB
-
MD5
830b68cd5d7602365e22f4276a59c300
-
SHA1
e96ae5ba5ddc5bb4f0621f273305a154f1cac6c7
-
SHA256
886542b9dbb9d5981313562a2f1a0048fa4e590d762c9714a81675d1c53f332d
-
SHA512
4afbd5fab0d401177510c95691f5efb87fa8be534aae764ba81518b08f754b8245327765dc13450adbcb042c84d8bbe692411d8909792bf5415f32e6616c29a2
-
SSDEEP
12288:DzaXu1iuIHnVNk7/utyfOCLbnd745u4KUVwVyU4xqodHxiRqwRoOP4ixGZbNCONS:DG+iuaVN2mtyfHvnUWVKdEfoMNixC4if
Malware Config
Extracted
Family
redline
Botnet
@CocacolaN
C2
185.106.93.193:48563
Attributes
-
auth_value
62e77e7581a6d46f06f11ff370e3e0d6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\rescache\_merged\4183903823\810424605.pri taskmgr.exe File created C:\Windows\rescache\_merged\1601268389\3877292338.pri taskmgr.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2920667096-3376612704-1562175574-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1020 Setup_x32_x64.exe 1020 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 1020 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 1020 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 1488 Setup_x32_x64.exe 1488 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 1488 Setup_x32_x64.exe 1488 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4132 Setup_x32_x64.exe 4132 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 4132 Setup_x32_x64.exe 4532 taskmgr.exe 4132 Setup_x32_x64.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
description pid Process Token: SeDebugPrivilege 4532 taskmgr.exe Token: SeSystemProfilePrivilege 4532 taskmgr.exe Token: SeCreateGlobalPrivilege 4532 taskmgr.exe Token: SeDebugPrivilege 1020 Setup_x32_x64.exe Token: SeDebugPrivilege 1488 Setup_x32_x64.exe Token: SeDebugPrivilege 4132 Setup_x32_x64.exe -
Suspicious use of FindShellTrayWindow 62 IoCs
pid Process 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe -
Suspicious use of SendNotifyMessage 62 IoCs
pid Process 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe 4532 taskmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Drops file in Windows directory
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4532
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:2924
-
C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1488
-
C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"C:\Users\Admin\AppData\Local\Temp\Setup_x32_x64.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4132