Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20230621-en -
resource tags
arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system -
submitted
01-07-2023 08:01
Behavioral task
behavioral1
Sample
lfjsdk3exe.exe
Resource
win7-20230621-en
General
-
Target
lfjsdk3exe.exe
-
Size
1.5MB
-
MD5
d1964c1b30d01262eccaee06c600d726
-
SHA1
e213ef1a963cc1825b9183742bb2af555da72efe
-
SHA256
06ece311c226daf62863e5791def4efee02dacfeacc6b7635095d0a63b715a99
-
SHA512
02d5f5d71ef785dbc9a2c7bf960d60a19a7eeba3ae8227442c21ba153fc2443e0d1e5ec8319e70a55defcb1057f43d4f41602ba2089a64615dc3aaa8569d47a5
-
SSDEEP
49152:H2z+hNyiTobT9875vxVZTE90wa1GImyAZ:H2iobT981Ze0wwGIPAZ
Malware Config
Extracted
redline
YT
65.21.5.58:48811
-
auth_value
fb878dde7f3b4ad1e1bc26d24db36d28
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
lfjsdk3exe.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ lfjsdk3exe.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
lfjsdk3exe.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion lfjsdk3exe.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion lfjsdk3exe.exe -
Processes:
resource yara_rule behavioral1/memory/1580-55-0x0000000001170000-0x0000000001670000-memory.dmp themida behavioral1/memory/1580-66-0x0000000001170000-0x0000000001670000-memory.dmp themida -
Processes:
lfjsdk3exe.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA lfjsdk3exe.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
lfjsdk3exe.exepid process 1580 lfjsdk3exe.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
lfjsdk3exe.exedescription pid process target process PID 1580 set thread context of 1068 1580 lfjsdk3exe.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
lfjsdk3exe.exepid process 1580 lfjsdk3exe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
lfjsdk3exe.exedescription pid process Token: SeDebugPrivilege 1580 lfjsdk3exe.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
lfjsdk3exe.exedescription pid process target process PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1628 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe PID 1580 wrote to memory of 1068 1580 lfjsdk3exe.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\lfjsdk3exe.exe"C:\Users\Admin\AppData\Local\Temp\lfjsdk3exe.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1068-60-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1068-64-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1068-62-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/1068-67-0x0000000001F70000-0x0000000001FB0000-memory.dmpFilesize
256KB
-
memory/1068-68-0x0000000001F70000-0x0000000001FB0000-memory.dmpFilesize
256KB
-
memory/1580-55-0x0000000001170000-0x0000000001670000-memory.dmpFilesize
5.0MB
-
memory/1580-56-0x00000000000E0000-0x00000000000E1000-memory.dmpFilesize
4KB
-
memory/1580-57-0x000007FE80010000-0x000007FE80011000-memory.dmpFilesize
4KB
-
memory/1580-58-0x000000001B640000-0x000000001B6C0000-memory.dmpFilesize
512KB
-
memory/1580-59-0x0000000000380000-0x00000000003F8000-memory.dmpFilesize
480KB
-
memory/1580-66-0x0000000001170000-0x0000000001670000-memory.dmpFilesize
5.0MB