Analysis
-
max time kernel
40s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20230703-en -
resource tags
arch:x64arch:x86image:win7-20230703-enlocale:en-usos:windows7-x64system -
submitted
10/07/2023, 13:06
Behavioral task
behavioral1
Sample
46ef6daecec030061841713f7.exe
Resource
win7-20230703-en
Behavioral task
behavioral2
Sample
46ef6daecec030061841713f7.exe
Resource
win10v2004-20230703-en
General
-
Target
46ef6daecec030061841713f7.exe
-
Size
2.6MB
-
MD5
65482e3a11dff25a26f8b9667999ae5f
-
SHA1
967455baa933e5122008db83ebf0f0be29d8afa1
-
SHA256
46ef6daecec030061841713f7afb387a0a7ce913e2a5d63bc46126628daf19e1
-
SHA512
d4475480c623ddf2a648977af78548470a56e115990018fc91b354b939949a36f7dd84822d4dee54c3a9df690b4d70deef43eb55420f38fe9186a9d26fd1c6b3
-
SSDEEP
49152:DLZTeIJtQrmRw7mGRPsIbGHH04cmjloa2TouNMjTuyRQeWhKIjAkSt80rY:D5IrmRwKGSTHtjWa2cbTuySeWhKCSvY
Malware Config
Extracted
redline
090723_rc_11
rcam.tuktuk.ug:11290
-
auth_value
abd581cdd66d51ad306682319cafa5a0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 46ef6daecec030061841713f7.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 46ef6daecec030061841713f7.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 46ef6daecec030061841713f7.exe -
resource yara_rule behavioral1/memory/996-57-0x0000000000C60000-0x00000000012AA000-memory.dmp themida behavioral1/memory/996-97-0x0000000000C60000-0x00000000012AA000-memory.dmp themida -
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 46ef6daecec030061841713f7.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 996 46ef6daecec030061841713f7.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 996 set thread context of 2052 996 46ef6daecec030061841713f7.exe 29 -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 996 46ef6daecec030061841713f7.exe 2052 MsBuild.exe 2052 MsBuild.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 996 46ef6daecec030061841713f7.exe Token: SeDebugPrivilege 2052 MsBuild.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29 PID 996 wrote to memory of 2052 996 46ef6daecec030061841713f7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\46ef6daecec030061841713f7.exe"C:\Users\Admin\AppData\Local\Temp\46ef6daecec030061841713f7.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\MsBuild.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2052
-