Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 22:17
Static task
static1
Behavioral task
behavioral1
Sample
3f8ea350223347b7c1feab3a82091baf.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
3f8ea350223347b7c1feab3a82091baf.exe
Resource
win10v2004-20231215-en
General
-
Target
3f8ea350223347b7c1feab3a82091baf.exe
-
Size
1.8MB
-
MD5
3f8ea350223347b7c1feab3a82091baf
-
SHA1
ab4ac82877e05f363ec79ac52fad0347591fbd3e
-
SHA256
532c7089ec69ccb7b99fee0f61f4019b3f0579bee96df3e6b44918c35d11ff21
-
SHA512
58aabbea475acd951df9ccbec9e4f413a80647c8bf8f966f139377a979389e8bf81c3070c0b582cc9f10c4c9af25c5d5443cd6a4bedf742639bded0fac8514d7
-
SSDEEP
49152:w0ibGTraiQZH7eIZ+peMqLIRvGLLrld7ox1TfbcUeSJJoczC:nrQ02+peDLvppmRkSJ2cu
Malware Config
Extracted
redline
1
65.21.162.231:8696
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SectopRAT payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2184-6-0x0000000000DB0000-0x000000000126C000-memory.dmp family_sectoprat behavioral1/memory/2184-10-0x0000000000DB0000-0x000000000126C000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
3f8ea350223347b7c1feab3a82091baf.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 3f8ea350223347b7c1feab3a82091baf.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
3f8ea350223347b7c1feab3a82091baf.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 3f8ea350223347b7c1feab3a82091baf.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 3f8ea350223347b7c1feab3a82091baf.exe -
Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
Processes:
3f8ea350223347b7c1feab3a82091baf.exedescription ioc process Key opened \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Wine 3f8ea350223347b7c1feab3a82091baf.exe -
Processes:
3f8ea350223347b7c1feab3a82091baf.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 3f8ea350223347b7c1feab3a82091baf.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
Processes:
3f8ea350223347b7c1feab3a82091baf.exedescription ioc process File opened for modification \??\PhysicalDrive0 3f8ea350223347b7c1feab3a82091baf.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
3f8ea350223347b7c1feab3a82091baf.exepid process 2184 3f8ea350223347b7c1feab3a82091baf.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
3f8ea350223347b7c1feab3a82091baf.exepid process 2184 3f8ea350223347b7c1feab3a82091baf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3f8ea350223347b7c1feab3a82091baf.exedescription pid process Token: SeDebugPrivilege 2184 3f8ea350223347b7c1feab3a82091baf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f8ea350223347b7c1feab3a82091baf.exe"C:\Users\Admin\AppData\Local\Temp\3f8ea350223347b7c1feab3a82091baf.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2184-0-0x0000000000DB0000-0x000000000126C000-memory.dmpFilesize
4.7MB
-
memory/2184-1-0x0000000077300000-0x0000000077302000-memory.dmpFilesize
8KB
-
memory/2184-2-0x0000000074BE0000-0x0000000074BEB000-memory.dmpFilesize
44KB
-
memory/2184-4-0x0000000074A80000-0x0000000074ACA000-memory.dmpFilesize
296KB
-
memory/2184-5-0x00000000749A0000-0x00000000749A9000-memory.dmpFilesize
36KB
-
memory/2184-7-0x00000000742B0000-0x000000007499E000-memory.dmpFilesize
6.9MB
-
memory/2184-6-0x0000000000DB0000-0x000000000126C000-memory.dmpFilesize
4.7MB
-
memory/2184-8-0x0000000076860000-0x000000007692C000-memory.dmpFilesize
816KB
-
memory/2184-10-0x0000000000DB0000-0x000000000126C000-memory.dmpFilesize
4.7MB
-
memory/2184-9-0x0000000076A60000-0x0000000076B50000-memory.dmpFilesize
960KB
-
memory/2184-11-0x0000000002A70000-0x0000000002AB0000-memory.dmpFilesize
256KB
-
memory/2184-12-0x0000000073BD0000-0x0000000073BE7000-memory.dmpFilesize
92KB
-
memory/2184-13-0x0000000000DB0000-0x000000000126C000-memory.dmpFilesize
4.7MB
-
memory/2184-14-0x0000000073B70000-0x0000000073BC2000-memory.dmpFilesize
328KB
-
memory/2184-15-0x0000000073B40000-0x0000000073B4D000-memory.dmpFilesize
52KB
-
memory/2184-16-0x0000000073A80000-0x0000000073AD8000-memory.dmpFilesize
352KB
-
memory/2184-17-0x0000000076930000-0x0000000076957000-memory.dmpFilesize
156KB
-
memory/2184-19-0x0000000074A80000-0x0000000074ACA000-memory.dmpFilesize
296KB
-
memory/2184-20-0x00000000742B0000-0x000000007499E000-memory.dmpFilesize
6.9MB
-
memory/2184-21-0x0000000076A60000-0x0000000076B50000-memory.dmpFilesize
960KB
-
memory/2184-23-0x0000000002A70000-0x0000000002AB0000-memory.dmpFilesize
256KB
-
memory/2184-24-0x0000000073B70000-0x0000000073BC2000-memory.dmpFilesize
328KB
-
memory/2184-25-0x0000000073A80000-0x0000000073AD8000-memory.dmpFilesize
352KB