Analysis
-
max time kernel
143s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
-
submitted
08/01/2024, 05:39
General
-
Target
Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe
-
Size
413KB
-
MD5
8b549dd5d9bd265f5c2f660128ca0416
-
SHA1
e30b5ff421c81114fc5f4e6d9fe52d201b4486a5
-
SHA256
468b604307b567958f106df5a1503da9ce04390eda7c83f67bc38d08a09156f0
-
SHA512
3441562ee73483eccc1f4eba9449f49a0248b5908b0f1b817bd166c78dcafe6235c4fee7989a8b0e4f9ceece52c92cd48c2df11d3bd418b32648b613f7658f25
-
SSDEEP
6144:3l6C3WQk+iM53X+FduVXUCB5EU7hbBNrVO+DSLbyVnygTClugS+EI:3p9iMtX+6TLEUNb3rI+DSInTTC0gS+EI
Malware Config
Extracted
redline
W118
77.73.134.2:4427
-
auth_value
709a90bfc5899237ba049ee1a7dec425
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 4 IoCs
-
Nirsoft 1 IoCs
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
-
Executes dropped EXE 3 IoCs
-
Windows security modification 2 TTPs 5 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Suspicious use of SetThreadContext 1 IoCs
-
Drops file in Windows directory 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 27 IoCs
-
Suspicious use of AdjustPrivilegeToken 9 IoCs
-
Suspicious use of WriteProcessMemory 25 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionExtension "exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\3b181df5-de77-4ead-af5a-55f0525950ef.exe"C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\3b181df5-de77-4ead-af5a-55f0525950ef.exe" /o /c "Windows-Defender" /r2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Checks computer location settings
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\01072950-83c0-4449-8845-d6552589f811\AdvancedRun.exe" /SpecialRun 4101d8 39443⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe"C:\Users\Admin\AppData\Local\Temp\Microsoft.VisualStudio.Web.Publish.Contracts.dll.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
25KB
MD55951b52c9b4d11ca7f4f33e5a3fb2c31
SHA10bc54fd699fff7b93e5c447a141c0d904924ab0d
SHA25670b785e5cb5b2e61c0f5da4a71ab0bbd14d9a0849387f037e0d75cc1ffe0a082
SHA51230b3b1eed05ba724d9a19d0d301b6ffb45222a47cc5476cc7f61ae565ddea4deea669f6fc3f38a1c5f24396eb4d3d6a7a8b58992fdfe2fac57dbcc2fa5b9b1d8
-
Filesize
88KB
MD517fc12902f4769af3a9271eb4e2dacce
SHA19a4a1581cc3971579574f837e110f3bd6d529dab
SHA25629ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b
SHA512036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a
-
Filesize
7.7MB
-
Filesize
200KB
-
Filesize
120KB
-
Filesize
104KB
-
Filesize
304KB
-
Filesize
64KB
-
Filesize
7.7MB
-
Filesize
216KB
-
Filesize
64KB
-
Filesize
56KB
-
Filesize
64KB
-
Filesize
68KB
-
Filesize
64KB
-
Filesize
240KB
-
Filesize
1.0MB
-
Filesize
7.7MB
-
Filesize
7.7MB
-
Filesize
112KB
-
Filesize
6.1MB
-
Filesize
304KB
-
Filesize
72KB
-
Filesize
48KB
-
Filesize
10.8MB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
40KB
-
Filesize
304KB
-
Filesize
652KB
-
Filesize
7.7MB
-
Filesize
104KB
-
Filesize
64KB
-
Filesize
32KB
-
Filesize
7.7MB
-
Filesize
6.5MB
-
Filesize
64KB
-
Filesize
136KB
-
Filesize
3.3MB
-
Filesize
7.7MB
-
Filesize
408KB
-
Filesize
304KB
-
Filesize
120KB
-
Filesize
64KB
-
Filesize
80KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
64KB
-
Filesize
600KB
-
Filesize
7.7MB
-
Filesize
6.2MB
-
Filesize
432KB
-
Filesize
5.6MB
-
Filesize
416KB
-
Filesize
64KB
-
Filesize
624KB
-
Filesize
7.7MB
-
Filesize
7.7MB