Analysis
-
max time kernel
143s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06-02-2024 09:56
Behavioral task
behavioral1
Sample
946d57e17f85b6556069ab908af48b7e.exe
Resource
win7-20231215-en
General
-
Target
946d57e17f85b6556069ab908af48b7e.exe
-
Size
1.9MB
-
MD5
946d57e17f85b6556069ab908af48b7e
-
SHA1
30524c2b14a80070ddfaa937731c3814a3b6201e
-
SHA256
7b265d7cc88fdf7c6d99ea21e3bc57c01e421f83a720da383fe7ae825fd958b0
-
SHA512
3e720cb0536e3b3eda121fe1d63f5469888d90dfed999d760085d7c30e0a3d8dec50b9b9ee65506c922d63257480251a385c7910cfa19e90ea104195fb6079a2
-
SSDEEP
24576:KOdEoHSpRdr3pOXi/eruVXKwGwICm6M7LfT+3sKpE1ICrjuzH+ByDYLN61s6DdBr:KOHy1UXlSglzXHf0sx1HkesDYiL09dm
Malware Config
Extracted
redline
H
65.21.103.71:56458
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
SectopRAT payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/536-11-0x0000000000D00000-0x0000000001358000-memory.dmp family_sectoprat -
Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\ACPI\DSDT\VBOX__ 946d57e17f85b6556069ab908af48b7e.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 946d57e17f85b6556069ab908af48b7e.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 946d57e17f85b6556069ab908af48b7e.exe -
Processes:
resource yara_rule behavioral2/memory/536-11-0x0000000000D00000-0x0000000001358000-memory.dmp themida -
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 946d57e17f85b6556069ab908af48b7e.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exepid process 536 946d57e17f85b6556069ab908af48b7e.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exepid process 536 946d57e17f85b6556069ab908af48b7e.exe 536 946d57e17f85b6556069ab908af48b7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
946d57e17f85b6556069ab908af48b7e.exedescription pid process Token: SeDebugPrivilege 536 946d57e17f85b6556069ab908af48b7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\946d57e17f85b6556069ab908af48b7e.exe"C:\Users\Admin\AppData\Local\Temp\946d57e17f85b6556069ab908af48b7e.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/536-0-0x0000000000D00000-0x0000000001358000-memory.dmpFilesize
6.3MB
-
memory/536-1-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-3-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-5-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-6-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-7-0x0000000077C64000-0x0000000077C66000-memory.dmpFilesize
8KB
-
memory/536-4-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-2-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-11-0x0000000000D00000-0x0000000001358000-memory.dmpFilesize
6.3MB
-
memory/536-12-0x0000000005BB0000-0x0000000006154000-memory.dmpFilesize
5.6MB
-
memory/536-14-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/536-13-0x0000000006780000-0x0000000006D98000-memory.dmpFilesize
6.1MB
-
memory/536-15-0x0000000005700000-0x0000000005712000-memory.dmpFilesize
72KB
-
memory/536-16-0x0000000005960000-0x000000000599C000-memory.dmpFilesize
240KB
-
memory/536-17-0x00000000064F0000-0x000000000653C000-memory.dmpFilesize
304KB
-
memory/536-18-0x0000000006670000-0x000000000677A000-memory.dmpFilesize
1.0MB
-
memory/536-20-0x0000000000D00000-0x0000000001358000-memory.dmpFilesize
6.3MB
-
memory/536-21-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-23-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-22-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-25-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB
-
memory/536-26-0x0000000075AB0000-0x0000000075BA0000-memory.dmpFilesize
960KB