Analysis

  • max time kernel
    85s
  • max time network
    197s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240214-en
  • resource tags

    arch:x64arch:x86image:win11-20240214-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    07-04-2024 17:53

General

  • Target

    frf.rar

  • Size

    3.1MB

  • MD5

    58f4de6b7696beac715e95dae702b0be

  • SHA1

    0dc721f94f58f67aec72cd72f24cb1fc8510bd04

  • SHA256

    4d8a9a4d5c6b2280c7fde5fe7bca2ec92ebb5dc10620c8070fefd28ade097991

  • SHA512

    0dfb4281d3d5a35f6b205446c8b9a7f9fa0254063e113a0b86a926d42f7e9fb96a1ce6774b84ce4164eedb134b7c1616e33d9fc7f9933f77e69849ad0001252c

  • SSDEEP

    49152:nlCV1w6IJgtaf2RJP/Yx1VOwFN1aqdpKuy6sCdxfrRNFIfYuyMhoXFbJ:lM1NJtTRJIPUANRpKuxs4jZwygo11

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Program crash 2 IoCs
  • Modifies registry class 1 IoCs
  • Modifies system certificate store 2 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Windows\system32\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\frf.rar
    1⤵
    • Modifies registry class
    • Suspicious use of WriteProcessMemory
    PID:4948
    • C:\Program Files\7-Zip\7zFM.exe
      "C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\frf.rar"
      2⤵
      • Suspicious behavior: GetForegroundWindowSpam
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      PID:3488
  • C:\Windows\System32\rundll32.exe
    C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
    1⤵
      PID:2736
    • C:\Users\Admin\Desktop\New folder\Brembo Loader.exe
      "C:\Users\Admin\Desktop\New folder\Brembo Loader.exe"
      1⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:3172
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Modifies system certificate store
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1256
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 3172 -s 828
        2⤵
        • Program crash
        PID:4720
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 416 -p 3172 -ip 3172
      1⤵
        PID:2840
      • C:\Users\Admin\Desktop\New folder\Brembo Loader.exe
        "C:\Users\Admin\Desktop\New folder\Brembo Loader.exe"
        1⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:448
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          2⤵
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of AdjustPrivilegeToken
          PID:4556
        • C:\Windows\SysWOW64\WerFault.exe
          C:\Windows\SysWOW64\WerFault.exe -u -p 448 -s 800
          2⤵
          • Program crash
          PID:2508
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 448 -ip 448
        1⤵
          PID:3164

        Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\RegAsm.exe.log

          Filesize

          2KB

          MD5

          18514361175f3afea0667587c0dad86c

          SHA1

          5d2f5a788f8747bfdfc87fe98387aa2f9bebb633

          SHA256

          d30dd2efb8bf06f2a61e8fcb8dbff8d021d4b7fc331c732e98ac25580cc0b14c

          SHA512

          76c4093685029b272ee1780dada3298f4fa0115a684925aaa2180b031c6f38182d8bcd1b483801eb972e6251b39879ff1070d17266dd6cfef7ec26ca1de04d51

        • C:\Users\Admin\AppData\Local\Temp\Tmp1EFD.tmp

          Filesize

          2KB

          MD5

          1420d30f964eac2c85b2ccfe968eebce

          SHA1

          bdf9a6876578a3e38079c4f8cf5d6c79687ad750

          SHA256

          f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

          SHA512

          6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

        • C:\Users\Admin\Desktop\Microsoft Edge.lnk

          Filesize

          2KB

          MD5

          b3d38ae17baab7284b45c76aacf25309

          SHA1

          a7ca5c07f499fc2acb3b526efedcdc2a121fd291

          SHA256

          2b90d1c75f1e6da878540efa57cb263d303eada27c0d3c0bfe18df61745c5272

          SHA512

          9febabdf15638291240227751f04f6932e5aa7b72189dbca4d0eac5b721cdcd8eec50603caf4ef002756dcea459430116615bcd00a518649c16862cc34101f00

        • C:\Users\Admin\Desktop\New folder\Brembo Loader.exe

          Filesize

          732KB

          MD5

          053f4312cef2c4b87dab159efedccb08

          SHA1

          75cf4286ee8131bcdd5857ffc6f97a765f5f7248

          SHA256

          a19ff1f1682f30e39769b199a30f00fbed768200b6fa367a1eee436c6d538354

          SHA512

          f47f5d9af72e7cc87df97788faad49b579cd0815f6e8082ca1ab73c62c45a89f188b0854a6b9bbd41e7eeeb33036ed94b022034509e1e275eb5380d59001fd78

        • C:\Users\Public\Desktop\Google Chrome.lnk

          Filesize

          2KB

          MD5

          6e6311a1b543dcda645469f117749a90

          SHA1

          c12d21a358c3d97eded0c1bb5d448d59c8a1878c

          SHA256

          cd697e72ae83162e18b3f37dd57768c2112d04d35f8431fef8c45faeffe66089

          SHA512

          8a7bf0fbafc4468563641808c5a037decf6c34eb1a6b46b6a509ee1bc79999e6d7f48b01d792b4e86f78edf3fe8f47beafa2470b7c6e3d1c264c42a33a89e05d

        • memory/448-90-0x0000000074F80000-0x0000000075731000-memory.dmp

          Filesize

          7.7MB

        • memory/448-80-0x0000000003240000-0x0000000005240000-memory.dmp

          Filesize

          32.0MB

        • memory/448-74-0x0000000074F80000-0x0000000075731000-memory.dmp

          Filesize

          7.7MB

        • memory/1256-62-0x0000000009060000-0x000000000916A000-memory.dmp

          Filesize

          1.0MB

        • memory/1256-69-0x000000000AB30000-0x000000000ACF2000-memory.dmp

          Filesize

          1.8MB

        • memory/1256-35-0x00000000056F0000-0x0000000005700000-memory.dmp

          Filesize

          64KB

        • memory/1256-36-0x00000000056F0000-0x0000000005700000-memory.dmp

          Filesize

          64KB

        • memory/1256-38-0x0000000005CB0000-0x0000000006256000-memory.dmp

          Filesize

          5.6MB

        • memory/1256-37-0x00000000056F0000-0x0000000005700000-memory.dmp

          Filesize

          64KB

        • memory/1256-39-0x0000000005700000-0x0000000005790000-memory.dmp

          Filesize

          576KB

        • memory/1256-40-0x0000000005830000-0x00000000058C2000-memory.dmp

          Filesize

          584KB

        • memory/1256-41-0x00000000057B0000-0x00000000057BA000-memory.dmp

          Filesize

          40KB

        • memory/1256-26-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/1256-33-0x00000000055F0000-0x0000000005682000-memory.dmp

          Filesize

          584KB

        • memory/1256-57-0x0000000008400000-0x0000000008476000-memory.dmp

          Filesize

          472KB

        • memory/1256-58-0x0000000008AD0000-0x0000000008AEE000-memory.dmp

          Filesize

          120KB

        • memory/1256-61-0x0000000009460000-0x0000000009A78000-memory.dmp

          Filesize

          6.1MB

        • memory/1256-32-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/1256-63-0x0000000008F90000-0x0000000008FA2000-memory.dmp

          Filesize

          72KB

        • memory/1256-64-0x0000000008FF0000-0x000000000902C000-memory.dmp

          Filesize

          240KB

        • memory/1256-65-0x0000000009170000-0x00000000091BC000-memory.dmp

          Filesize

          304KB

        • memory/1256-66-0x00000000092B0000-0x0000000009316000-memory.dmp

          Filesize

          408KB

        • memory/1256-34-0x0000000074EE0000-0x0000000075691000-memory.dmp

          Filesize

          7.7MB

        • memory/1256-70-0x000000000B230000-0x000000000B75C000-memory.dmp

          Filesize

          5.2MB

        • memory/1256-72-0x0000000074EE0000-0x0000000075691000-memory.dmp

          Filesize

          7.7MB

        • memory/1256-29-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/1256-28-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/3172-42-0x0000000074EE0000-0x0000000075691000-memory.dmp

          Filesize

          7.7MB

        • memory/3172-22-0x00000000001B0000-0x0000000000268000-memory.dmp

          Filesize

          736KB

        • memory/3172-23-0x0000000074EE0000-0x0000000075691000-memory.dmp

          Filesize

          7.7MB

        • memory/3172-30-0x0000000002770000-0x0000000004770000-memory.dmp

          Filesize

          32.0MB

        • memory/4556-88-0x0000000005820000-0x0000000005830000-memory.dmp

          Filesize

          64KB

        • memory/4556-86-0x0000000005820000-0x0000000005830000-memory.dmp

          Filesize

          64KB

        • memory/4556-79-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/4556-87-0x0000000005820000-0x0000000005830000-memory.dmp

          Filesize

          64KB

        • memory/4556-85-0x0000000074F80000-0x0000000075731000-memory.dmp

          Filesize

          7.7MB

        • memory/4556-89-0x0000000005820000-0x0000000005830000-memory.dmp

          Filesize

          64KB

        • memory/4556-83-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/4556-81-0x0000000000400000-0x00000000004B1000-memory.dmp

          Filesize

          708KB

        • memory/4556-109-0x00000000093B0000-0x00000000093FC000-memory.dmp

          Filesize

          304KB

        • memory/4556-112-0x0000000074F80000-0x0000000075731000-memory.dmp

          Filesize

          7.7MB