Malware Analysis Report

2024-12-01 01:23

Sample ID 241112-y76azs1bjm
Target 22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88
SHA256 22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88
Tags
redline romik discovery infostealer persistence
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88

Threat Level: Known bad

The file 22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88 was found to be: Known bad.

Malicious Activity Summary

redline romik discovery infostealer persistence

RedLine

RedLine payload

Redline family

Executes dropped EXE

Adds Run key to start application

Unsigned PE

System Location Discovery: System Language Discovery

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-11-12 20:26

Signatures

Unsigned PE

Description Indicator Process Target
N/A N/A N/A N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-11-12 20:26

Reported

2024-11-12 20:29

Platform

win10v2004-20241007-en

Max time kernel

140s

Max time network

150s

Command Line

"C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe"

Signatures

RedLine

infostealer redline

RedLine payload

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A
N/A N/A N/A N/A

Redline family

redline

Adds Run key to start application

persistence
Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup1 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP001.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup2 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP002.TMP\\\"" C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe N/A

System Location Discovery: System Language Discovery

discovery
Description Indicator Process Target
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe N/A
Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeDebugPrivilege N/A C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 3984 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe
PID 3984 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe
PID 3984 wrote to memory of 1692 N/A C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe
PID 1692 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe
PID 1692 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe
PID 1692 wrote to memory of 2588 N/A C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe
PID 2588 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe
PID 2588 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe
PID 2588 wrote to memory of 3000 N/A C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe

Processes

C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe

"C:\Users\Admin\AppData\Local\Temp\22c1a63a7205d1da40b89afd71679c06d8d0ba66649afe47278e84a1380f8f88.exe"

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe

Network

Country Destination Domain Proto
US 8.8.8.8:53 8.8.8.8.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 71.209.201.84.in-addr.arpa udp
US 8.8.8.8:53 133.32.126.40.in-addr.arpa udp
US 8.8.8.8:53 95.221.229.192.in-addr.arpa udp
RU 193.233.20.12:4132 tcp
US 8.8.8.8:53 133.211.185.52.in-addr.arpa udp
US 8.8.8.8:53 200.163.202.172.in-addr.arpa udp
US 8.8.8.8:53 171.39.242.20.in-addr.arpa udp
RU 193.233.20.12:4132 tcp
US 8.8.8.8:53 74.209.201.84.in-addr.arpa udp
RU 193.233.20.12:4132 tcp
US 8.8.8.8:53 172.210.232.199.in-addr.arpa udp
RU 193.233.20.12:4132 tcp
US 8.8.8.8:53 172.214.232.199.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
RU 193.233.20.12:4132 tcp
RU 193.233.20.12:4132 tcp

Files

C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\vJM12.exe

MD5 926b103575301f2845bf10a52573df4c
SHA1 d287cada71637511c7f1909c38fbd5012122b382
SHA256 63ea3f7582ce3938814f0f8d32d107bec23a59e02d3b3094f2ab11ce74858099
SHA512 a93cb342fdc158e6dad2f67eb6f20c024c5389d20b7b57d45ca2c158cebc634fd366fd964aff15b97a25cb74871872933f75469f26c2bfa2f0e8346a832ff03c

C:\Users\Admin\AppData\Local\Temp\IXP001.TMP\vSB30.exe

MD5 8b2cef09e4a0a9e6096c7164e9bedf5d
SHA1 f40e1016b15afaab49c109a80545b28ad0620eb2
SHA256 e8e9f3539ac23af78b2aafefc85d6bfd2f3410584d6debda08fff846f1b85da4
SHA512 fc7382860bad8d7a0635e60b8629e5a3ccc70e7465aca5c234d7b0262629fd386a28d05467cf2ae2a7f61d6b26904910c2e37f1cc60774a557ddea367129acef

C:\Users\Admin\AppData\Local\Temp\IXP002.TMP\dHj16.exe

MD5 45f8bfc8d5eb5084fd616df3f7e055af
SHA1 bed0d63374a425e922b18f243c699239ba0f6bfb
SHA256 e36e5a2972ffa26a5453108e0385fbe371045fafb60ca0fafd0a7fe1e557a0c9
SHA512 0e4ae78d96fe6e89929806a7716770563cab588ce1f724abffd046b6671f8f46e78007a8d6b74c0c034f6ddaebc646359810075e2e6fdf3fa66c8e343cbba1e4

memory/3000-24-0x0000000000400000-0x000000000044E000-memory.dmp

memory/3000-23-0x0000000000670000-0x00000000006BB000-memory.dmp

memory/3000-22-0x0000000000740000-0x0000000000840000-memory.dmp

memory/3000-25-0x0000000002260000-0x00000000022A6000-memory.dmp

memory/3000-26-0x0000000004CE0000-0x0000000005284000-memory.dmp

memory/3000-27-0x0000000004B50000-0x0000000004B94000-memory.dmp

memory/3000-29-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-67-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-91-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-89-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-88-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-85-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-83-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-81-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-79-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-77-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-75-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-73-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-71-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-69-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-65-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-63-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-62-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-59-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-57-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-55-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-51-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-49-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-47-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-45-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-43-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-41-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-39-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-37-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-35-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-31-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-53-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-33-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-28-0x0000000004B50000-0x0000000004B8E000-memory.dmp

memory/3000-934-0x0000000005290000-0x00000000058A8000-memory.dmp

memory/3000-935-0x00000000058B0000-0x00000000059BA000-memory.dmp

memory/3000-936-0x0000000004CA0000-0x0000000004CB2000-memory.dmp

memory/3000-937-0x00000000059C0000-0x00000000059FC000-memory.dmp

memory/3000-938-0x0000000005B00000-0x0000000005B4C000-memory.dmp

memory/3000-940-0x0000000000740000-0x0000000000840000-memory.dmp

memory/3000-941-0x0000000000400000-0x000000000044E000-memory.dmp