Analysis
-
max time kernel
149s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2024 18:22
Behavioral task
behavioral1
Sample
stas.exe
Resource
win7-20241010-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
stas.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
stas.exe
-
Size
141KB
-
MD5
8811c7584ab2e1615dee039af05ac388
-
SHA1
6f4b6eaaafc7a80159988b8476f034a77fcd9350
-
SHA256
43afd5df7d87b7e29ec8d8d4411cc4d901426230a68394125ba6c2b26a361183
-
SHA512
fcdc97570d68a71bd335cfd3ebca762c1d57efa6afa0982d03939c6b8f36944870326a09b7e4a8d75481127f2253063c369439a7f8fe7b877856dfc58eb6cc26
-
SSDEEP
3072:VK1JZOpTvVQZ+rcIeRYs6YmszJqoD2n7BpGGoMTb3R35dINX9r57xo:UOpu0rjeRbVJqoDy1pGGoMTb3RDINN
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral2/memory/3428-1-0x0000000000440000-0x000000000046A000-memory.dmp family_redline -
Redline family
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language stas.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Kills process with taskkill 1 IoCs
pid Process 4956 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 20 IoCs
pid Process 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3428 stas.exe Token: SeDebugPrivilege 4956 taskkill.exe Token: SeDebugPrivilege 1588 taskmgr.exe Token: SeSystemProfilePrivilege 1588 taskmgr.exe Token: SeCreateGlobalPrivilege 1588 taskmgr.exe Token: 33 1588 taskmgr.exe Token: SeIncBasePriorityPrivilege 1588 taskmgr.exe -
Suspicious use of FindShellTrayWindow 45 IoCs
pid Process 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe -
Suspicious use of SendNotifyMessage 45 IoCs
pid Process 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe 1588 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3428 wrote to memory of 2652 3428 stas.exe 87 PID 3428 wrote to memory of 2652 3428 stas.exe 87 PID 3428 wrote to memory of 2652 3428 stas.exe 87 PID 2652 wrote to memory of 4956 2652 cmd.exe 89 PID 2652 wrote to memory of 4956 2652 cmd.exe 89 PID 2652 wrote to memory of 4956 2652 cmd.exe 89 PID 2652 wrote to memory of 3808 2652 cmd.exe 93 PID 2652 wrote to memory of 3808 2652 cmd.exe 93 PID 2652 wrote to memory of 3808 2652 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\stas.exe"C:\Users\Admin\AppData\Local\Temp\stas.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3428 -
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /C taskkill /F /PID 3428 && choice /C Y /N /D Y /T 3 & Del "C:\Users\Admin\AppData\Local\Temp\stas.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\taskkill.exetaskkill /F /PID 34283⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4956
-
-
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 33⤵
- System Location Discovery: System Language Discovery
PID:3808
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1588
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:4372