Analysis
-
max time kernel
41s -
max time network
41s -
platform
windows11-21h2_x64 -
resource
win11-20241007-en -
resource tags
arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system -
submitted
12-01-2025 23:50
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Setup.exe
Resource
win11-20241007-en
windows11-21h2-x64
13 signatures
150 seconds
General
-
Target
Setup.exe
-
Size
766KB
-
MD5
3a2edcc08db323bcb54a4b7dd3064c93
-
SHA1
40ee8e516f21720335e4e01e471471044a2f94ff
-
SHA256
c44b939c90c4a2532cf72c111ac8afd762661703a4e220f1c605bf71a66b2829
-
SHA512
040997f3b968a46920e9ef611a309eceadcb7e904be8f0ca94870213a5fbff4217c41820deee76062d3cc04b0a3643bb752c0b9bf7b1d53fd9c23914d4ecd4ad
-
SSDEEP
12288:9M21Of9dQUbkKevTfdEGDXicZ6SXntq6YQCtcKqrapU3Vg7cQ9oGa1ZFt:m2QvmtScZLW6aGVg4Qha17
Score
10/10
Malware Config
Extracted
Family
redline
C2
45.15.157.131:36457
Attributes
-
auth_value
0b1c7aa3f8d9eb1607fd8100272acb83
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
resource yara_rule behavioral1/memory/3800-1-0x00000000002F0000-0x0000000000320000-memory.dmp family_redline -
Redline family
-
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1472 set thread context of 3800 1472 Setup.exe 78 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AppLaunch.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Setup.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 taskmgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString taskmgr.exe -
Modifies registry class 3 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\History\CachePrefix = "Visited:" BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Content\CachePrefix BackgroundTransferHost.exe Set value (str) \REGISTRY\USER\S-1-5-21-556537508-2730415644-482548075-1000_Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppContainer\Storage\microsoftwindows.client.cbs_cw5n1h2txyewy\Internet Settings\Cache\Cookies\CachePrefix = "Cookie:" BackgroundTransferHost.exe -
Suspicious behavior: EnumeratesProcesses 23 IoCs
pid Process 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 4168 taskmgr.exe Token: SeSystemProfilePrivilege 4168 taskmgr.exe Token: SeCreateGlobalPrivilege 4168 taskmgr.exe Token: 33 4168 taskmgr.exe Token: SeIncBasePriorityPrivilege 4168 taskmgr.exe -
Suspicious use of FindShellTrayWindow 43 IoCs
pid Process 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe -
Suspicious use of SendNotifyMessage 43 IoCs
pid Process 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe 4168 taskmgr.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 1472 wrote to memory of 3800 1472 Setup.exe 78 PID 1472 wrote to memory of 3800 1472 Setup.exe 78 PID 1472 wrote to memory of 3800 1472 Setup.exe 78 PID 1472 wrote to memory of 3800 1472 Setup.exe 78 PID 1472 wrote to memory of 3800 1472 Setup.exe 78
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup.exe"C:\Users\Admin\AppData\Local\Temp\Setup.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- System Location Discovery: System Language Discovery
PID:3800
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:3036
-
C:\Windows\system32\BackgroundTransferHost.exe"BackgroundTransferHost.exe" -ServerName:BackgroundTransferHost.131⤵
- Modifies registry class
PID:4656
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /01⤵
- Checks SCSI registry key(s)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:4168