Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
4vyCnCoo6B.exe

Overview

General Information

Sample name:4vyCnCoo6B.exe
renamed because original name is a hash value
Original sample name:65f8fcab7cfe7aecbdd653d2ec0837ed.exe
Analysis ID:1472627
MD5:65f8fcab7cfe7aecbdd653d2ec0837ed
SHA1:ea9596a2624d5790c2bc4df8a68cfa0f058e6b29
SHA256:f40e893088c2aa07fb61b43f6e5087dbe49857044efa50b56329ccfe82b252a9
Tags:exeRedLineStealer
Infos:

Detection

RedLine
Score:100
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Found malware configuration
Multi AV Scanner detection for domain / URL
Multi AV Scanner detection for submitted file
Snort IDS alert for network traffic
Yara detected RedLine Stealer
AI detected suspicious sample
C2 URLs / IPs found in malware configuration
Machine Learning detection for sample
Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)
Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)
Tries to harvest and steal browser information (history, passwords, etc)
Tries to steal Crypto Currency Wallets
Allocates memory with a write watch (potentially for evading sandboxes)
Binary contains a suspicious time stamp
Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)
Contains functionality to access loader functionality (e.g. LdrGetProcedureAddress)
Contains long sleeps (>= 3 min)
Detected TCP or UDP traffic on non-standard ports
Detected potential crypto function
Enables debug privileges
Found a high number of Window / User specific system calls (may be a loop to detect user behavior)
Found inlined nop instructions (likely shell or obfuscated code)
IP address seen in connection with other malware
Internet Provider seen in connection with other malware
May sleep (evasive loops) to hinder dynamic analysis
Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)
Queries the volume information (name, serial number etc) of a device
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Uses code obfuscation techniques (call, push, ret)
Yara detected Credential Stealer

Classification

Process Tree

  • System is w10x64
  • 4vyCnCoo6B.exe (PID: 6984 cmdline: "C:\Users\user\Desktop\4vyCnCoo6B.exe" MD5: 65F8FCAB7CFE7AECBDD653D2EC0837ED)
  • cleanup

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

Threatname: RedLine

{"C2 url": ["77.105.135.107:3445"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
4vyCnCoo6B.exeJoeSecurity_RedLineYara detected RedLine StealerJoe Security

    PCAP (Network Traffic)

    SourceRuleDescriptionAuthorStrings
    dump.pcapJoeSecurity_RedLine_1Yara detected RedLine StealerJoe Security
      dump.pcapJoeSecurity_RedLineYara detected RedLine StealerJoe Security

        Memory Dumps

        SourceRuleDescriptionAuthorStrings
        00000000.00000000.1624178266.0000000000992000.00000002.00000001.01000000.00000003.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
          00000000.00000002.1758904914.0000000002EA4000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
            00000000.00000002.1758904914.0000000002EA4000.00000004.00000800.00020000.00000000.sdmpJoeSecurity_RedLineYara detected RedLine StealerJoe Security
              Process Memory Space: 4vyCnCoo6B.exe PID: 6984JoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
                Process Memory Space: 4vyCnCoo6B.exe PID: 6984JoeSecurity_RedLineYara detected RedLine StealerJoe Security

                  Unpacked PEs

                  SourceRuleDescriptionAuthorStrings
                  0.0.4vyCnCoo6B.exe.990000.0.unpackJoeSecurity_RedLineYara detected RedLine StealerJoe Security

                    Sigma Signatures

                    ⊘No Sigma rule has matched

                    Snort Signatures

                    Timestamp:07/13/24-08:32:05.987590
                    SID:2043231
                    Source Port:49730
                    Destination Port:3445
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:07/13/24-08:31:54.766128
                    SID:2043234
                    Source Port:3445
                    Destination Port:49730
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:07/13/24-08:31:54.575294
                    SID:2046045
                    Source Port:49730
                    Destination Port:3445
                    Protocol:TCP
                    Classtype:A Network Trojan was detected
                    Timestamp:07/13/24-08:32:00.297078
                    SID:2046056
                    Source Port:3445
                    Destination Port:49730
                    Protocol:TCP
                    Classtype:A Network Trojan was detected

                    Joe Sandbox Signatures

                    Click to jump to signature section

                    Show All Signature Results

                    AV Detection

                    barindex
                    Found malware configuration
                    Source: 4vyCnCoo6B.exeMalware Configuration Extractor: RedLine {"C2 url": ["77.105.135.107:3445"], "Bot Id": "LogsDiller Cloud (TG: @logsdillabot)", "Authorization Header": "3a050df92d0cf082b2cdaf87863616be"}
                    Multi AV Scanner detection for domain / URL
                    Source: 77.105.135.107:3445Virustotal: Detection: 9%Perma Link
                    Multi AV Scanner detection for submitted file
                    Source: 4vyCnCoo6B.exeReversingLabs: Detection: 87%
                    Source: 4vyCnCoo6B.exeVirustotal: Detection: 79%Perma Link
                    AI detected suspicious sample
                    Source: Submited SampleIntegrated Neural Analysis Model: Matched 100.0% probability
                    Machine Learning detection for sample
                    Source: 4vyCnCoo6B.exeJoe Sandbox ML: detected
                    Source: 4vyCnCoo6B.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
                    Source: 4vyCnCoo6B.exeStatic PE information: DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F0AA44h0_2_06F0A780
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F0B247h0_2_06F0AAE8
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F01FD2h0_2_06F01BB0
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F02452h0_2_06F01BB0
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F03AE3h0_2_06F038B0
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F0D6B0h0_2_06F0D1B8
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F06402h0_2_06F06141
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F04EFDh0_2_06F04EDC
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F09A3Ah0_2_06F09A22
                    Source: C:\Users\user\Desktop\4vyCnCoo6B.exeCode function: 4x nop then jmp 06F02C45h0_2_06F02868

                    Networking

                    bar