Edit tour

Windows Analysis Report
StZAEFSb2j.exe

Overview

General Information

Sample Name:	StZAEFSb2j.exe
Analysis ID:	736967
MD5:	c71616e2b7cedf9fc8e2ca6f6929abdf
SHA1:	896a4c41792c73db51074ccff5ef3f0577f510c5
SHA256:	4a9f8a3b847fa9d2e854d3a7235ddee8e4c093d04c3901f006d430be1060fae5
Tags:	exeRedLineStealer
Infos:

Detection

RedLine

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Yara detected RedLine Stealer

Multi AV Scanner detection for submitted file

Malicious sample detected (through community Yara rule)

Antivirus detection for URL or domain

Snort IDS alert for network traffic

Writes to foreign memory regions

Tries to steal Crypto Currency Wallets

.NET source code references suspicious native API functions

Uses known network protocols on non-standard ports

Machine Learning detection for sample

Allocates memory in foreign processes

.NET source code contains potential unpacker

Injects a PE file into a foreign processes

Queries sensitive video device information (via WMI, Win32_VideoController, often done to detect virtual machines)

Queries sensitive disk information (via WMI, Win32_DiskDrive, often done to detect virtual machines)

C2 URLs / IPs found in malware configuration

Found many strings related to Crypto-Wallets (likely being stolen)

Contains functionality to check if a debugger is running (CheckRemoteDebuggerPresent)

Tries to harvest and steal browser information (history, passwords, etc)

Queries the volume information (name, serial number etc) of a device

Yara signature match

May sleep (evasive loops) to hinder dynamic analysis

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Uses code obfuscation techniques (call, push, ret)

Internet Provider seen in connection with other malware

Detected potential crypto function

Sample execution stops while process was sleeping (likely an evasion)

Yara detected Credential Stealer

JA3 SSL client fingerprint seen in connection with other malware

HTTP GET or POST without a user agent

IP address seen in connection with other malware

Contains long sleeps (>= 3 min)

Enables debug privileges

Is looking for software installed on the system

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found inlined nop instructions (likely shell or obfuscated code)

Sample file is different than original file name gathered from version info

Detected TCP or UDP traffic on non-standard ports

Checks if the current process is being debugged

Contains functionality to detect virtual machines (SLDT)

Queries sensitive processor information (via WMI, Win32_Processor, often done to detect virtual machines)

Creates a process in suspended mode (likely to inject code)

Classification

Process Tree

System is w10x64

StZAEFSb2j.exe (PID: 780 cmdline: C:\Users\user\Desktop\StZAEFSb2j.exe MD5: C71616E2B7CEDF9FC8E2CA6F6929ABDF)

aspnet_compiler.exe (PID: 1592 cmdline: C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe MD5: 17CC69238395DF61AAF483BCEF02E7C9)

conhost.exe (PID: 6120 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: EA777DEEA782E8B4D7C7C33BBF8A4496)

cleanup

Malware Configuration

Threatname: RedLine

{"C2 url": ["194.55.186.201:6008"], "Bot Id": "xxxPROFxxx"}

Yara Signatures

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
dump.pcap	JoeSecurity_RedLine_1	Yara detected RedLine Stealer	Joe Security

Memory Dumps

Source	Rule	Description	Author	Strings
00000000.00000002.321721404.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000000.00000002.321721404.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000000.00000002.321721404.00000000042B9000.00000004.00000800.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x535ca:$a4: get_ScannedWallets 0x6b1ea:$a4: get_ScannedWallets 0x52428:$a5: get_ScanTelegram 0x6a048:$a5: get_ScanTelegram 0x5324e:$a6: get_ScanGeckoBrowsersPaths 0x6ae6e:$a6: get_ScanGeckoBrowsersPaths 0x5106a:$a7: <Processes>k__BackingField 0x68c8a:$a7: <Processes>k__BackingField 0x4ef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x66b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x5099e:$a9: <ScanFTP>k__BackingField 0x685be:$a9: <ScanFTP>k__BackingField
00000001.00000000.316565039.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
00000001.00000000.316565039.0000000000402000.00000040.00000400.00020000.00000000.sdmp	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
00000001.00000000.316565039.0000000000402000.00000040.00000400.00020000.00000000.sdmp	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x133ca:$a4: get_ScannedWallets 0x12228:$a5: get_ScanTelegram 0x1304e:$a6: get_ScanGeckoBrowsersPaths 0x10e6a:$a7: <Processes>k__BackingField 0xed7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1079e:$a9: <ScanFTP>k__BackingField
00000001.00000002.415555604.0000000002FAF000.00000004.00000800.00020000.00000000.sdmp	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: StZAEFSb2j.exe PID: 780	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: StZAEFSb2j.exe PID: 780	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: StZAEFSb2j.exe PID: 780	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x381a4:$a4: get_ScannedWallets 0x3704b:$a5: get_ScanTelegram 0x37e2d:$a6: get_ScanGeckoBrowsersPaths 0x35cde:$a7: <Processes>k__BackingField 0x33211:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x35612:$a9: <ScanFTP>k__BackingField
Process Memory Space: aspnet_compiler.exe PID: 1592	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 1592	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
Process Memory Space: aspnet_compiler.exe PID: 1592	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x102b92:$a4: get_ScannedWallets 0x101a39:$a5: get_ScanTelegram 0x10281b:$a6: get_ScanGeckoBrowsersPaths 0x1006cc:$a7: <Processes>k__BackingField 0xfdbff:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x100000:$a9: <ScanFTP>k__BackingField
Click to see the 8 entries

Unpacked PEs

Source	Rule	Description	Author	Strings
0.2.StZAEFSb2j.exe.42f9000.5.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.StZAEFSb2j.exe.42f9000.5.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.StZAEFSb2j.exe.42f9000.5.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0xe68a:$u7: RunPE 0x11d41:$u8: DownloadAndEx 0x7330:$pat14: , CommandLine: 0x11279:$v2_1: ListOfProcesses 0xe88b:$v2_2: get_ScanVPN 0xe92e:$v2_2: get_ScanFTP 0xf61e:$v2_2: get_ScanDiscord 0x1060c:$v2_2: get_ScanSteam 0x10628:$v2_2: get_ScanTelegram 0x106ce:$v2_2: get_ScanScreen 0x11416:$v2_2: get_ScanChromeBrowsersPaths 0x1144e:$v2_2: get_ScanGeckoBrowsersPaths 0x11709:$v2_2: get_ScanBrowsers 0x117ca:$v2_2: get_ScannedWallets 0x117f0:$v2_2: get_ScanWallets 0x11810:$v2_3: GetArguments 0xfed9:$v2_4: VerifyUpdate 0x147f6:$v2_4: VerifyUpdate 0x11bca:$v2_5: VerifyScanRequest 0x112c6:$v2_6: GetUpdates 0x147d7:$v2_6: GetUpdates
0.2.StZAEFSb2j.exe.42f9000.5.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x117ca:$a4: get_ScannedWallets 0x10628:$a5: get_ScanTelegram 0x1144e:$a6: get_ScanGeckoBrowsersPaths 0xf26a:$a7: <Processes>k__BackingField 0xd17c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0xeb9e:$a9: <ScanFTP>k__BackingField
1.0.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
1.0.aspnet_compiler.exe.400000.0.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
1.0.aspnet_compiler.exe.400000.0.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x13610:$v2_3: GetArguments 0x11cd9:$v2_4: VerifyUpdate 0x165f6:$v2_4: VerifyUpdate 0x139ca:$v2_5: VerifyScanRequest 0x130c6:$v2_6: GetUpdates 0x165d7:$v2_6: GetUpdates
1.0.aspnet_compiler.exe.400000.0.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField
0.2.StZAEFSb2j.exe.42f9000.5.raw.unpack	JoeSecurity_RedLine	Yara detected RedLine Stealer	Joe Security
0.2.StZAEFSb2j.exe.42f9000.5.raw.unpack	JoeSecurity_CredentialStealer	Yara detected Credential Stealer	Joe Security
0.2.StZAEFSb2j.exe.42f9000.5.raw.unpack	MALWARE_Win_RedLine	Detects RedLine infostealer	ditekSHen	0x1048a:$u7: RunPE 0x280aa:$u7: RunPE 0x13b41:$u8: DownloadAndEx 0x2b761:$u8: DownloadAndEx 0x9130:$pat14: , CommandLine: 0x20d50:$pat14: , CommandLine: 0x13079:$v2_1: ListOfProcesses 0x2ac99:$v2_1: ListOfProcesses 0x1068b:$v2_2: get_ScanVPN 0x1072e:$v2_2: get_ScanFTP 0x1141e:$v2_2: get_ScanDiscord 0x1240c:$v2_2: get_ScanSteam 0x12428:$v2_2: get_ScanTelegram 0x124ce:$v2_2: get_ScanScreen 0x13216:$v2_2: get_ScanChromeBrowsersPaths 0x1324e:$v2_2: get_ScanGeckoBrowsersPaths 0x13509:$v2_2: get_ScanBrowsers 0x135ca:$v2_2: get_ScannedWallets 0x135f0:$v2_2: get_ScanWallets 0x282ab:$v2_2: get_ScanVPN 0x2834e:$v2_2: get_ScanFTP
0.2.StZAEFSb2j.exe.42f9000.5.raw.unpack	Windows_Trojan_RedLineStealer_f54632eb	unknown	unknown	0x135ca:$a4: get_ScannedWallets 0x2b1ea:$a4: get_ScannedWallets 0x12428:$a5: get_ScanTelegram 0x2a048:$a5: get_ScanTelegram 0x1324e:$a6: get_ScanGeckoBrowsersPaths 0x2ae6e:$a6: get_ScanGeckoBrowsersPaths 0x1106a:$a7: <Processes>k__BackingField 0x28c8a:$a7: <Processes>k__BackingField 0xef7c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x26b9c:$a8: <GetWindowsVersion>g__HKLM_GetString\|11_0 0x1099e:$a9: <ScanFTP>k__BackingField 0x285be:$a9: <ScanFTP>k__BackingField
Click to see the 7 entries

Sigma Signatures

⊘No Sigma rule has matched

Snort Signatures

ET DNS Query to a .tk domain - Likely Hostile - Source IP: 192.168.2.4 - Destination IP: 8.8.8.8

Timestamp:	192.168.2.48.8.8.856572532012811 11/03/22-12:44:38.337914
SID:	2012811
Source Port:	56572
Destination Port:	53
Protocol:	UDP
Classtype:	Potentially Bad Traffic

ET TROJAN Windows executable base64 encoded - Source IP: 50.115.174.192 - Destination IP: 192.168.2.4

Timestamp:	50.115.174.192192.168.2.4443496952018856 11/03/22-12:44:39.556293
SID:	2018856
Source Port:	443
Destination Port:	49695
Protocol:	TCP
Classtype:	A Network Trojan was detected

ET TROJAN Windows executable base64 encoded - Source IP: 50.115.174.192 - Destination IP: 192.168.2.4

Timestamp:	50.115.174.192192.168.2.4443496962018856 11/03/22-12:44:40.820043
SID:	2018856
Source Port:	443
Destination Port:	49696
Protocol:	TCP
Classtype:	A Network Trojan was detected

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Multi AV Scanner detection for submitted file

Source: StZAEFSb2j.exe	ReversingLabs: Detection: 34%
Source: StZAEFSb2j.exe	Virustotal: Detection: 25%			Perma Link

Antivirus detection for URL or domain

Source: https://tgc8x.tk/tt/BLACKDEV.txt	Avira URL Cloud: Label: phishing
Source: https://tgc8x.tk/tt/lamb.txt	Avira URL Cloud: Label: phishing

Machine Learning detection for sample

Source: StZAEFSb2j.exe

Joe Sandbox ML: detected

Source: 00000000.00000002.321721404.00000000042B9000.00000004.00000800.00020000.00000000.sdmp

Malware Configuration Extractor: RedLine {"C2 url": ["194.55.186.201:6008"], "Bot Id": "xxxPROFxxx"}

Source: unknown

HTTPS traffic detected: 50.115.174.192:443 -> 192.168.2.4:49695 version: TLS 1.2

Source: StZAEFSb2j.exe

Static PE information: HIGH_ENTROPY_VA, DYNAMIC_BASE, NX_COMPAT, NO_SEH, TERMINAL_SERVER_AWARE

Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BLACKDEVIL.pdbBSJB source: StZAEFSb2j.exe, 00000000.00000002.322189785.0000000005000000.00000004.08000000.00040000.00000000.sdmp, StZAEFSb2j.exe, 00000000.00000002.321290507.0000000002C1B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: C:\Users\Administrator\Documents\CryptoObfuscator_Output\BLACKDEVIL.pdb source: StZAEFSb2j.exe, 00000000.00000002.322189785.0000000005000000.00000004.08000000.00040000.00000000.sdmp, StZAEFSb2j.exe, 00000000.00000002.321290507.0000000002C1B000.00000004.00000800.00020000.00000000.sdmp
Source:	Binary string: XCBVNDDJD.pdb source: StZAEFSb2j.exe

Source: C:\Users\user\Desktop\StZAEFSb2j.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00E442DC
Source: C:\Users\user\Desktop\StZAEFSb2j.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00E464DC
Source: C:\Users\user\Desktop\StZAEFSb2j.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00E45C60
Source: C:\Users\user\Desktop\StZAEFSb2j.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00E44300
Source: C:\Users\user\Desktop\StZAEFSb2j.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00E4610C
Source: C:\Users\user\Desktop\StZAEFSb2j.exe	Code function: 4x nop then mov dword ptr [ebp-20h], 00000000h	0_2_00E44318

Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report
StZAEFSb2j.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report StZAEFSb2j.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: RedLine

Yara Signatures

PCAP (Network Traffic)

Memory Dumps

Unpacked PEs

Sigma Signatures

Snort Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Software Vulnerabilities

Networking

Windows Analysis Report
StZAEFSb2j.exe