Resubmissions
29-06-2024 09:31
240629-lg563sxglj 1029-06-2024 09:28
240629-lfeyhaxfrk 1029-06-2024 09:23
240629-lcqktsxfmk 10Analysis
-
max time kernel
79s -
max time network
87s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
29-06-2024 09:28
Static task
static1
Behavioral task
behavioral1
Sample
Aura.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
Aura.exe
Resource
win10v2004-20240508-en
General
-
Target
Aura.exe
-
Size
493KB
-
MD5
7e7b8be8a1f1ef05c932ea1e8eab6590
-
SHA1
f790227a5148d6cba037c24643306f330c6fe5f4
-
SHA256
c7383b039d569cc256026d6b7985bb763f36530708bca3e4f82fa130d2d7dfbb
-
SHA512
c57fc80bf97309ca887c88526fc586b080d47c4f2ebe611d40f94f48c0af2b7c56cec19f0379a5bc27bd6a0e2f75bdb7953c05bcc1069633812bbd22649ef890
-
SSDEEP
12288:qGlz1vS9p1+kOwILHmKfZcBg688m/Iezfihoto8:qyNSgJqBg6NmAeehn
Malware Config
Extracted
redline
@hitok4111
94.228.166.68:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4280-1-0x0000000000400000-0x0000000000450000-memory.dmp family_redline -
Suspicious use of SetThreadContext 1 IoCs
Processes:
Aura.exedescription pid process target process PID 4048 set thread context of 4280 4048 Aura.exe RegAsm.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 4952 4048 WerFault.exe Aura.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
wermgr.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString wermgr.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 wermgr.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
wermgr.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS wermgr.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU wermgr.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Aura.exedescription pid process target process PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe PID 4048 wrote to memory of 4280 4048 Aura.exe RegAsm.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Aura.exe"C:\Users\Admin\AppData\Local\Temp\Aura.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4048 -s 2762⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 412 -p 4048 -ip 40481⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵
-
C:\Windows\system32\wermgr.exe"C:\Windows\system32\wermgr.exe" "-outproc" "0" "3484" "10292" "10244" "10296" "0" "0" "10300" "10304" "0" "0" "0" "0"1⤵
- Checks processor information in registry
- Enumerates system info in registry
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4048-0-0x0000000003000000-0x0000000003001000-memory.dmpFilesize
4KB
-
memory/4280-1-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/4280-2-0x000000007474E000-0x000000007474F000-memory.dmpFilesize
4KB
-
memory/4280-3-0x00000000056E0000-0x0000000005C84000-memory.dmpFilesize
5.6MB
-
memory/4280-4-0x00000000051D0000-0x0000000005262000-memory.dmpFilesize
584KB
-
memory/4280-5-0x0000000005190000-0x000000000519A000-memory.dmpFilesize
40KB
-
memory/4280-6-0x0000000074740000-0x0000000074EF0000-memory.dmpFilesize
7.7MB
-
memory/4280-7-0x0000000006670000-0x0000000006C88000-memory.dmpFilesize
6.1MB
-
memory/4280-8-0x0000000008000000-0x000000000810A000-memory.dmpFilesize
1.0MB
-
memory/4280-9-0x0000000007F10000-0x0000000007F22000-memory.dmpFilesize
72KB
-
memory/4280-10-0x0000000007F70000-0x0000000007FAC000-memory.dmpFilesize
240KB
-
memory/4280-11-0x0000000007FB0000-0x0000000007FFC000-memory.dmpFilesize
304KB
-
memory/4280-12-0x000000007474E000-0x000000007474F000-memory.dmpFilesize
4KB
-
memory/4280-13-0x0000000074740000-0x0000000074EF0000-memory.dmpFilesize
7.7MB