Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
dump-6712fc982192d3f301cda237.exe

Overview

General Information

Sample name:dump-6712fc982192d3f301cda237.exe
Analysis ID:1537511
MD5:3de539e280954c1083481598569d4506
SHA1:684b851290faadcb3a08b905b8c136599f562936
SHA256:0f88ab5ce2544b2bfe515e5b808f9c723e467bb609d7890e2242d9a76b966da7
Tags:exeuser-V3n0mStrike
Infos:
Errors
  • No process behavior to analyse as no analysis process or sample was found
  • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

Detection

RedLine
Score:68
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Malicious sample detected (through community Yara rule)
Multi AV Scanner detection for submitted file
Yara detected RedLine Stealer
Machine Learning detection for sample
PE file does not import any functions
Sample file is different than original file name gathered from version info
Uses 32bit PE files
Yara detected Credential Stealer
Yara signature match

Classification

Malware Threat Intel

Provided by

NameDescriptionAttributionBlogpost URLsLink
RedLine StealerRedLine Stealer is a malware available on underground forums for sale apparently as a standalone ($100/$150 depending on the version) or also on a subscription basis ($100/month). This malware harvests information from browsers such as saved credentials, autocomplete data, and credit card information. A system inventory is also taken when running on a target machine, to include details such as the username, location data, hardware configuration, and information regarding installed security software. More recent versions of RedLine added the ability to steal cryptocurrency. FTP and IM clients are also apparently targeted by this family, and this malware has the ability to upload and download files, execute commands, and periodically send back information about the infected computer.No Attributionhttps://malpedia.caad.fkie.fraunhofer.de/details/win.redline_stealer

Malware Configuration

⊘No configs have been found

Yara Signatures

Initial Sample

SourceRuleDescriptionAuthorStrings
dump-6712fc982192d3f301cda237.exeJoeSecurity_CredentialStealerYara detected Credential StealerJoe Security
    dump-6712fc982192d3f301cda237.exeJoeSecurity_RedLineYara detected RedLine StealerJoe Security
      dump-6712fc982192d3f301cda237.exeMALWARE_Win_Arechclient2Detects Arechclient2 RATditekSHen
      • 0xba44a:$s14: keybd_event
      • 0xc11b9:$v1_1: grabber@
      • 0xbb01c:$v1_2: <BrowserProfile>k__
      • 0xbba95:$v1_3: <SystemHardwares>k__
      • 0xbbb54:$v1_5: <ScannedWallets>k__
      • 0xbbbe4:$v1_6: <DicrFiles>k__
      • 0xbbbc0:$v1_7: <MessageClientFiles>k__
      • 0xbbf8a:$v1_8: <ScanBrowsers>k__BackingField
      • 0xbbfdc:$v1_8: <ScanWallets>k__BackingField
      • 0xbbff9:$v1_8: <ScanScreen>k__BackingField
      • 0xbc033:$v1_8: <ScanVPN>k__BackingField
      • 0xad862:$v1_9: displayName[AString-ZaString-z\d]{2String4}\.[String\w-]{String6}\.[\wString-]{2String7}Local Extension Settingshost
      • 0xad16e:$v1_10: \sitemanager.xml MB or SELECT * FROM Cookiesconfig

      Sigma Signatures

      ⊘No Sigma rule has matched

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      AV Detection

      barindex
      Multi AV Scanner detection for submitted file
      Source: dump-6712fc982192d3f301cda237.exeVirustotal: Detection: 27%Perma Link
      Machine Learning detection for sample
      Source: dump-6712fc982192d3f301cda237.exeJoe Sandbox ML: detected
      Source: dump-6712fc982192d3f301cda237.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE

      System Summary

      barindex
      Malicious sample detected (through community Yara rule)
      Source: dump-6712fc982192d3f301cda237.exe, type: SAMPLEMatched rule: Detects Arechclient2 RAT Author: ditekSHen
      Source: dump-6712fc982192d3f301cda237.exeStatic PE information: No import functions for PE file found
      Source: dump-6712fc982192d3f301cda237.exeBinary or memory string: OriginalFilenamebluefin.exe" vs dump-6712fc982192d3f301cda237.exe
      Source: dump-6712fc982192d3f301cda237.exeStatic PE information: EXECUTABLE_IMAGE, 32BIT_MACHINE
      Source: dump-6712fc982192d3f301cda237.exe, type: SAMPLEMatched rule: MALWARE_Win_Arechclient2 author = ditekSHen, description = Detects Arechclient2 RAT
      Source: classification engineClassification label: mal68.troj.winEXE@0/0@0/0
      Source: dump-6712fc982192d3f301cda237.exeStatic PE information: Section: .text IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      Source: dump-6712fc982192d3f301cda237.exeStatic file information: TRID: Win32 Executable (generic) Net Framework (10011505/4) 49.79%
      Source: dump-6712fc982192d3f301cda237.exeVirustotal: Detection: 27%
      Source: dump-6712fc982192d3f301cda237.exeStatic PE information: data directory type: IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR

      Stealing of Sensitive Information

      barindex
      Yara detected RedLine Stealer
      Source: Yara matchFile source: dump-6712fc982192d3f301cda237.exe, type: SAMPLE
      Source: Yara matchFile source: dump-6712fc982192d3f301cda237.exe, type: SAMPLE

      Remote Access Functionality

      barindex
      Yara detected RedLine Stealer
      Source: Yara matchFile source: dump-6712fc982192d3f301cda237.exe, type: SAMPLE

      Mitre Att&ck Matrix

      ⊘No Mitre Att&ck techniques found

      Behavior Graph

      Hide Legend

      Legend:

      • Process
      • Signature
      • Created File
      • DNS/IP Info
      • Is Dropped
      • Is Windows Process
      • Number of created Registry Values
      • Number of created Files
      • Visual Basic
      • Delphi
      • Java
      • .Net C# or VB.NET
      • C, C++ or other language
      • Is malicious
      • Internet

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      dump-6712fc982192d3f301cda237.exe27%VirustotalBrowse
      dump-6712fc982192d3f301cda237.exe100%Joe Sandbox ML

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      ⊘No contacted domains info

      World Map of Contacted IPs

      ⊘No contacted IP infos

      General Information

      Joe Sandbox version:41.0.0 Charoite
      Analysis ID:1537511
      Start date and time:2024-10-19 03:54:05 +02:00
      Joe Sandbox product:CloudBasic
      Overall analysis duration:0h 1m 21s
      Hypervisor based Inspection enabled:false
      Report type:full
      Cookbook file name:default.jbs
      Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
      Number of analysed new started processes analysed:1
      Number of new started drivers analysed:0
      Number of existing processes analysed:0
      Number of existing drivers analysed:0
      Number of injected processes analysed:0
      Technologies:
      • EGA enabled
      • AMSI enabled
      Analysis Mode:default
      Analysis stop reason:Timeout
      Sample name:dump-6712fc982192d3f301cda237.exe
      Detection:MAL
      Classification:mal68.troj.winEXE@0/0@0/0
      Cookbook Comments:
      • Found application associated with file extension: .exe
      • Unable to launch sample, stop analysis

      Errors

      • No process behavior to analyse as no analysis process or sample was found
      • Corrupt sample or wrongly selected analyzer. Details: %1 is not a valid Win32 application.

      Warnings

      • Exclude process from analysis (whitelisted): dllhost.exe

      Simulations

      Behavior and APIs

      ⊘No simulations

      Joe Sandbox View / Context

      IPs

      ⊘No context

      Domains

      ⊘No context

      ASNs

      ⊘No context

      JA3 Fingerprints

      ⊘No context

      Dropped Files

      ⊘No context

      Created / dropped Files

      ⊘No created / dropped files found

      Static File Info

      General

      File type:PE32 executable (GUI) Intel 80386 Mono/.Net assembly, for MS Windows
      Entropy (8bit):6.68664751143546
      TrID:
      • Win32 Executable (generic) Net Framework (10011505/4) 49.79%
      • Win32 Executable (generic) a (10002005/4) 49.75%
      • Generic CIL Executable (.NET, Mono, etc.) (73296/58) 0.36%
      • Windows Screen Saver (13104/52) 0.07%
      • Win16/32 Executable Delphi generic (2074/23) 0.01%
      File name:dump-6712fc982192d3f301cda237.exe
      File size:811'008 bytes
      MD5:3de539e280954c1083481598569d4506
      SHA1:684b851290faadcb3a08b905b8c136599f562936
      SHA256:0f88ab5ce2544b2bfe515e5b808f9c723e467bb609d7890e2242d9a76b966da7
      SHA512:4e2026a9d8e4287c97d1f1e404db18a81e2c6880a638210df5e5966e016ba8a2153c65a625f490e7967680c635c1383290c2226b1941559b94e1746a694a7b62
      SSDEEP:12288:rvsXZv8km0OHcbGbvzWHz0Hnquw3S+60ssFWylkkoAbtEfnwfNqbYS2VbICKMIUM:UfPz0H0r60ssFlSjruu
      TLSH:84055BEF7B4BEE32DEE9337C48FF4D0992A1D3A79181914A144894D00FE479E9749AC1
      File Content Preview:MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......PE..L......g................................. ........@.. .......................`.............................................

      File Icon

      Icon Hash:00928e8e8686b000

      Static PE Info

      General

      Entrypoint:0x4c17ae
      Entrypoint Section:.text
      Digitally signed:false
      Imagebase:0x400000
      Subsystem:windows gui
      Image File Characteristics:EXECUTABLE_IMAGE, 32BIT_MACHINE
      DLL Characteristics:
      Time Stamp:0x6703D8EB [Mon Oct 7 12:49:47 2024 UTC]
      TLS Callbacks:
      CLR (.Net) Version:
      OS Version Major:4
      OS Version Minor:0
      File Version Major:4
      File Version Minor:0
      Subsystem Version Major:4
      Subsystem Version Minor:0
      Import Hash:

      Entrypoint Preview

      Instruction
      or eax, dword ptr [edi]
      or dword ptr [eax+ecx], ebx
      or byte ptr [eax], cl
      or byte ptr [eax+ecx], bl
      or byte ptr [eax], cl
      add eax, 12020120h
      or al, 15h
      add dword ptr [eax], eax
      add dword ptr [eax], eax
      push esp
      push cs
      add al, 4Eh
      popad
      insd
      or dword ptr [ecx+ebp*2+72h], eax
      arpl word ptr [edi+ebp*2+72h], si
      jns 00007F45C0908B15h
      add dword ptr [eax], eax
      add dword ptr [eax], eax
      push esp
      push cs
      add al, 4Eh
      popad
      insd
      pop es
      push eax
      popad
      je 00007F45C0908B76h
      jc 00007F45C0908B71h
      push ss
      add dword ptr [eax], eax
      add dword ptr [eax], eax
      push esp
      push cs
      add al, 4Eh
      popad
      insd
      or dl, byte ptr [edx+65h]
      arpl word ptr [edi+75h], bp
      jc 00007F45C0908B75h
      imul esi, dword ptr [esi+00h], 00000000h
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al
      add byte ptr [eax], al

      Data Directories

      NameVirtual AddressVirtual Size Is in Section
      IMAGE_DIRECTORY_ENTRY_EXPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IMPORT0xc17540x57.text
      IMAGE_DIRECTORY_ENTRY_RESOURCE0xc20000x600.rsrc
      IMAGE_DIRECTORY_ENTRY_EXCEPTION0x00x0
      IMAGE_DIRECTORY_ENTRY_SECURITY0x00x0
      IMAGE_DIRECTORY_ENTRY_BASERELOC0xc40000xc.reloc
      IMAGE_DIRECTORY_ENTRY_DEBUG0x00x0
      IMAGE_DIRECTORY_ENTRY_COPYRIGHT0x00x0
      IMAGE_DIRECTORY_ENTRY_GLOBALPTR0x00x0
      IMAGE_DIRECTORY_ENTRY_TLS0x00x0
      IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG0x00x0
      IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_IAT0x20000x8.text
      IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT0x00x0
      IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR0x20080x48.text
      IMAGE_DIRECTORY_ENTRY_RESERVED0x00x0

      Sections

      NameVirtual AddressVirtual SizeRaw SizeMD5Xored PEZLIB ComplexityFile TypeEntropyCharacteristics
      .text0x20000xbf7b40xbf800f4d2589031985047e415795050a264ccFalse0.5456243370593995data6.778270125642536IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
      .rsrc0xc20000x6000x6005f66dd302c7c3267136ac33720e7e1f2False0.4973958333333333data5.402281516046388IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ
      .reloc0xc40000xc0x2000ef78b826d948610f6089f879f89d02fFalse0.50390625data5.1483542079209395IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_DISCARDABLE, IMAGE_SCN_MEM_READ

      Network Behavior

      ⊘No network behavior found

      Statistics

      ⊘No statistics

      System Behavior

      ⊘No system behavior

      Disassembly

      ⊘No disassembly