Analysis
- max time kernel
112s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/03/2021, 16:02
General
- Target Smash Installer for Windows/1.exe
- Size 877KB
- Sample210305-kal2t1vmv2
- SHA256 1fd155e7fc507bd4df5d7c8ee6f5bf97cff1c38c8d2980d5ab6724065f22e2dc
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of SendNotifyMessage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Smash Installer for Windows\1.exe"C:\Users\Admin\AppData\Local\Temp\Smash Installer for Windows\1.exe"1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmpC:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\wmgDt5qbkprBPEvHJq3Cd9WrLH.tmp"{path}"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1344-26-0x00000000059D0000-0x00000000059D1000-memory.dmp
memory/1344-28-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/1344-36-0x0000000008A00000-0x0000000008A01000-memory.dmp
memory/1344-35-0x0000000005331000-0x0000000005332000-memory.dmp
memory/1344-34-0x0000000006F90000-0x0000000006F91000-memory.dmp
memory/1344-31-0x00000000073B0000-0x00000000073B1000-memory.dmp
memory/1344-30-0x0000000006CB0000-0x0000000006CB1000-memory.dmp
memory/1344-29-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/1344-15-0x0000000000400000-0x0000000000426000-memory.dmp
memory/1344-27-0x0000000005A30000-0x0000000005A31000-memory.dmp
memory/1344-25-0x0000000005F40000-0x0000000005F41000-memory.dmp
memory/1344-19-0x0000000073A40000-0x000000007412E000-memory.dmp
memory/1344-22-0x00000000051E0000-0x00000000051E1000-memory.dmp
memory/1344-23-0x0000000005330000-0x0000000005331000-memory.dmp
memory/1344-24-0x0000000005780000-0x0000000005781000-memory.dmp
memory/3608-5-0x0000000073A40000-0x000000007412E000-memory.dmp
memory/3608-6-0x0000000000370000-0x0000000000371000-memory.dmp
memory/3608-8-0x00000000051F0000-0x00000000051F1000-memory.dmp
memory/3608-14-0x0000000008550000-0x0000000008597000-memory.dmp
memory/3608-13-0x0000000004EB0000-0x0000000004EBB000-memory.dmp
memory/3608-12-0x0000000008330000-0x0000000008331000-memory.dmp
memory/3608-11-0x0000000004F10000-0x0000000004F11000-memory.dmp
memory/3608-10-0x0000000004DA0000-0x0000000004DA1000-memory.dmp
memory/3608-9-0x0000000004CF0000-0x0000000004CF1000-memory.dmp