Analysis

  • max time kernel
    30s
  • max time network
    67s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    31-03-2021 12:51

General

  • Target

    483dfb5d1e3d6a2da44d470459421a38.exe

  • Size

    353KB

  • MD5

    483dfb5d1e3d6a2da44d470459421a38

  • SHA1

    8980996a8ff96f53eec4098e44145f8eb7cfaf26

  • SHA256

    763523c1b4a8e9aa4583af76c6706ccac9df72244a3b8fc70ac81f864bcf7ed9

  • SHA512

    222083e593404936edc5e4c436df7cf1826911d3d781022a3f938c390e600b27584ad548f02d3e3425aa1e9e72929fecd67ba9c7a81f178ecb09f524c92bcac9

Malware Config

Extracted

Family

redline

Botnet

vavilon

C2

152.228.146.168:57727

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\483dfb5d1e3d6a2da44d470459421a38.exe
    "C:\Users\Admin\AppData\Local\Temp\483dfb5d1e3d6a2da44d470459421a38.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1404

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1404-2-0x0000000001E20000-0x0000000001E21000-memory.dmp
    Filesize

    4KB

  • memory/1404-3-0x0000000003940000-0x0000000003941000-memory.dmp
    Filesize

    4KB

  • memory/1404-4-0x0000000001C50000-0x0000000001C8A000-memory.dmp
    Filesize

    232KB

  • memory/1404-5-0x0000000000400000-0x000000000043D000-memory.dmp
    Filesize

    244KB

  • memory/1404-6-0x0000000073420000-0x0000000073B0E000-memory.dmp
    Filesize

    6.9MB

  • memory/1404-7-0x0000000003850000-0x0000000003884000-memory.dmp
    Filesize

    208KB

  • memory/1404-8-0x0000000006190000-0x0000000006191000-memory.dmp
    Filesize

    4KB

  • memory/1404-10-0x0000000006182000-0x0000000006183000-memory.dmp
    Filesize

    4KB

  • memory/1404-9-0x0000000006180000-0x0000000006181000-memory.dmp
    Filesize

    4KB

  • memory/1404-11-0x0000000006183000-0x0000000006184000-memory.dmp
    Filesize

    4KB

  • memory/1404-12-0x00000000038D0000-0x0000000003902000-memory.dmp
    Filesize

    200KB

  • memory/1404-13-0x0000000003940000-0x0000000003941000-memory.dmp
    Filesize

    4KB

  • memory/1404-14-0x0000000006184000-0x0000000006186000-memory.dmp
    Filesize

    8KB

  • memory/1404-15-0x0000000006160000-0x0000000006161000-memory.dmp
    Filesize

    4KB

  • memory/1404-16-0x0000000006B90000-0x0000000006B91000-memory.dmp
    Filesize

    4KB

  • memory/1404-17-0x0000000007210000-0x0000000007211000-memory.dmp
    Filesize

    4KB

  • memory/1404-18-0x0000000007230000-0x0000000007231000-memory.dmp
    Filesize

    4KB

  • memory/1404-19-0x00000000073A0000-0x00000000073A1000-memory.dmp
    Filesize

    4KB

  • memory/1404-20-0x0000000007630000-0x0000000007631000-memory.dmp
    Filesize

    4KB

  • memory/1404-21-0x0000000007AC0000-0x0000000007AC1000-memory.dmp
    Filesize

    4KB

  • memory/1404-22-0x0000000007C90000-0x0000000007C91000-memory.dmp
    Filesize

    4KB

  • memory/1404-23-0x0000000008550000-0x0000000008551000-memory.dmp
    Filesize

    4KB

  • memory/1404-24-0x0000000008600000-0x0000000008601000-memory.dmp
    Filesize

    4KB

  • memory/1404-25-0x0000000009900000-0x0000000009901000-memory.dmp
    Filesize

    4KB

  • memory/1404-26-0x0000000009B90000-0x0000000009B91000-memory.dmp
    Filesize

    4KB