Resubmissions

02-04-2021 10:13

210402-qmk84q731a 5

01-04-2021 07:23

210401-qmxmygyems 10

Analysis

  • max time kernel
    133s
  • max time network
    132s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    01-04-2021 07:23

General

  • Target

    QFSN0331PDF.exe

  • Size

    519KB

  • MD5

    18377afa571a27e3d67024934eb425fc

  • SHA1

    72e4b926dcf352558304f42fac331b2dda61049e

  • SHA256

    edbc5c4578e139f3194afcb1ccd8627f8f966bfda05e4574d0e8dcc65b8a4dcb

  • SHA512

    7ea97d9f6bfe31288d8487386ec5d92ea9d9d7832813d40f20c49cc345c03b4caec4c2558258c7f5d895663a38aff1afe8edd70bf49ebed4dfbcb5b8a0542475

Malware Config

Extracted

Family

redline

C2

mhuncho.duckdns.org:3214

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe
    "C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1724
    • C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe
      "C:\Users\Admin\AppData\Local\Temp\QFSN0331PDF.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1296

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1296-8-0x0000000000400000-0x0000000000430000-memory.dmp
    Filesize

    192KB

  • memory/1296-9-0x00000000004296EE-mapping.dmp
  • memory/1296-10-0x0000000074D20000-0x000000007540E000-memory.dmp
    Filesize

    6.9MB

  • memory/1296-11-0x0000000000400000-0x0000000000430000-memory.dmp
    Filesize

    192KB

  • memory/1296-13-0x0000000004A90000-0x0000000004A91000-memory.dmp
    Filesize

    4KB

  • memory/1724-2-0x0000000074D20000-0x000000007540E000-memory.dmp
    Filesize

    6.9MB

  • memory/1724-3-0x0000000001230000-0x0000000001231000-memory.dmp
    Filesize

    4KB

  • memory/1724-5-0x00000000004E0000-0x00000000004E9000-memory.dmp
    Filesize

    36KB

  • memory/1724-6-0x0000000004C80000-0x0000000004C81000-memory.dmp
    Filesize

    4KB

  • memory/1724-7-0x0000000004C20000-0x0000000004C78000-memory.dmp
    Filesize

    352KB