Analysis

  • max time kernel
    55s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    02-05-2021 09:40

General

  • Target

    eeb397bd859f7efb9e507c0878562cd1.exe

  • Size

    995KB

  • MD5

    eeb397bd859f7efb9e507c0878562cd1

  • SHA1

    f2933d4df487ff310ff6e755884f2baf14404f5b

  • SHA256

    8c2bcfb8657193f893a95fac8d90cabad1b35ed4ed2402dc717523ef255b9e2e

  • SHA512

    9c8e1567621e81535d921ac2a0fabb468d8d7aa83bb793851c9434a49e7f7b9d62d21bad9646220be241f9c9b67858dc99af9d1e09affe3753a2d2496598dacd

Malware Config

Extracted

Family

redline

Botnet

2.05.111M

C2

redworksite.info:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\eeb397bd859f7efb9e507c0878562cd1.exe
    "C:\Users\Admin\AppData\Local\Temp\eeb397bd859f7efb9e507c0878562cd1.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4800
    • C:\Users\Admin\AppData\Local\Temp\eeb397bd859f7efb9e507c0878562cd1.exe
      "{path}"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1000

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\eeb397bd859f7efb9e507c0878562cd1.exe.log
    MD5

    b4f7a6a57cb46d94b72410eb6a6d45a9

    SHA1

    69f3596ffa027202d391444b769ceea0ae14c5f7

    SHA256

    23994ebe221a48ea16ebad51ae0d4b47ccd415ae10581f9405e588d4f6c2523b

    SHA512

    be6da516e54c3a5b33ac2603137a2f8cf8445ff5961dd266faedf3627bae8979953d7ef305538df0151c609917a5b99bf5d023bdd32de50fd5c723950f90db5c

  • memory/1000-127-0x00000000004163A2-mapping.dmp
  • memory/1000-141-0x0000000006F30000-0x0000000006F31000-memory.dmp
    Filesize

    4KB

  • memory/1000-140-0x0000000007460000-0x0000000007461000-memory.dmp
    Filesize

    4KB

  • memory/1000-139-0x0000000006D60000-0x0000000006D61000-memory.dmp
    Filesize

    4KB

  • memory/1000-136-0x00000000054C0000-0x00000000054C1000-memory.dmp
    Filesize

    4KB

  • memory/1000-135-0x0000000005130000-0x0000000005736000-memory.dmp
    Filesize

    6.0MB

  • memory/1000-134-0x0000000005250000-0x0000000005251000-memory.dmp
    Filesize

    4KB

  • memory/1000-133-0x0000000005210000-0x0000000005211000-memory.dmp
    Filesize

    4KB

  • memory/1000-132-0x00000000051B0000-0x00000000051B1000-memory.dmp
    Filesize

    4KB

  • memory/1000-131-0x0000000005740000-0x0000000005741000-memory.dmp
    Filesize

    4KB

  • memory/1000-126-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

  • memory/4800-120-0x00000000052B0000-0x00000000052B1000-memory.dmp
    Filesize

    4KB

  • memory/4800-125-0x000000000B130000-0x000000000B160000-memory.dmp
    Filesize

    192KB

  • memory/4800-124-0x0000000008970000-0x00000000089EC000-memory.dmp
    Filesize

    496KB

  • memory/4800-123-0x0000000005570000-0x000000000557E000-memory.dmp
    Filesize

    56KB

  • memory/4800-122-0x00000000087F0000-0x0000000008881000-memory.dmp
    Filesize

    580KB

  • memory/4800-121-0x0000000008890000-0x0000000008891000-memory.dmp
    Filesize

    4KB

  • memory/4800-114-0x0000000000870000-0x0000000000871000-memory.dmp
    Filesize

    4KB

  • memory/4800-119-0x0000000002C80000-0x0000000002C81000-memory.dmp
    Filesize

    4KB

  • memory/4800-118-0x00000000052F0000-0x00000000052F1000-memory.dmp
    Filesize

    4KB

  • memory/4800-117-0x00000000051F0000-0x00000000051F1000-memory.dmp
    Filesize

    4KB

  • memory/4800-116-0x0000000005800000-0x0000000005801000-memory.dmp
    Filesize

    4KB