Analysis

  • max time kernel
    23s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    03-05-2021 23:37

General

  • Target

    320F0032704DEA1152C5880DEF04E61E.exe

  • Size

    2.3MB

  • MD5

    320f0032704dea1152c5880def04e61e

  • SHA1

    6dd5462a765375ab6d8720263aebe4b37c9b17d2

  • SHA256

    8d730630389f403985ddbff2c9617c9b9ca9fd4ad0c9ee5d9fceeecc44356340

  • SHA512

    99ed916a76ecd3c898afff7d287e95cbd985f22b3c99999396de5e5c4ebc99c1e020309fede213cdb4a2a4c2523b521b4803c396089424ee21ac20a88eea701d

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Turns off Windows Defender SpyNet reporting 2 TTPs
  • Windows security bypass 2 TTPs
  • Nirsoft 3 IoCs
  • Executes dropped EXE 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Windows security modification 2 TTPs 10 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 7 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe
    "C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe"
    1⤵
    • Windows security modification
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2208
    • C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe
      "C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2748
      • C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe
        "C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe" /SpecialRun 4101d8 2748
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:3280
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe" -Force
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2820
    • C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe
      "C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe"
      2⤵
        PID:2636
      • C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe
        "C:\Users\Admin\AppData\Local\Temp\320F0032704DEA1152C5880DEF04E61E.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:988

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Defense Evasion

    Disabling Security Tools

    3
    T1089

    Modify Registry

    3
    T1112

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    System Information Discovery

    1
    T1082

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\320F0032704DEA1152C5880DEF04E61E.exe.log
      MD5

      c0ad7b531cb050d170ceb51110be64db

      SHA1

      1fc4ff77fe0838a1fec8723139c25d5708ed8c0b

      SHA256

      2212589a88f2f3fa5c7127e548ea493b3ab2927e2417b54928ec82e3a42a424c

      SHA512

      148ecaa1ee3259ab2ec63abb28af5daad10534bd48e9afec2984d343c8f9c361f8caed04b32bb0de85d41e3329935e6d100d5036e33bc8fadcda1f7dd1bde436

    • C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe
      MD5

      17fc12902f4769af3a9271eb4e2dacce

      SHA1

      9a4a1581cc3971579574f837e110f3bd6d529dab

      SHA256

      29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

      SHA512

      036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

    • C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe
      MD5

      17fc12902f4769af3a9271eb4e2dacce

      SHA1

      9a4a1581cc3971579574f837e110f3bd6d529dab

      SHA256

      29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

      SHA512

      036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

    • C:\Users\Admin\AppData\Local\Temp\12defb9a-1f68-4bbe-9c74-aef1690feb72\AdvancedRun.exe
      MD5

      17fc12902f4769af3a9271eb4e2dacce

      SHA1

      9a4a1581cc3971579574f837e110f3bd6d529dab

      SHA256

      29ae7b30ed8394c509c561f6117ea671ec412da50d435099756bbb257fafb10b

      SHA512

      036e0d62490c26dee27ef54e514302e1cc8a14de8ce3b9703bf7caf79cfae237e442c27a0edcf2c4fd41af4195ba9ed7e32e894767ce04467e79110e89522e4a

    • memory/988-190-0x0000000005790000-0x0000000005D96000-memory.dmp
      Filesize

      6.0MB

    • memory/988-189-0x00000000004171F2-mapping.dmp
    • memory/2208-114-0x0000000000FA0000-0x0000000000FA1000-memory.dmp
      Filesize

      4KB

    • memory/2208-116-0x0000000005A00000-0x0000000005A01000-memory.dmp
      Filesize

      4KB

    • memory/2208-117-0x00000000032F0000-0x0000000003356000-memory.dmp
      Filesize

      408KB

    • memory/2208-118-0x0000000008550000-0x0000000008551000-memory.dmp
      Filesize

      4KB

    • memory/2208-119-0x0000000006DF0000-0x0000000006DF1000-memory.dmp
      Filesize

      4KB

    • memory/2748-120-0x0000000000000000-mapping.dmp
    • memory/2820-130-0x00000000049C0000-0x00000000049C1000-memory.dmp
      Filesize

      4KB

    • memory/2820-138-0x0000000008410000-0x0000000008411000-memory.dmp
      Filesize

      4KB

    • memory/2820-129-0x00000000073D0000-0x00000000073D1000-memory.dmp
      Filesize

      4KB

    • memory/2820-132-0x00000000072A0000-0x00000000072A1000-memory.dmp
      Filesize

      4KB

    • memory/2820-133-0x0000000007C90000-0x0000000007C91000-memory.dmp
      Filesize

      4KB

    • memory/2820-134-0x0000000007B00000-0x0000000007B01000-memory.dmp
      Filesize

      4KB

    • memory/2820-135-0x0000000007D00000-0x0000000007D01000-memory.dmp
      Filesize

      4KB

    • memory/2820-136-0x0000000007B70000-0x0000000007B71000-memory.dmp
      Filesize

      4KB

    • memory/2820-137-0x0000000008560000-0x0000000008561000-memory.dmp
      Filesize

      4KB

    • memory/2820-131-0x00000000049C2000-0x00000000049C3000-memory.dmp
      Filesize

      4KB

    • memory/2820-146-0x00000000090E0000-0x0000000009113000-memory.dmp
      Filesize

      204KB

    • memory/2820-153-0x00000000090C0000-0x00000000090C1000-memory.dmp
      Filesize

      4KB

    • memory/2820-158-0x0000000009440000-0x0000000009441000-memory.dmp
      Filesize

      4KB

    • memory/2820-159-0x0000000009600000-0x0000000009601000-memory.dmp
      Filesize

      4KB

    • memory/2820-187-0x000000007F510000-0x000000007F511000-memory.dmp
      Filesize

      4KB

    • memory/2820-188-0x00000000049C3000-0x00000000049C4000-memory.dmp
      Filesize

      4KB

    • memory/2820-128-0x0000000004820000-0x0000000004821000-memory.dmp
      Filesize

      4KB

    • memory/2820-125-0x0000000000000000-mapping.dmp
    • memory/3280-123-0x0000000000000000-mapping.dmp