Analysis

  • max time kernel
    62s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    19-05-2021 18:31

General

  • Target

    3D29B2A1A23B12A5134FBE8B17FE5BA0C87549E567123.exe

  • Size

    1.0MB

  • MD5

    033e13c4aca370aeeb8031dbce7bf0b9

  • SHA1

    406100cd169260cecdf31914d055b612f678b00e

  • SHA256

    3d29b2a1a23b12a5134fbe8b17fe5ba0c87549e5671232eb9e842c2a55ad8f2b

  • SHA512

    4aa49c6b70df63bb022b5c7fcd7aef985c503dd21f6994394a4360a98cba4f3283f2dd8e986d9bf23cfe94425286526fff0f5b296a71c364b7a3e05d639ad00f

Malware Config

Extracted

Family

redline

Botnet

EUMX

C2

tstamore.info:80

Extracted

Family

redline

Botnet

121212

C2

168.119.241.77:60932

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 6 IoCs
  • Downloads MZ/PE file
  • Executes dropped EXE 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Suspicious use of SetThreadContext 2 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Modifies system certificate store 2 TTPs 2 IoCs
  • Runs ping.exe 1 TTPs 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3D29B2A1A23B12A5134FBE8B17FE5BA0C87549E567123.exe
    "C:\Users\Admin\AppData\Local\Temp\3D29B2A1A23B12A5134FBE8B17FE5BA0C87549E567123.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious use of WriteProcessMemory
    PID:3016
    • C:\Users\Admin\AppData\Local\Temp\262124620.exe
      C:\Users\Admin\AppData\Local\Temp\262124620.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3936
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe
        3⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2960
    • C:\Users\Admin\AppData\Local\Temp\2095039246.exe
      C:\Users\Admin\AppData\Local\Temp\2095039246.exe
      2⤵
      • Executes dropped EXE
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1524
      • C:\Users\Admin\AppData\Local\Temp\2095039246.exe
        C:\Users\Admin\AppData\Local\Temp\2095039246.exe
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4004
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /k ping 0 & del C:\Users\Admin\AppData\Local\Temp\3D29B2A1A23B12A5134FBE8B17FE5BA0C87549E567123.exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2208
      • C:\Windows\SysWOW64\PING.EXE
        ping 0
        3⤵
        • Runs ping.exe
        PID:3392

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

System Information Discovery

1
T1082

Remote System Discovery

1
T1018

Collection

Data from Local System

2
T1005

Command and Control

Web Service

1
T1102

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2095039246.exe.log
    MD5

    4a30a8132195c1aa1a62b78676b178d9

    SHA1

    506e6d99a2ba08c9d3553af30daaaa0fc46ae4be

    SHA256

    71636c227625058652c089035480b7bb3e5795f3998bc9823c401029fc844a20

    SHA512

    3272b5129525c2b8f7efb99f5a2115cf2572480ff6938ca80e63f02c52588216f861307b9ef962ba015787cae0d5a95e74ebb5fe4b35b34f1c4f3a7deac8ce09

  • C:\Users\Admin\AppData\Local\Temp\2095039246.exe
    MD5

    988a04b95560cf988b7cfa0daa3089ae

    SHA1

    fd19469731f19ca0d7ea13c13f9a8ad4c22c0bde

    SHA256

    f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1

    SHA512

    e6c0207d708a985c7cd152a7712f69a607cd31b94a937d01fcf3c8087f8436ddcb011dac3704a0cfa0a41f80b807b93b4cbdf11cebfc02270e6d307ff6dadf29

  • C:\Users\Admin\AppData\Local\Temp\2095039246.exe
    MD5

    988a04b95560cf988b7cfa0daa3089ae

    SHA1

    fd19469731f19ca0d7ea13c13f9a8ad4c22c0bde

    SHA256

    f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1

    SHA512

    e6c0207d708a985c7cd152a7712f69a607cd31b94a937d01fcf3c8087f8436ddcb011dac3704a0cfa0a41f80b807b93b4cbdf11cebfc02270e6d307ff6dadf29

  • C:\Users\Admin\AppData\Local\Temp\2095039246.exe
    MD5

    988a04b95560cf988b7cfa0daa3089ae

    SHA1

    fd19469731f19ca0d7ea13c13f9a8ad4c22c0bde

    SHA256

    f38d0cb23b83e4dccb0ae0016b5c94156a93f1c7dfdcf23ffef5c0a982e0f1d1

    SHA512

    e6c0207d708a985c7cd152a7712f69a607cd31b94a937d01fcf3c8087f8436ddcb011dac3704a0cfa0a41f80b807b93b4cbdf11cebfc02270e6d307ff6dadf29

  • C:\Users\Admin\AppData\Local\Temp\262124620.exe
    MD5

    723265e91c12f30cf69e763c04aef64f

    SHA1

    8a7b75fcc815c5ef119638bbe8265ecbba99c830

    SHA256

    6c0ee45081a09a77a503269607bb0dfd0ee173243f72224b46c8f7498aa1557d

    SHA512

    498706512c6fa7ed52f4035e5f67dda412b37829fa0b08c7a0279a5e307a2c6a7d9abe17eb2312549aa90f73efedc40db58b319a98ea2891a6328d2dce163554

  • C:\Users\Admin\AppData\Local\Temp\262124620.exe
    MD5

    723265e91c12f30cf69e763c04aef64f

    SHA1

    8a7b75fcc815c5ef119638bbe8265ecbba99c830

    SHA256

    6c0ee45081a09a77a503269607bb0dfd0ee173243f72224b46c8f7498aa1557d

    SHA512

    498706512c6fa7ed52f4035e5f67dda412b37829fa0b08c7a0279a5e307a2c6a7d9abe17eb2312549aa90f73efedc40db58b319a98ea2891a6328d2dce163554

  • memory/1524-147-0x00000000082F0000-0x00000000082F7000-memory.dmp
    Filesize

    28KB

  • memory/1524-134-0x0000000007D50000-0x0000000007D51000-memory.dmp
    Filesize

    4KB

  • memory/1524-146-0x0000000007D30000-0x0000000007D31000-memory.dmp
    Filesize

    4KB

  • memory/1524-145-0x0000000007B30000-0x0000000007B31000-memory.dmp
    Filesize

    4KB

  • memory/1524-128-0x0000000000000000-mapping.dmp
  • memory/1524-139-0x0000000007850000-0x0000000007D4E000-memory.dmp
    Filesize

    5.0MB

  • memory/1524-136-0x00000000078C0000-0x00000000078C1000-memory.dmp
    Filesize

    4KB

  • memory/1524-135-0x00000000078F0000-0x00000000078F1000-memory.dmp
    Filesize

    4KB

  • memory/1524-132-0x0000000000B40000-0x0000000000B41000-memory.dmp
    Filesize

    4KB

  • memory/2208-160-0x0000000000000000-mapping.dmp
  • memory/2960-130-0x00000000057B0000-0x00000000057B1000-memory.dmp
    Filesize

    4KB

  • memory/2960-127-0x0000000005770000-0x0000000005771000-memory.dmp
    Filesize

    4KB

  • memory/2960-125-0x0000000005C70000-0x0000000005C71000-memory.dmp
    Filesize

    4KB

  • memory/2960-137-0x0000000005A20000-0x0000000005A21000-memory.dmp
    Filesize

    4KB

  • memory/2960-138-0x0000000005660000-0x0000000005C66000-memory.dmp
    Filesize

    6.0MB

  • memory/2960-121-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

  • memory/2960-142-0x0000000007180000-0x0000000007181000-memory.dmp
    Filesize

    4KB

  • memory/2960-143-0x0000000007880000-0x0000000007881000-memory.dmp
    Filesize

    4KB

  • memory/2960-144-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
    Filesize

    4KB

  • memory/2960-122-0x000000000041607A-mapping.dmp
  • memory/2960-126-0x0000000005710000-0x0000000005711000-memory.dmp
    Filesize

    4KB

  • memory/3392-161-0x0000000000000000-mapping.dmp
  • memory/3936-119-0x0000000005590000-0x0000000005591000-memory.dmp
    Filesize

    4KB

  • memory/3936-117-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
    Filesize

    4KB

  • memory/3936-114-0x0000000000000000-mapping.dmp
  • memory/3936-120-0x0000000002DD0000-0x0000000002DD9000-memory.dmp
    Filesize

    36KB

  • memory/4004-148-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

  • memory/4004-149-0x000000000041639E-mapping.dmp
  • memory/4004-159-0x0000000006680000-0x0000000006681000-memory.dmp
    Filesize

    4KB

  • memory/4004-163-0x0000000005770000-0x0000000005C6E000-memory.dmp
    Filesize

    5.0MB