Analysis
- max time kernel
115s - max time network
119s - platform
windows10_x64 - resource
win10v20210410 - submitted
26/05/2021, 16:59
General
- Target 47b7a984658530083d914253649f86c6.exe
- Size 708KB
- Sample210526-apy7exla3x
- SHA256 faa254ca57ec7188939dc6b75b65b9e018d3152c5adb2953daaea28fd4044b69
Malware Config
Extracted
-
redline
-
MIX 25.05
-
xisolenoy.xyz:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\47b7a984658530083d914253649f86c6.exe"C:\Users\Admin\AppData\Local\Temp\47b7a984658530083d914253649f86c6.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exeedspolishpp.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3060-124-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/3060-127-0x0000000005600000-0x0000000005601000-memory.dmp
memory/3060-136-0x0000000006D30000-0x0000000006D31000-memory.dmp
memory/3060-119-0x0000000000520000-0x00000000005CE000-memory.dmp
memory/3060-120-0x0000000000400000-0x000000000046D000-memory.dmp
memory/3060-121-0x0000000002160000-0x0000000002179000-memory.dmp
memory/3060-122-0x0000000004AF0000-0x0000000004AF1000-memory.dmp
memory/3060-123-0x0000000002590000-0x00000000025A7000-memory.dmp
memory/3060-135-0x0000000006720000-0x0000000006721000-memory.dmp
memory/3060-125-0x0000000002730000-0x0000000002731000-memory.dmp
memory/3060-126-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3060-128-0x0000000005790000-0x0000000005791000-memory.dmp
memory/3060-130-0x00000000022D2000-0x00000000022D3000-memory.dmp
memory/3060-129-0x00000000022D0000-0x00000000022D1000-memory.dmp
memory/3060-131-0x00000000022D3000-0x00000000022D4000-memory.dmp
memory/3060-132-0x00000000022D4000-0x00000000022D6000-memory.dmp
memory/3060-133-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
memory/3060-134-0x0000000006510000-0x0000000006511000-memory.dmp
memory/4048-114-0x00000000020E0000-0x00000000021AE000-memory.dmp
memory/4048-115-0x0000000000400000-0x00000000004D5000-memory.dmp