Analysis
- max time kernel
146s - max time network
186s - platform
windows7_x64 - resource
win7v20210408 - submitted
03/06/2021, 22:03
General
- Target SecuriteInfo.com.Trojan.Win32.Save.a.6900.14762.exe
- Size 150KB
- Sample210603-e7paf64x3a
- SHA256 445d39df326616cbfd206707370348697ee1ad8ffb5ce1edc330afe9bf49266e
Malware Config
Extracted
-
redline
-
1
-
brershrowal.xyz:80
Extracted
-
redline
-
1.1
-
brershrowal.xyz:80
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 6 IoCs
- CustAttr .NET packer 1 IoCs
Detects CustAttr .NET packer in memory.
- Executes dropped EXE 9 IoCs
- Loads dropped DLL 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 2 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Modifies system certificate store 2 TTPs 4 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 6 IoCs
- Suspicious use of WriteProcessMemory 46 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.6900.14762.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.Win32.Save.a.6900.14762.exe"1⤵
- Modifies system certificate store
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\6976403.exe"C:\Users\Admin\AppData\Roaming\6976403.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\4498257.exe"C:\Users\Admin\AppData\Roaming\4498257.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\7907844.exe"C:\Users\Admin\AppData\Roaming\7907844.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\7907844.exe"C:\Users\Admin\AppData\Roaming\7907844.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\3370263.exe"C:\Users\Admin\AppData\Roaming\3370263.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\3370263.exe"{path}"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\3370263.exe"{path}"3⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Roaming\3370263.exe"{path}"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/296-103-0x0000000004B00000-0x0000000004B01000-memory.dmp
memory/296-94-0x00000000013A0000-0x00000000013A1000-memory.dmp
memory/892-70-0x0000000001030000-0x0000000001031000-memory.dmp
memory/892-81-0x0000000000390000-0x00000000003B0000-memory.dmp
memory/892-84-0x00000000004C0000-0x00000000004C1000-memory.dmp
memory/892-82-0x0000000000400000-0x0000000000401000-memory.dmp
memory/892-73-0x0000000000380000-0x0000000000381000-memory.dmp
memory/1104-80-0x0000000000310000-0x000000000031E000-memory.dmp
memory/1104-69-0x0000000000A30000-0x0000000000A31000-memory.dmp
memory/1104-74-0x00000000002A0000-0x00000000002A1000-memory.dmp
memory/1104-83-0x0000000000460000-0x0000000000461000-memory.dmp
memory/1164-123-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1164-125-0x0000000000300000-0x0000000000301000-memory.dmp
memory/1164-120-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1588-116-0x0000000004E60000-0x0000000004E61000-memory.dmp
memory/1588-114-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1588-111-0x0000000000400000-0x000000000041C000-memory.dmp
memory/1744-105-0x0000000000380000-0x0000000000382000-memory.dmp
memory/1744-107-0x00000000051B0000-0x000000000521C000-memory.dmp
memory/1744-108-0x0000000000D40000-0x0000000000D5E000-memory.dmp
memory/1744-101-0x00000000002D0000-0x00000000002D1000-memory.dmp
memory/1744-88-0x0000000000120000-0x0000000000121000-memory.dmp
memory/1744-106-0x0000000000AE0000-0x0000000000B25000-memory.dmp
memory/1744-100-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/1940-61-0x0000000000280000-0x000000000029B000-memory.dmp
memory/1940-62-0x000000001B010000-0x000000001B012000-memory.dmp
memory/1940-59-0x00000000000F0000-0x00000000000F1000-memory.dmp
memory/1948-99-0x00000000011A0000-0x00000000011A1000-memory.dmp
memory/1948-118-0x0000000005650000-0x00000000056E9000-memory.dmp
memory/1948-119-0x0000000001140000-0x0000000001195000-memory.dmp
memory/1948-117-0x00000000052A0000-0x0000000005334000-memory.dmp
memory/1948-78-0x0000000001240000-0x0000000001241000-memory.dmp
memory/1948-102-0x0000000000280000-0x0000000000281000-memory.dmp
memory/1948-104-0x00000000003C0000-0x00000000003C5000-memory.dmp