Resubmissions
14-07-2021 20:31
210714-qghj6e8wb6 1014-07-2021 11:13
210714-dntethcvhj 1014-07-2021 10:51
210714-zmcee6clxe 1014-07-2021 10:13
210714-xhkjp515fn 10Analysis
-
max time kernel
31s -
max time network
124s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
14-07-2021 20:31
Static task
static1
Behavioral task
behavioral1
Sample
Minecraft_ver3.1.exe
Resource
win7v20210410
General
-
Target
Minecraft_ver3.1.exe
-
Size
238KB
-
MD5
ee8eaf19a7dc7566de81f80704649d3b
-
SHA1
89075ec02747fd84f36f532244e77ee105893b92
-
SHA256
0c482db22cf1dc6dbc6ee7b678f98275db291fedfe42c4c0413141e00143a882
-
SHA512
bceaa7ba6e4133a12771f2487955091e9a507b53688df819d91cbaf5fa3968401a9c84f79c080dbbba7b3359706ae86d6f29badf9536c4d2af258d61a4c1ae1c
Malware Config
Extracted
redline
ytmaloy3
46.8.19.196:53773
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3924-122-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral2/memory/3924-123-0x0000000000417E9E-mapping.dmp family_redline -
Processes:
resource yara_rule behavioral2/memory/3924-122-0x0000000000400000-0x000000000041E000-memory.dmp malwarecrypter behavioral2/memory/3924-123-0x0000000000417E9E-mapping.dmp malwarecrypter -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/4428-121-0x00000000052D0000-0x00000000052D6000-memory.dmp agile_net -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Minecraft_ver3.1.exedescription pid process target process PID 4428 set thread context of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Minecraft_ver3.1.exepid process 3924 Minecraft_ver3.1.exe 3924 Minecraft_ver3.1.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Minecraft_ver3.1.exeMinecraft_ver3.1.exedescription pid process Token: SeDebugPrivilege 4428 Minecraft_ver3.1.exe Token: SeDebugPrivilege 3924 Minecraft_ver3.1.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Minecraft_ver3.1.exedescription pid process target process PID 4428 wrote to memory of 3076 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3076 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3076 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe PID 4428 wrote to memory of 3924 4428 Minecraft_ver3.1.exe Minecraft_ver3.1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft_ver3.1.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft_ver3.1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Minecraft_ver3.1.exeC:\Users\Admin\AppData\Local\Temp\Minecraft_ver3.1.exe2⤵
-
C:\Users\Admin\AppData\Local\Temp\Minecraft_ver3.1.exeC:\Users\Admin\AppData\Local\Temp\Minecraft_ver3.1.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Minecraft_ver3.1.exe.logMD5
db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
memory/3924-129-0x0000000005350000-0x0000000005351000-memory.dmpFilesize
4KB
-
memory/3924-130-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/3924-127-0x0000000005860000-0x0000000005861000-memory.dmpFilesize
4KB
-
memory/3924-128-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/3924-134-0x0000000006F70000-0x0000000006F71000-memory.dmpFilesize
4KB
-
memory/3924-133-0x0000000006870000-0x0000000006871000-memory.dmpFilesize
4KB
-
memory/3924-122-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/3924-123-0x0000000000417E9E-mapping.dmp
-
memory/3924-135-0x0000000006A40000-0x0000000006A41000-memory.dmpFilesize
4KB
-
memory/3924-132-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/3924-131-0x0000000005250000-0x0000000005856000-memory.dmpFilesize
6.0MB
-
memory/4428-121-0x00000000052D0000-0x00000000052D6000-memory.dmpFilesize
24KB
-
memory/4428-114-0x0000000000900000-0x0000000000901000-memory.dmpFilesize
4KB
-
memory/4428-119-0x00000000052F0000-0x00000000052F1000-memory.dmpFilesize
4KB
-
memory/4428-118-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/4428-117-0x00000000056D0000-0x00000000056D1000-memory.dmpFilesize
4KB
-
memory/4428-120-0x0000000005290000-0x0000000005291000-memory.dmpFilesize
4KB
-
memory/4428-116-0x00000000051C0000-0x00000000051C1000-memory.dmpFilesize
4KB