Analysis

  • max time kernel
    63s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    22-07-2021 13:02

General

  • Target

    d2792e1448fdf7a225b51b4688b855c9.exe

  • Size

    176KB

  • MD5

    d2792e1448fdf7a225b51b4688b855c9

  • SHA1

    5e00613e000595c45914848ef69b820208c19eba

  • SHA256

    02e9bbebcc372e37d18f0dfed9c2dc5e50a23b7305aa3527accedba48bbd8432

  • SHA512

    6de5d993a70604c26be7b2ea6b069ee17abf5df412a43bdc9812d7403925d383d12be07c35a712f6dfca79e43ecc362c3135cd8eb27a0ec690ca46394dcb9215

Malware Config

Extracted

Family

redline

Botnet

z0rm1on

C2

77.220.213.35:52349

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe
    "C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3560
    • C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe
      C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1120

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d2792e1448fdf7a225b51b4688b855c9.exe.log
    MD5

    7438b57da35c10c478469635b79e33e1

    SHA1

    5ffcbdfbfd800f67d6d9d6ee46de2eb13fcbb9a5

    SHA256

    b253c066d4a6604aaa5204b09c1edde92c410b0af351f3760891f5e56c867f70

    SHA512

    5887796f8ceb1c5ae790caff0020084df49ea8d613b78656a47dc9a569c5c86a9b16ec2ebe0d6f34c5e3001026385bb1282434cc3ffc7bda99427c154c04b45a

  • memory/1120-125-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
    Filesize

    4KB

  • memory/1120-131-0x0000000006340000-0x0000000006341000-memory.dmp
    Filesize

    4KB

  • memory/1120-126-0x0000000004E20000-0x0000000004E21000-memory.dmp
    Filesize

    4KB

  • memory/1120-128-0x0000000004E60000-0x0000000004E61000-memory.dmp
    Filesize

    4KB

  • memory/1120-120-0x0000000000417E06-mapping.dmp
  • memory/1120-134-0x0000000007470000-0x0000000007471000-memory.dmp
    Filesize

    4KB

  • memory/1120-124-0x0000000005380000-0x0000000005381000-memory.dmp
    Filesize

    4KB

  • memory/1120-133-0x0000000006510000-0x0000000006511000-memory.dmp
    Filesize

    4KB

  • memory/1120-135-0x0000000006860000-0x0000000006861000-memory.dmp
    Filesize

    4KB

  • memory/1120-132-0x0000000006A40000-0x0000000006A41000-memory.dmp
    Filesize

    4KB

  • memory/1120-119-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/1120-129-0x00000000050D0000-0x00000000050D1000-memory.dmp
    Filesize

    4KB

  • memory/1120-130-0x0000000004D70000-0x0000000005376000-memory.dmp
    Filesize

    6.0MB

  • memory/3560-116-0x0000000002290000-0x000000000229E000-memory.dmp
    Filesize

    56KB

  • memory/3560-118-0x0000000004860000-0x0000000004861000-memory.dmp
    Filesize

    4KB

  • memory/3560-114-0x0000000000010000-0x0000000000011000-memory.dmp
    Filesize

    4KB

  • memory/3560-117-0x00000000048E0000-0x00000000048E1000-memory.dmp
    Filesize

    4KB

  • memory/3560-127-0x00000000048D0000-0x00000000048D1000-memory.dmp
    Filesize

    4KB