Analysis
- max time kernel
37s - max time network
113s - platform
windows10_x64 - resource
win10v20210408 - submitted
22/07/2021, 12:17
General
- Target d2792e1448fdf7a225b51b4688b855c9.exe
- Size 176KB
- Sample210722-tnelct4ky2
- SHA256 02e9bbebcc372e37d18f0dfed9c2dc5e50a23b7305aa3527accedba48bbd8432
Malware Config
Extracted
-
redline
-
z0rm1on
-
77.220.213.35:52349
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe"C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exeC:\Users\Admin\AppData\Local\Temp\d2792e1448fdf7a225b51b4688b855c9.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/656-116-0x0000000002AC0000-0x0000000002AC1000-memory.dmp
memory/656-117-0x0000000001270000-0x000000000127E000-memory.dmp
memory/656-118-0x0000000005220000-0x0000000005221000-memory.dmp
memory/656-119-0x0000000002AA0000-0x0000000002AA1000-memory.dmp
memory/656-114-0x00000000008C0000-0x00000000008C1000-memory.dmp
memory/3168-125-0x0000000005320000-0x0000000005321000-memory.dmp
memory/3168-120-0x0000000000400000-0x000000000041E000-memory.dmp
memory/3168-126-0x0000000004D10000-0x0000000004D11000-memory.dmp
memory/3168-127-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/3168-128-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/3168-129-0x0000000004D10000-0x0000000005316000-memory.dmp
memory/3168-130-0x0000000005020000-0x0000000005021000-memory.dmp
memory/3168-131-0x00000000062C0000-0x00000000062C1000-memory.dmp
memory/3168-132-0x00000000069C0000-0x00000000069C1000-memory.dmp
memory/3168-133-0x0000000006490000-0x0000000006491000-memory.dmp
memory/3168-134-0x00000000073F0000-0x00000000073F1000-memory.dmp
memory/3168-135-0x0000000006820000-0x0000000006821000-memory.dmp