Analysis
- max time kernel
48s - max time network
118s - platform
windows10_x64 - resource
win10v20210408 - submitted
27/07/2021, 13:21
General
- Target ad54fbfa5cd265112f67ea1b4d2e95a7.exe
- Size 739KB
- Sample210727-58znhm85d2
- SHA256 57430cbbfebdef7c54698b00102dbd2098aef53ba4bd5fa43660c2e306f53482
Malware Config
Extracted
-
redline
-
@MrHaluyepp
-
185.80.234.77:17105
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe"C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1000-114-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/1000-116-0x0000000005C00000-0x0000000005C01000-memory.dmp
memory/1000-117-0x0000000005700000-0x0000000005701000-memory.dmp
memory/1000-118-0x00000000056D0000-0x00000000056D1000-memory.dmp
memory/1000-119-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/1000-120-0x0000000005890000-0x0000000005892000-memory.dmp
memory/1000-121-0x0000000008D70000-0x0000000008D71000-memory.dmp
memory/1000-122-0x00000000077B0000-0x0000000007823000-memory.dmp
memory/1000-123-0x00000000076F0000-0x000000000771A000-memory.dmp
memory/3600-124-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3600-130-0x0000000006860000-0x0000000006861000-memory.dmp
memory/3600-132-0x00000000059B0000-0x00000000059B1000-memory.dmp
memory/3600-133-0x0000000005A40000-0x0000000005A41000-memory.dmp
memory/3600-134-0x00000000066F0000-0x00000000066F1000-memory.dmp
memory/3600-135-0x00000000080C0000-0x00000000080C1000-memory.dmp
memory/3600-136-0x0000000005850000-0x0000000005D4E000-memory.dmp
memory/3600-137-0x0000000008C10000-0x0000000008C11000-memory.dmp
memory/3600-138-0x0000000009310000-0x0000000009311000-memory.dmp
memory/3600-139-0x0000000008B60000-0x0000000008B61000-memory.dmp
memory/3600-140-0x0000000009060000-0x0000000009061000-memory.dmp
memory/3600-141-0x0000000009150000-0x0000000009151000-memory.dmp