Overview

overview

10

Static

static

ad54fbfa5c...a7.exe

windows7_x64

10

ad54fbfa5c...a7.exe

windows10_x64

10

Analysis

  • max time kernel
    62s
  • max time network
    63s
  • platform
    windows7_x64
  • resource
    win7v20210408
  • submitted
    27-07-2021 14:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ad54fbfa5cd265112f67ea1b4d2e95a7.exe

  • Size

    739KB

  • MD5

    ad54fbfa5cd265112f67ea1b4d2e95a7

  • SHA1

    b92e996cffa1ad3b6e6a0c439f1bf21c72ccce51

  • SHA256

    57430cbbfebdef7c54698b00102dbd2098aef53ba4bd5fa43660c2e306f53482

  • SHA512

    d4a4fc1b25f2f51f5ce6d40dc7277ee51af5004630449595348406663892ed4f2849bd3417b3e484ff409263083833a8c2c00d6758549bd92a901956a48afaf6

Score
10/10
redline@mrhaluyeppdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

@MrHaluyepp

C2

185.80.234.77:17105

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe
    "C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe
      "{path}"
      2⤵
        PID:1532
      • C:\Users\Admin\AppData\Local\Temp\ad54fbfa5cd265112f67ea1b4d2e95a7.exe
        "{path}"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1492

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    2
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/940-59-0x0000000000830000-0x0000000000831000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-61-0x0000000004DE0000-0x0000000004DE1000-memory.dmp
      Filesize

      4KB

      Download
    • memory/940-62-0x00000000003A0000-0x00000000003A2000-memory.dmp
      Filesize

      8KB

      Download
    • memory/940-63-0x0000000005CF0000-0x0000000005D63000-memory.dmp
      Filesize

      460KB

      Download
    • memory/940-64-0x0000000000670000-0x000000000069A000-memory.dmp
      Filesize

      168KB

      Download
    • memory/1492-65-0x0000000000400000-0x0000000000422000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1492-66-0x0000000000418896-mapping.dmp
      Download
    • memory/1492-67-0x0000000000400000-0x0000000000422000-memory.dmp
      Filesize

      136KB

      Download
    • memory/1492-69-0x0000000004340000-0x0000000004341000-memory.dmp
      Filesize

      4KB

      Download