Analysis
- max time kernel
15s - max time network
125s - platform
windows10_x64 - resource
win10v20210410 - submitted
09/08/2021, 11:32
General
- Target 4560e56b3ca6bafd278a64d67efad9fe.exe
- Size 153KB
- Sample210809-ecwbd5j9lx
- SHA256 cd602bd9a09c703688d407da30d330b710d405aa3391c7f06202378178c6e364
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
suricata: ET MALWARE Observed Elysium Stealer Variant CnC Domain (all-brain-company .xyz in TLS SNI)
- Executes dropped EXE 5 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of WriteProcessMemory 14 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4560e56b3ca6bafd278a64d67efad9fe.exe"C:\Users\Admin\AppData\Local\Temp\4560e56b3ca6bafd278a64d67efad9fe.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\7486557.exe"C:\Users\Admin\AppData\Roaming\7486557.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1856 -s 17603⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Roaming\1911871.exe"C:\Users\Admin\AppData\Roaming\1911871.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"C:\Users\Admin\AppData\Roaming\WinHost\WinHoster.exe"3⤵
- Executes dropped EXE
-
-
-
C:\Users\Admin\AppData\Roaming\3639543.exe"C:\Users\Admin\AppData\Roaming\3639543.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\7181209.exe"C:\Users\Admin\AppData\Roaming\7181209.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2788 -s 21323⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1856-123-0x0000000000FD0000-0x0000000000FD1000-memory.dmp
memory/1856-141-0x0000000001810000-0x0000000001812000-memory.dmp
memory/1856-127-0x00000000017F0000-0x00000000017F1000-memory.dmp
memory/1856-137-0x0000000001800000-0x0000000001801000-memory.dmp
memory/1856-131-0x0000000001820000-0x0000000001851000-memory.dmp
memory/2064-145-0x00000000081E0000-0x00000000081E1000-memory.dmp
memory/2064-134-0x0000000000F50000-0x0000000000F51000-memory.dmp
memory/2064-147-0x0000000007CE0000-0x0000000007CE1000-memory.dmp
memory/2064-142-0x0000000003090000-0x0000000003097000-memory.dmp
memory/2556-177-0x000000000FAE0000-0x000000000FAE1000-memory.dmp
memory/2556-180-0x000000000FBA0000-0x000000000FBA1000-memory.dmp
memory/2556-174-0x000000000F4C0000-0x000000000F4C1000-memory.dmp
memory/2556-144-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/2556-164-0x0000000005020000-0x0000000005021000-memory.dmp
memory/2556-168-0x000000000E050000-0x000000000E051000-memory.dmp
memory/2556-175-0x000000000FBC0000-0x000000000FBC1000-memory.dmp
memory/2556-148-0x0000000001090000-0x0000000001091000-memory.dmp
memory/2556-149-0x000000000A6C0000-0x000000000A6F8000-memory.dmp
memory/2556-150-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/2556-151-0x000000000E420000-0x000000000E421000-memory.dmp
memory/2556-152-0x0000000001020000-0x0000000001021000-memory.dmp
memory/2556-154-0x000000000DE60000-0x000000000DE61000-memory.dmp
memory/2556-162-0x000000000DEA0000-0x000000000DEA1000-memory.dmp
memory/2788-143-0x0000000002B20000-0x0000000002B21000-memory.dmp
memory/2788-170-0x0000000005470000-0x0000000005471000-memory.dmp
memory/2788-157-0x000000000A760000-0x000000000A7A4000-memory.dmp
memory/2788-160-0x0000000005190000-0x0000000005191000-memory.dmp
memory/2788-165-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/2788-138-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/2788-173-0x0000000005B20000-0x0000000005B21000-memory.dmp
memory/3540-116-0x0000000001570000-0x0000000001571000-memory.dmp
memory/3540-114-0x0000000000F60000-0x0000000000F61000-memory.dmp
memory/3540-118-0x00000000015A0000-0x00000000015A1000-memory.dmp
memory/3540-119-0x000000001BB10000-0x000000001BB12000-memory.dmp
memory/3540-117-0x0000000001580000-0x000000000159B000-memory.dmp
memory/3644-169-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/3644-167-0x0000000007E10000-0x0000000007E11000-memory.dmp