Analysis
-
max time kernel
73s -
max time network
120s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
10-08-2021 11:13
General
-
Target
onetap.exe
-
Size
400KB
-
MD5
7914f8165ade3f483e1f62dce8ec8828
-
SHA1
7ac59abb131d0644d0f0aa31cb99cf0a415deb9e
-
SHA256
e5b091808b73fbf1b94a24bb98d8ac945012ec6b69f0979371af225ecdb804df
-
SHA512
e3b4e163e9cbb2fb4719c09c2274af3e068f762d570b1d24093be411ef9b81ba91c10d92317a8af6a050bc4dd34a9a4bc67861ce00bff5e09383281e95163aa7
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
@tupa187
C2
37.1.213.214:63028
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
Executes dropped EXE 1 IoCs
-
Loads dropped DLL 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\onetap.exe"C:\Users\Admin\AppData\Local\Temp\onetap.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RegAsm.exeC:\Users\Admin\AppData\Local\Temp\RegAsm.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
-
Filesize
120KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
428KB
-
Filesize
292KB
-
Filesize
4KB
-
Filesize
4KB