Overview
overview
10Static
static
7Bird.exe
windows7_x64
10Bird.exe
windows10_x64
10Crystal.exe
windows7_x64
10Crystal.exe
windows10_x64
10Install.exe
windows7_x64
10Install.exe
windows10_x64
10Minecraft_v4.4.exe
windows7_x64
10Minecraft_v4.4.exe
windows10_x64
10NewHacks.exe
windows7_x64
10NewHacks.exe
windows10_x64
10Setup.exe
windows7_x64
10Setup.exe
windows10_x64
10Software p....5.exe
windows7_x64
10Software p....5.exe
windows10_x64
10file3.exe
windows7_x64
10file3.exe
windows10_x64
10forcenitro2.4.1.exe
windows7_x64
7forcenitro2.4.1.exe
windows10_x64
7nitro_gen.exe
windows7_x64
8nitro_gen.exe
windows10_x64
8Analysis
-
max time kernel
42s -
max time network
80s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-08-2021 12:52
Static task
static1
Behavioral task
behavioral1
Sample
Bird.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
Bird.exe
Resource
win10v20210410
Behavioral task
behavioral3
Sample
Crystal.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
Crystal.exe
Resource
win10v20210410
Behavioral task
behavioral5
Sample
Install.exe
Resource
win7v20210410
Behavioral task
behavioral6
Sample
Install.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Minecraft_v4.4.exe
Resource
win7v20210410
Behavioral task
behavioral8
Sample
Minecraft_v4.4.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
NewHacks.exe
Resource
win7v20210410
Behavioral task
behavioral10
Sample
NewHacks.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Setup.exe
Resource
win7v20210410
Behavioral task
behavioral12
Sample
Setup.exe
Resource
win10v20210410
Behavioral task
behavioral13
Sample
Software patch v2.0.5.exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
Software patch v2.0.5.exe
Resource
win10v20210410
Behavioral task
behavioral15
Sample
file3.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
file3.exe
Resource
win10v20210410
Behavioral task
behavioral17
Sample
forcenitro2.4.1.exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
forcenitro2.4.1.exe
Resource
win10v20210410
Behavioral task
behavioral19
Sample
nitro_gen.exe
Resource
win7v20210408
Behavioral task
behavioral20
Sample
nitro_gen.exe
Resource
win10v20210410
General
-
Target
Minecraft_v4.4.exe
-
Size
1.3MB
-
MD5
d60df4a3ea6bce524650ba94f6339e39
-
SHA1
4805dc2d49d362028d48af9142f1abbe313e78c6
-
SHA256
172b6209ca78d8006297f41fded71268689f8b9be88513673af4420c12176c75
-
SHA512
8991e4b8b7b7602c8a8c2ea69bcb537d8d9c176ff79d151a7337334366dd9c637fc057f541298e92194f5a3a346423dfb7eca0a3e0b941b3bde59232ab5dce67
Malware Config
Extracted
redline
boss8
109.248.201.150:63757
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral7/memory/1584-65-0x0000000000418E52-mapping.dmp family_redline behavioral7/memory/1584-64-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral7/memory/1584-66-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Minecraft_v4.4.exedescription pid process target process PID 1644 set thread context of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Minecraft_v4.4.exeMinecraft_v4.4.exepid process 1644 Minecraft_v4.4.exe 1584 Minecraft_v4.4.exe 1584 Minecraft_v4.4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Minecraft_v4.4.exeMinecraft_v4.4.exedescription pid process Token: SeDebugPrivilege 1644 Minecraft_v4.4.exe Token: SeDebugPrivilege 1584 Minecraft_v4.4.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
Minecraft_v4.4.exedescription pid process target process PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1564 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe PID 1644 wrote to memory of 1584 1644 Minecraft_v4.4.exe Minecraft_v4.4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.4.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.4.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1644 -
C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.4.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.4.exe"2⤵PID:1564
-
C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.4.exe"C:\Users\Admin\AppData\Local\Temp\Minecraft_v4.4.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1584
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-65-0x0000000000418E52-mapping.dmp
-
memory/1584-64-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1584-66-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/1584-68-0x00000000044F0000-0x00000000044F1000-memory.dmpFilesize
4KB
-
memory/1644-60-0x0000000000980000-0x0000000000981000-memory.dmpFilesize
4KB
-
memory/1644-62-0x0000000004350000-0x0000000004351000-memory.dmpFilesize
4KB
-
memory/1644-63-0x0000000000520000-0x000000000053C000-memory.dmpFilesize
112KB