Analysis

  • max time kernel
    152s
  • max time network
    156s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    26-08-2021 08:47

General

  • Target

    E2D959B36754B37727EF0C54B11EF3CF.exe

  • Size

    606KB

  • MD5

    e2d959b36754b37727ef0c54b11ef3cf

  • SHA1

    fffc93eec7deeda7d17ab729f89d4c5e01d781cf

  • SHA256

    b8e902d0a3a533b5a9f495f58c69692ae79917fbf9fa7829a9c52d4012e7a060

  • SHA512

    9a1b180bdba8fa4d0e4c8e9e3417653278d531811ac4cfe89ad988690e006bbb531824d4c1b5c94b07b1f7f98fa47d6b8a5c64a1be2818084e60e25c2b45c807

Malware Config

Extracted

Family

redline

Botnet

NANani

C2

87.251.71.14:89

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
    "C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:640
    • C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
      C:\Users\Admin\AppData\Local\Temp\E2D959B36754B37727EF0C54B11EF3CF.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3852

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/640-114-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
    Filesize

    4KB

  • memory/640-116-0x0000000005780000-0x0000000005781000-memory.dmp
    Filesize

    4KB

  • memory/640-117-0x0000000003180000-0x0000000003181000-memory.dmp
    Filesize

    4KB

  • memory/640-118-0x0000000005970000-0x0000000005971000-memory.dmp
    Filesize

    4KB

  • memory/640-119-0x0000000005E80000-0x0000000005E81000-memory.dmp
    Filesize

    4KB

  • memory/3852-120-0x0000000000400000-0x000000000041E000-memory.dmp
    Filesize

    120KB

  • memory/3852-121-0x0000000000418F6E-mapping.dmp
  • memory/3852-124-0x00000000056C0000-0x00000000056C1000-memory.dmp
    Filesize

    4KB

  • memory/3852-125-0x0000000005170000-0x0000000005171000-memory.dmp
    Filesize

    4KB

  • memory/3852-126-0x00000000051D0000-0x00000000051D1000-memory.dmp
    Filesize

    4KB

  • memory/3852-127-0x0000000005210000-0x0000000005211000-memory.dmp
    Filesize

    4KB

  • memory/3852-128-0x00000000050B0000-0x00000000056B6000-memory.dmp
    Filesize

    6.0MB

  • memory/3852-129-0x00000000054B0000-0x00000000054B1000-memory.dmp
    Filesize

    4KB