Analysis
-
max time kernel
144s -
max time network
147s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
26-09-2021 23:45
Static task
static1
General
-
Target
debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe
-
Size
533KB
-
MD5
cd8f55a49dacba214619db527fe442d8
-
SHA1
91d3f5ceaf2d5e095c10d12400d9b358d1bea6fa
-
SHA256
debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b
-
SHA512
43bc0e90b161274617a76dc069767e349bec4a5f82e85440e38ab5435a9d8239234eda04246a6c3fafe259ce89687aa7b734de26e9b17a1804d7c042b9ed485f
Malware Config
Extracted
redline
mix27.09
185.215.113.15:6043
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2664-120-0x0000000002180000-0x000000000219F000-memory.dmp family_redline behavioral1/memory/2664-122-0x00000000024C0000-0x00000000024DE000-memory.dmp family_redline -
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
Processes:
monns.exepid process 2664 monns.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
monns.exepid process 2664 monns.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
monns.exedescription pid process Token: SeDebugPrivilege 2664 monns.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exedescription pid process target process PID 2384 wrote to memory of 2664 2384 debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe monns.exe PID 2384 wrote to memory of 2664 2384 debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe monns.exe PID 2384 wrote to memory of 2664 2384 debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe monns.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe"C:\Users\Admin\AppData\Local\Temp\debef8d793bc0e68b0aac6c85dfc336590c344f9e2f9b1ac234476271e28496b.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
PID:2384 -
C:\Users\Admin\AppData\Roaming\sliders\monns.exemonns.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\sliders\monns.exeMD5
ce2bd0911924c298be0799f15966273f
SHA1bec19040da85705c3cb3e575ac9d208b7db77f0b
SHA25620e626df36ba8f81f3b26dcb07dff7a86e75e0a20e3157d29e9d0e155732eac5
SHA512ce68bf6cec3453cb3b6ae3e6f5e4b090a91c9b305fd9445c6679dc80837912d9eb81917577e2effbf284d0d007310ebd010facb48b34e6cafe073f117f401a50
-
C:\Users\Admin\AppData\Roaming\sliders\monns.exeMD5
ce2bd0911924c298be0799f15966273f
SHA1bec19040da85705c3cb3e575ac9d208b7db77f0b
SHA25620e626df36ba8f81f3b26dcb07dff7a86e75e0a20e3157d29e9d0e155732eac5
SHA512ce68bf6cec3453cb3b6ae3e6f5e4b090a91c9b305fd9445c6679dc80837912d9eb81917577e2effbf284d0d007310ebd010facb48b34e6cafe073f117f401a50
-
memory/2384-116-0x0000000000400000-0x000000000050C000-memory.dmpFilesize
1.0MB
-
memory/2384-115-0x00000000022D0000-0x000000000239F000-memory.dmpFilesize
828KB
-
memory/2664-127-0x0000000000600000-0x000000000074A000-memory.dmpFilesize
1.3MB
-
memory/2664-130-0x00000000024F2000-0x00000000024F3000-memory.dmpFilesize
4KB
-
memory/2664-121-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/2664-122-0x00000000024C0000-0x00000000024DE000-memory.dmpFilesize
120KB
-
memory/2664-123-0x0000000004FC0000-0x0000000004FC1000-memory.dmpFilesize
4KB
-
memory/2664-124-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/2664-125-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/2664-126-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/2664-117-0x0000000000000000-mapping.dmp
-
memory/2664-131-0x00000000024F3000-0x00000000024F4000-memory.dmpFilesize
4KB
-
memory/2664-132-0x00000000024F4000-0x00000000024F6000-memory.dmpFilesize
8KB
-
memory/2664-120-0x0000000002180000-0x000000000219F000-memory.dmpFilesize
124KB
-
memory/2664-129-0x00000000024F0000-0x00000000024F1000-memory.dmpFilesize
4KB
-
memory/2664-128-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2664-133-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/2664-134-0x00000000069A0000-0x00000000069A1000-memory.dmpFilesize
4KB
-
memory/2664-135-0x0000000006B70000-0x0000000006B71000-memory.dmpFilesize
4KB
-
memory/2664-136-0x0000000007190000-0x0000000007191000-memory.dmpFilesize
4KB
-
memory/2664-137-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/2664-138-0x00000000075E0000-0x00000000075E1000-memory.dmpFilesize
4KB
-
memory/2664-139-0x00000000076C0000-0x00000000076C1000-memory.dmpFilesize
4KB