Analysis

  • max time kernel
    65s
  • max time network
    152s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    26-09-2021 13:21

General

  • Target

    4b4caac9b37e2081b2b5e33de0214c226ef3ab957e7bee1255b81c34d59fea33.exe

  • Size

    250KB

  • MD5

    2e9226c77d8d80677d35a48bc1d5bf19

  • SHA1

    b8dc5fb61fd1bc2e599dba3f1b37249d271e896f

  • SHA256

    4b4caac9b37e2081b2b5e33de0214c226ef3ab957e7bee1255b81c34d59fea33

  • SHA512

    b0864787f90260be96c1a4a4f3bff0a5625fd17da9ae7af9c21485ec39b99c7357db145a093de56e8005d39a058ee8c0498b3fa891b441af6eaa25bbf3c1dfd7

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.20:13441

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4b4caac9b37e2081b2b5e33de0214c226ef3ab957e7bee1255b81c34d59fea33.exe
    "C:\Users\Admin\AppData\Local\Temp\4b4caac9b37e2081b2b5e33de0214c226ef3ab957e7bee1255b81c34d59fea33.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:644

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/644-114-0x0000000002240000-0x0000000002270000-memory.dmp
    Filesize

    192KB

  • memory/644-115-0x0000000000400000-0x00000000004C5000-memory.dmp
    Filesize

    788KB

  • memory/644-116-0x0000000002330000-0x000000000234F000-memory.dmp
    Filesize

    124KB

  • memory/644-117-0x0000000004CE0000-0x0000000004CE1000-memory.dmp
    Filesize

    4KB

  • memory/644-118-0x00000000025E0000-0x00000000025FE000-memory.dmp
    Filesize

    120KB

  • memory/644-119-0x00000000051E0000-0x00000000051E1000-memory.dmp
    Filesize

    4KB

  • memory/644-121-0x0000000002672000-0x0000000002673000-memory.dmp
    Filesize

    4KB

  • memory/644-120-0x0000000002670000-0x0000000002671000-memory.dmp
    Filesize

    4KB

  • memory/644-122-0x0000000002673000-0x0000000002674000-memory.dmp
    Filesize

    4KB

  • memory/644-123-0x00000000027A0000-0x00000000027A1000-memory.dmp
    Filesize

    4KB

  • memory/644-124-0x00000000057F0000-0x00000000057F1000-memory.dmp
    Filesize

    4KB

  • memory/644-125-0x00000000027D0000-0x00000000027D1000-memory.dmp
    Filesize

    4KB

  • memory/644-126-0x0000000002674000-0x0000000002676000-memory.dmp
    Filesize

    8KB

  • memory/644-127-0x0000000005900000-0x0000000005901000-memory.dmp
    Filesize

    4KB

  • memory/644-128-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
    Filesize

    4KB

  • memory/644-129-0x0000000006CB0000-0x0000000006CB1000-memory.dmp
    Filesize

    4KB

  • memory/644-130-0x00000000072D0000-0x00000000072D1000-memory.dmp
    Filesize

    4KB

  • memory/644-131-0x0000000007630000-0x0000000007631000-memory.dmp
    Filesize

    4KB

  • memory/644-132-0x00000000076B0000-0x00000000076B1000-memory.dmp
    Filesize

    4KB

  • memory/644-133-0x00000000078A0000-0x00000000078A1000-memory.dmp
    Filesize

    4KB