Analysis

  • max time kernel
    107s
  • max time network
    108s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    26-09-2021 20:57

General

  • Target

    71a395e91c86b4636cbdc5a962373294.exe

  • Size

    661KB

  • MD5

    71a395e91c86b4636cbdc5a962373294

  • SHA1

    33798cff60d6228d9194df5f60bfca5e6be11179

  • SHA256

    150708169937ab48a2299f0e19112fdb01efd0233b984d85b647d96d06391bc5

  • SHA512

    bf31795274e03a780c52cfa0214748cc12ce60462fcea295c739930111b818a6c1c904e50219d13cec86643eed7acf2b0b01493ac61add0806e952caaa4cb80f

Malware Config

Extracted

Family

redline

Botnet

Kanuckk

C2

205.185.123.105:20035

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71a395e91c86b4636cbdc5a962373294.exe
    "C:\Users\Admin\AppData\Local\Temp\71a395e91c86b4636cbdc5a962373294.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1096
    • C:\Users\Admin\AppData\Local\Temp\71a395e91c86b4636cbdc5a962373294.exe
      "C:\Users\Admin\AppData\Local\Temp\71a395e91c86b4636cbdc5a962373294.exe"
      2⤵
        PID:1092
      • C:\Users\Admin\AppData\Local\Temp\71a395e91c86b4636cbdc5a962373294.exe
        "C:\Users\Admin\AppData\Local\Temp\71a395e91c86b4636cbdc5a962373294.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1224
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 1096 -s 932
        2⤵
        • Program crash
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:4000

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/1096-124-0x0000000005160000-0x0000000005163000-memory.dmp

      Filesize

      12KB

    • memory/1096-115-0x0000000005590000-0x0000000005591000-memory.dmp

      Filesize

      4KB

    • memory/1096-116-0x0000000005090000-0x0000000005091000-memory.dmp

      Filesize

      4KB

    • memory/1096-117-0x00000000051D0000-0x00000000051D1000-memory.dmp

      Filesize

      4KB

    • memory/1096-118-0x0000000005060000-0x0000000005078000-memory.dmp

      Filesize

      96KB

    • memory/1096-119-0x0000000005090000-0x000000000558E000-memory.dmp

      Filesize

      5.0MB

    • memory/1096-114-0x0000000000790000-0x0000000000791000-memory.dmp

      Filesize

      4KB

    • memory/1224-126-0x0000000005020000-0x0000000005021000-memory.dmp

      Filesize

      4KB

    • memory/1224-130-0x00000000050F0000-0x00000000050F1000-memory.dmp

      Filesize

      4KB

    • memory/1224-125-0x0000000005590000-0x0000000005591000-memory.dmp

      Filesize

      4KB

    • memory/1224-120-0x0000000000400000-0x0000000000422000-memory.dmp

      Filesize

      136KB

    • memory/1224-127-0x0000000005150000-0x0000000005151000-memory.dmp

      Filesize

      4KB

    • memory/1224-128-0x0000000004F80000-0x0000000005586000-memory.dmp

      Filesize

      6.0MB

    • memory/1224-129-0x00000000050B0000-0x00000000050B1000-memory.dmp

      Filesize

      4KB

    • memory/1224-121-0x000000000041C5EA-mapping.dmp

    • memory/1224-131-0x0000000006A90000-0x0000000006A91000-memory.dmp

      Filesize

      4KB

    • memory/1224-132-0x0000000007190000-0x0000000007191000-memory.dmp

      Filesize

      4KB

    • memory/1224-133-0x0000000006C60000-0x0000000006C61000-memory.dmp

      Filesize

      4KB

    • memory/1224-136-0x0000000006D60000-0x0000000006D61000-memory.dmp

      Filesize

      4KB

    • memory/1224-137-0x0000000007060000-0x0000000007061000-memory.dmp

      Filesize

      4KB

    • memory/1224-138-0x00000000070E0000-0x00000000070E1000-memory.dmp

      Filesize

      4KB