Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
27-09-2021 01:16
General
-
Target
44966902c444fde8c6d270659686fc59490b1d75187035e29d670907be34bce0.exe
-
Size
533KB
-
MD5
1638a9c3e0f200e375dcd23402787a95
-
SHA1
d810179f4697fbf57b7921fc1a89ff9f94b690d9
-
SHA256
44966902c444fde8c6d270659686fc59490b1d75187035e29d670907be34bce0
-
SHA512
5b118aaf0420c9a6dcd845292323c0cf827c579adacabc2fb8e6bb2c02d0e2c4ab2848a575fecf49b6d2579ca5f1b76a9b4ea7d7650aaafc7be81e151fb963ad
Malware Config
Extracted
redline
mix27.09
185.215.113.15:6043
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
suricata: ET MALWARE AutoHotkey Downloader Checkin via IPLogger
-
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44966902c444fde8c6d270659686fc59490b1d75187035e29d670907be34bce0.exe"C:\Users\Admin\AppData\Local\Temp\44966902c444fde8c6d270659686fc59490b1d75187035e29d670907be34bce0.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\sliders\monns.exemonns.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
ce2bd0911924c298be0799f15966273f
SHA1bec19040da85705c3cb3e575ac9d208b7db77f0b
SHA25620e626df36ba8f81f3b26dcb07dff7a86e75e0a20e3157d29e9d0e155732eac5
SHA512ce68bf6cec3453cb3b6ae3e6f5e4b090a91c9b305fd9445c6679dc80837912d9eb81917577e2effbf284d0d007310ebd010facb48b34e6cafe073f117f401a50
-
MD5
ce2bd0911924c298be0799f15966273f
SHA1bec19040da85705c3cb3e575ac9d208b7db77f0b
SHA25620e626df36ba8f81f3b26dcb07dff7a86e75e0a20e3157d29e9d0e155732eac5
SHA512ce68bf6cec3453cb3b6ae3e6f5e4b090a91c9b305fd9445c6679dc80837912d9eb81917577e2effbf284d0d007310ebd010facb48b34e6cafe073f117f401a50
-
Filesize
1.0MB
-
Filesize
828KB
-
Filesize
780KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
120KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
192KB
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
124KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB