Analysis
- max time kernel
115s - max time network
119s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
29/09/2021, 14:22
General
- Target 7e27bd30e64157535afe9910078ec791.exe
- Size 31KB
- Sample210929-rpkg8sfccq
- SHA256 e5e0601b8269cf5ffd12af1b005d913fd5d70235841daf3017a9cbb5da483dce
Malware Config
Extracted
-
redline
-
vatos_admin4
-
193.163.113.105:26203
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Windows security bypass 2 TTPs
- Nirsoft 3 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 10 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Drops file in Windows directory 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 32 IoCs
- Suspicious use of AdjustPrivilegeToken 11 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe"C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe"1⤵
- Windows security modification
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54de1c16-8528-484a-9c4a-14a02792cbfb\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\54de1c16-8528-484a-9c4a-14a02792cbfb\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\54de1c16-8528-484a-9c4a-14a02792cbfb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\54de1c16-8528-484a-9c4a-14a02792cbfb\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\54de1c16-8528-484a-9c4a-14a02792cbfb\AdvancedRun.exe" /SpecialRun 4101d8 26923⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe"C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe"C:\Users\Admin\AppData\Local\Temp\7e27bd30e64157535afe9910078ec791.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 22522⤵
- Drops file in Windows directory
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/424-390-0x00000000069A0000-0x00000000069A1000-memory.dmp
memory/424-387-0x0000000006DB0000-0x0000000006DB1000-memory.dmp
memory/424-386-0x00000000066B0000-0x00000000066B1000-memory.dmp
memory/424-391-0x0000000006980000-0x0000000006981000-memory.dmp
memory/424-393-0x0000000007930000-0x0000000007931000-memory.dmp
memory/424-149-0x0000000004C10000-0x0000000005216000-memory.dmp
memory/424-135-0x0000000005220000-0x0000000005221000-memory.dmp
memory/424-146-0x0000000004CA0000-0x0000000004CA1000-memory.dmp
memory/424-129-0x0000000000400000-0x0000000000422000-memory.dmp
memory/424-138-0x0000000004D70000-0x0000000004D71000-memory.dmp
memory/424-136-0x0000000004C40000-0x0000000004C41000-memory.dmp
memory/2004-140-0x0000000004700000-0x0000000004701000-memory.dmp
memory/2004-240-0x0000000004703000-0x0000000004704000-memory.dmp
memory/2004-137-0x0000000007780000-0x0000000007781000-memory.dmp
memory/2004-132-0x0000000007120000-0x0000000007121000-memory.dmp
memory/2004-139-0x0000000007070000-0x0000000007071000-memory.dmp
memory/2004-371-0x0000000009340000-0x0000000009341000-memory.dmp
memory/2004-142-0x0000000007990000-0x0000000007991000-memory.dmp
memory/2004-141-0x0000000004702000-0x0000000004703000-memory.dmp
memory/2004-143-0x0000000007A00000-0x0000000007A01000-memory.dmp
memory/2004-144-0x0000000007DF0000-0x0000000007DF1000-memory.dmp
memory/2004-145-0x0000000007E10000-0x0000000007E11000-memory.dmp
memory/2004-148-0x0000000008130000-0x0000000008131000-memory.dmp
memory/2004-365-0x0000000009350000-0x0000000009351000-memory.dmp
memory/2004-157-0x0000000008E80000-0x0000000008EB3000-memory.dmp
memory/2004-164-0x0000000008E60000-0x0000000008E61000-memory.dmp
memory/2004-169-0x0000000009030000-0x0000000009031000-memory.dmp
memory/2004-170-0x000000007F880000-0x000000007F881000-memory.dmp
memory/2004-171-0x00000000093C0000-0x00000000093C1000-memory.dmp
memory/2004-130-0x00000000045C0000-0x00000000045C1000-memory.dmp
memory/2116-115-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/2116-120-0x00000000062D0000-0x00000000062D1000-memory.dmp
memory/2116-119-0x0000000005C90000-0x0000000005D04000-memory.dmp
memory/2116-118-0x0000000005D30000-0x0000000005D31000-memory.dmp
memory/2116-117-0x00000000050D0000-0x00000000050D1000-memory.dmp