Analysis
-
max time kernel
110s -
max time network
119s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
24-10-2021 16:23
Static task
static1
Behavioral task
behavioral1
Sample
tradecheat.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
tradecheat.exe
Resource
win10-en-20210920
General
-
Target
tradecheat.exe
-
Size
1.8MB
-
MD5
c7d14620434af78c9c97915ce1ad2f3e
-
SHA1
f68964448d84fea2cb727e1048f22531e6bacb06
-
SHA256
6c798312f1aa6826f5e1dcc49ae54d4011d0e28245b3e6be0803dfd4381c6acb
-
SHA512
7153ad04f977df8464007f26348d28b08a7de854e6640d39cc74212a730b5f4522eb0b209edbc420f83817d05f6748a19882dd113f559fee6ad1d964d58ba132
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4076-125-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral2/memory/4076-126-0x0000000000418D4A-mapping.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 14 IoCs
Processes:
tradecheat.exepid process 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
tradecheat.exedescription pid process target process PID 704 set thread context of 4076 704 tradecheat.exe tradecheat.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2656 704 WerFault.exe tradecheat.exe -
Suspicious behavior: EnumeratesProcesses 16 IoCs
Processes:
tradecheat.exeWerFault.exetradecheat.exepid process 704 tradecheat.exe 704 tradecheat.exe 704 tradecheat.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 2656 WerFault.exe 4076 tradecheat.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
tradecheat.exeWerFault.exetradecheat.exedescription pid process Token: SeDebugPrivilege 704 tradecheat.exe Token: SeRestorePrivilege 2656 WerFault.exe Token: SeBackupPrivilege 2656 WerFault.exe Token: SeDebugPrivilege 2656 WerFault.exe Token: SeDebugPrivilege 4076 tradecheat.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
tradecheat.exedescription pid process target process PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe PID 704 wrote to memory of 4076 704 tradecheat.exe tradecheat.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 704 -s 17682⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/704-115-0x0000000000C30000-0x0000000000C31000-memory.dmpFilesize
4KB
-
memory/704-117-0x0000000005920000-0x0000000005921000-memory.dmpFilesize
4KB
-
memory/704-118-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/704-119-0x0000000003120000-0x0000000003123000-memory.dmpFilesize
12KB
-
memory/704-123-0x00000000062F0000-0x000000000631F000-memory.dmpFilesize
188KB
-
memory/704-124-0x0000000007BB0000-0x0000000007BB1000-memory.dmpFilesize
4KB
-
memory/4076-125-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4076-126-0x0000000000418D4A-mapping.dmp
-
memory/4076-129-0x0000000005CD0000-0x0000000005CD1000-memory.dmpFilesize
4KB
-
memory/4076-130-0x0000000005710000-0x0000000005711000-memory.dmpFilesize
4KB
-
memory/4076-131-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/4076-132-0x0000000005770000-0x0000000005771000-memory.dmpFilesize
4KB
-
memory/4076-133-0x00000000057B0000-0x00000000057B1000-memory.dmpFilesize
4KB
-
memory/4076-134-0x00000000056C0000-0x0000000005CC6000-memory.dmpFilesize
6.0MB
-
memory/4076-136-0x0000000005AE0000-0x0000000005AE1000-memory.dmpFilesize
4KB
-
memory/4076-137-0x00000000065A0000-0x00000000065A1000-memory.dmpFilesize
4KB
-
memory/4076-138-0x00000000066C0000-0x00000000066C1000-memory.dmpFilesize
4KB
-
memory/4076-139-0x0000000006680000-0x0000000006681000-memory.dmpFilesize
4KB
-
memory/4076-140-0x0000000007E40000-0x0000000007E41000-memory.dmpFilesize
4KB
-
memory/4076-141-0x0000000008540000-0x0000000008541000-memory.dmpFilesize
4KB