Analysis
-
max time kernel
122s -
max time network
136s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
28-10-2021 16:15
Static task
static1
Behavioral task
behavioral1
Sample
cheatMINE.exe
Resource
win7-en-20210920
General
-
Target
cheatMINE.exe
-
Size
907KB
-
MD5
2133a0f1fc59fcaf01aeafbeb99a0dce
-
SHA1
356314122398c64d96915c40e6ca357538d8f4a2
-
SHA256
e273b33d875d2227fd607c82cc4313509eebf56e8d9101d3a3e64ca6ddd3028c
-
SHA512
baefab75ebc9650ca8b441ba1e0cf136f34242f6acf2e97924b2f42cc9daea83b8d54c7dc32c8bdbc21ea65ce9d17100bd77421fb41846f816155b3b700fd956
Malware Config
Extracted
redline
5IRJ6JMY
188.34.176.164:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4276-115-0x0000000000730000-0x000000000075E000-memory.dmp family_redline behavioral2/memory/4276-119-0x00000000008C0000-0x00000000008D9000-memory.dmp family_redline -
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
cheatMINE.exepid process 4276 cheatMINE.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cheatMINE.exedescription pid process Token: SeDebugPrivilege 4276 cheatMINE.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4276-115-0x0000000000730000-0x000000000075E000-memory.dmpFilesize
184KB
-
memory/4276-119-0x00000000008C0000-0x00000000008D9000-memory.dmpFilesize
100KB
-
memory/4276-121-0x00000000055D0000-0x00000000055D1000-memory.dmpFilesize
4KB
-
memory/4276-122-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/4276-123-0x00000000053D0000-0x00000000053D1000-memory.dmpFilesize
4KB
-
memory/4276-125-0x00000000055C2000-0x00000000055C3000-memory.dmpFilesize
4KB
-
memory/4276-124-0x00000000055C0000-0x00000000055C1000-memory.dmpFilesize
4KB
-
memory/4276-126-0x00000000055C3000-0x00000000055C4000-memory.dmpFilesize
4KB
-
memory/4276-127-0x00000000055C4000-0x00000000055C5000-memory.dmpFilesize
4KB
-
memory/4276-128-0x0000000002BD0000-0x0000000002BD1000-memory.dmpFilesize
4KB
-
memory/4276-129-0x0000000002C30000-0x0000000002C31000-memory.dmpFilesize
4KB
-
memory/4276-130-0x0000000006DE0000-0x0000000006DE1000-memory.dmpFilesize
4KB
-
memory/4276-131-0x0000000007320000-0x0000000007321000-memory.dmpFilesize
4KB
-
memory/4276-132-0x0000000007650000-0x0000000007651000-memory.dmpFilesize
4KB
-
memory/4276-133-0x00000000076F0000-0x00000000076F1000-memory.dmpFilesize
4KB
-
memory/4276-134-0x0000000007840000-0x0000000007841000-memory.dmpFilesize
4KB
-
memory/4276-135-0x0000000007D80000-0x0000000007D81000-memory.dmpFilesize
4KB
-
memory/4276-136-0x0000000007F50000-0x0000000007F51000-memory.dmpFilesize
4KB
-
memory/4276-137-0x00000000088D0000-0x00000000088D1000-memory.dmpFilesize
4KB