Analysis
- max time kernel
110s - max time network
120s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
12/11/2021, 18:41
General
- Target 44ad735bb80385db6f54e921733dbf48.exe
- Size 42KB
- Sample211112-xbrx2sbacl
- SHA256 0827673ccd2ea519b7dc5992a11beae4a429b2588be92e94e20e16ad132e086c
Malware Config
Extracted
-
redline
-
2
-
23.88.59.8:3453
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Turns off Windows Defender SpyNet reporting 2 TTPs
- UAC bypass 3 TTPs
- Windows security bypass 2 TTPs
- Nirsoft 3 IoCs
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Windows security modification 2 TTPs 10 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 2 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 8 IoCs
- Suspicious use of WriteProcessMemory 23 IoCs
- System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exe"C:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exe"1⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\527ef921-bba9-4574-993e-a7e9b9a047eb\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\527ef921-bba9-4574-993e-a7e9b9a047eb\AdvancedRun.exe" /EXEFilename "C:\Users\Admin\AppData\Local\Temp\527ef921-bba9-4574-993e-a7e9b9a047eb\test.bat" /WindowState ""0"" /PriorityClass ""32"" /CommandLine "" /StartDirectory "" /RunAs 8 /Run2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\527ef921-bba9-4574-993e-a7e9b9a047eb\AdvancedRun.exe"C:\Users\Admin\AppData\Local\Temp\527ef921-bba9-4574-993e-a7e9b9a047eb\AdvancedRun.exe" /SpecialRun 4101d8 33603⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exeC:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exeC:\Users\Admin\AppData\Local\Temp\44ad735bb80385db6f54e921733dbf48.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1308-137-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1308-157-0x0000000004F80000-0x0000000005586000-memory.dmp
memory/1308-156-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/1308-152-0x0000000005160000-0x0000000005161000-memory.dmp
memory/1308-149-0x0000000005030000-0x0000000005031000-memory.dmp
memory/1308-141-0x0000000005590000-0x0000000005591000-memory.dmp
memory/2732-143-0x0000000004E70000-0x0000000004E71000-memory.dmp
memory/2732-147-0x0000000004E72000-0x0000000004E73000-memory.dmp
memory/2732-179-0x0000000009620000-0x0000000009653000-memory.dmp
memory/2732-131-0x0000000003350000-0x0000000003351000-memory.dmp
memory/2732-132-0x0000000003350000-0x0000000003351000-memory.dmp
memory/2732-205-0x000000007E920000-0x000000007E921000-memory.dmp
memory/2732-165-0x0000000003350000-0x0000000003351000-memory.dmp
memory/2732-237-0x0000000004E73000-0x0000000004E74000-memory.dmp
memory/2968-133-0x00000000049D0000-0x00000000049D1000-memory.dmp
memory/2968-151-0x0000000007B80000-0x0000000007B81000-memory.dmp
memory/2968-142-0x00000000049C0000-0x00000000049C1000-memory.dmp
memory/2968-145-0x00000000049C2000-0x00000000049C3000-memory.dmp
memory/2968-135-0x0000000007470000-0x0000000007471000-memory.dmp
memory/2968-233-0x00000000049C3000-0x00000000049C4000-memory.dmp
memory/2968-148-0x0000000007B10000-0x0000000007B11000-memory.dmp
memory/2968-144-0x0000000007400000-0x0000000007401000-memory.dmp
memory/2968-154-0x0000000007DF0000-0x0000000007DF1000-memory.dmp
memory/2968-129-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/2968-206-0x000000007EA10000-0x000000007EA11000-memory.dmp
memory/2968-130-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/2968-158-0x0000000007C10000-0x0000000007C11000-memory.dmp
memory/2968-160-0x0000000008510000-0x0000000008511000-memory.dmp
memory/2968-163-0x0000000008560000-0x0000000008561000-memory.dmp
memory/2968-166-0x0000000000ED0000-0x0000000000ED1000-memory.dmp
memory/3460-118-0x00000000049E0000-0x00000000049E1000-memory.dmp
memory/3460-119-0x0000000004900000-0x0000000004DFE000-memory.dmp
memory/3460-120-0x0000000000AD0000-0x0000000000B62000-memory.dmp
memory/3460-121-0x0000000006AC0000-0x0000000006AC1000-memory.dmp
memory/3460-115-0x0000000000180000-0x0000000000181000-memory.dmp
memory/3460-117-0x0000000004E00000-0x0000000004E01000-memory.dmp