Analysis

  • max time kernel
    119s
  • max time network
    119s
  • platform
    windows7_x64
  • resource
    win7-en-20211014
  • submitted
    13-11-2021 01:44

General

  • Target

    280d8ac98717328877666b10a47bd686.exe

  • Size

    1.3MB

  • MD5

    280d8ac98717328877666b10a47bd686

  • SHA1

    8e02e4700f050797ba5529599d18cdada7e82198

  • SHA256

    88d819e97e573477222ae60022206e9d16fabeaa10385296f403adcb2edf1bac

  • SHA512

    a7ff352227ae52a7a95fc3b9d046e4efa8c416c4a9418170169e0a618891eeb16ddd3ba8966142d665f8c778c6720b868771162099bf57cc7117211452ead2ab

Malware Config

Extracted

Family

redline

Botnet

ppg

C2

86.107.197.248:56626

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 4 IoCs
  • Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\280d8ac98717328877666b10a47bd686.exe
    "C:\Users\Admin\AppData\Local\Temp\280d8ac98717328877666b10a47bd686.exe"
    1⤵
    • Checks BIOS information in registry
    • Checks whether UAC is enabled
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:740
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1612

Network

MITRE ATT&CK Matrix ATT&CK v6

Defense Evasion

Virtualization/Sandbox Evasion

1
T1497

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

2
T1012

Virtualization/Sandbox Evasion

1
T1497

System Information Discovery

2
T1082

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/740-55-0x0000000074A31000-0x0000000074A33000-memory.dmp
    Filesize

    8KB

  • memory/740-56-0x0000000000400000-0x00000000007AC000-memory.dmp
    Filesize

    3.7MB

  • memory/740-57-0x0000000000400000-0x00000000007AC000-memory.dmp
    Filesize

    3.7MB

  • memory/740-58-0x0000000000400000-0x00000000007AC000-memory.dmp
    Filesize

    3.7MB

  • memory/740-59-0x0000000000290000-0x00000000002F0000-memory.dmp
    Filesize

    384KB

  • memory/740-61-0x0000000002750000-0x0000000002751000-memory.dmp
    Filesize

    4KB

  • memory/740-62-0x0000000002700000-0x0000000002701000-memory.dmp
    Filesize

    4KB

  • memory/740-63-0x0000000002770000-0x0000000002771000-memory.dmp
    Filesize

    4KB

  • memory/740-60-0x0000000002740000-0x0000000002741000-memory.dmp
    Filesize

    4KB

  • memory/740-67-0x0000000002760000-0x0000000002761000-memory.dmp
    Filesize

    4KB

  • memory/740-66-0x0000000002790000-0x0000000002791000-memory.dmp
    Filesize

    4KB

  • memory/740-65-0x0000000002720000-0x0000000002721000-memory.dmp
    Filesize

    4KB

  • memory/740-64-0x0000000002730000-0x0000000002731000-memory.dmp
    Filesize

    4KB

  • memory/740-68-0x0000000003430000-0x0000000003431000-memory.dmp
    Filesize

    4KB

  • memory/740-69-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-71-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-73-0x0000000000BF0000-0x0000000000BF1000-memory.dmp
    Filesize

    4KB

  • memory/740-72-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-70-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-92-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-93-0x0000000000350000-0x0000000000351000-memory.dmp
    Filesize

    4KB

  • memory/740-94-0x00000000027F0000-0x00000000027F1000-memory.dmp
    Filesize

    4KB

  • memory/740-91-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-90-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-107-0x0000000000400000-0x00000000007AC000-memory.dmp
    Filesize

    3.7MB

  • memory/740-106-0x0000000000350000-0x0000000000351000-memory.dmp
    Filesize

    4KB

  • memory/740-108-0x0000000000400000-0x00000000007AC000-memory.dmp
    Filesize

    3.7MB

  • memory/740-105-0x0000000000350000-0x0000000000351000-memory.dmp
    Filesize

    4KB

  • memory/740-104-0x0000000002060000-0x0000000002061000-memory.dmp
    Filesize

    4KB

  • memory/740-103-0x0000000002830000-0x0000000002831000-memory.dmp
    Filesize

    4KB

  • memory/740-102-0x0000000000350000-0x0000000000351000-memory.dmp
    Filesize

    4KB

  • memory/740-101-0x0000000000350000-0x0000000000351000-memory.dmp
    Filesize

    4KB

  • memory/740-100-0x0000000002840000-0x0000000002841000-memory.dmp
    Filesize

    4KB

  • memory/740-99-0x00000000027D0000-0x00000000027D1000-memory.dmp
    Filesize

    4KB

  • memory/740-98-0x00000000027E0000-0x00000000027E1000-memory.dmp
    Filesize

    4KB

  • memory/740-97-0x0000000002820000-0x0000000002821000-memory.dmp
    Filesize

    4KB

  • memory/740-95-0x0000000002800000-0x0000000002801000-memory.dmp
    Filesize

    4KB

  • memory/740-96-0x00000000027B0000-0x00000000027B1000-memory.dmp
    Filesize

    4KB

  • memory/740-89-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-88-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-87-0x00000000026E0000-0x00000000026E1000-memory.dmp
    Filesize

    4KB

  • memory/740-86-0x0000000002280000-0x0000000002281000-memory.dmp
    Filesize

    4KB

  • memory/740-85-0x0000000002290000-0x0000000002291000-memory.dmp
    Filesize

    4KB

  • memory/740-84-0x00000000026C0000-0x00000000026C1000-memory.dmp
    Filesize

    4KB

  • memory/740-83-0x0000000002260000-0x0000000002261000-memory.dmp
    Filesize

    4KB

  • memory/740-82-0x00000000022B0000-0x00000000022B1000-memory.dmp
    Filesize

    4KB

  • memory/740-81-0x00000000022A0000-0x00000000022A1000-memory.dmp
    Filesize

    4KB

  • memory/740-80-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-79-0x0000000003420000-0x0000000003421000-memory.dmp
    Filesize

    4KB

  • memory/740-78-0x0000000002050000-0x0000000002051000-memory.dmp
    Filesize

    4KB

  • memory/740-77-0x0000000000C20000-0x0000000000C21000-memory.dmp
    Filesize

    4KB

  • memory/740-76-0x0000000000940000-0x0000000000941000-memory.dmp
    Filesize

    4KB

  • memory/740-75-0x0000000000360000-0x0000000000361000-memory.dmp
    Filesize

    4KB

  • memory/740-74-0x0000000000C00000-0x0000000000C01000-memory.dmp
    Filesize

    4KB

  • memory/1612-109-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1612-110-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1612-115-0x0000000000418EEE-mapping.dmp
  • memory/1612-116-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1612-117-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/1612-119-0x0000000000400000-0x0000000000401000-memory.dmp
    Filesize

    4KB

  • memory/1612-121-0x00000000004A0000-0x00000000004A1000-memory.dmp
    Filesize

    4KB