Analysis
- max time kernel
138s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
13/11/2021, 19:14
General
- Target tradecheat.exe
- Size 324KB
- Sample211113-xxmv8afdd2
- SHA256 f5faced81151871dd7ecd897e8c41dccf60eeadc7598563baeba61c66a743e4a
Malware Config
Extracted
-
redline
-
81.91.178.86:21746
Extracted
-
redline
-
xxluchxx1
-
212.86.102.63:62907
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"C:\Users\Admin\AppData\Local\Temp\tradecheat.exe"1⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\asfasf.exe"C:\Users\Admin\AppData\Roaming\asfasf.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Roaming\Loger.exe"C:\Users\Admin\AppData\Roaming\Loger.exe"2⤵
- Executes dropped EXE
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3612 -s 9483⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2412-117-0x0000000002980000-0x0000000002982000-memory.dmp
memory/2412-118-0x000000001B6D0000-0x000000001B6D1000-memory.dmp
memory/2412-119-0x00000000029D0000-0x00000000029EA000-memory.dmp
memory/2412-120-0x000000001B4E0000-0x000000001B4E1000-memory.dmp
memory/2412-115-0x0000000000950000-0x0000000000951000-memory.dmp
memory/2412-135-0x000000001E0E0000-0x000000001E0E1000-memory.dmp
memory/3036-127-0x0000000000EC0000-0x0000000000ED8000-memory.dmp
memory/3036-134-0x0000000001070000-0x0000000001072000-memory.dmp
memory/3036-124-0x00000000006F0000-0x00000000006F1000-memory.dmp
memory/3036-136-0x0000000001030000-0x0000000001031000-memory.dmp
memory/3036-137-0x000000001B330000-0x000000001B331000-memory.dmp
memory/3036-142-0x000000001D7F0000-0x000000001D7F1000-memory.dmp
memory/3036-143-0x000000001DEF0000-0x000000001DEF1000-memory.dmp
memory/3612-132-0x0000020906710000-0x0000020906711000-memory.dmp
memory/3612-140-0x0000020920E60000-0x000002092114F000-memory.dmp
memory/3612-141-0x0000020920E50000-0x0000020920E52000-memory.dmp