Analysis
- max time kernel
117s - max time network
117s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
17/11/2021, 17:29
General
- Target Euphoriah.exe
- Size 1.4MB
- Sample211117-v2kkjsaddm
- SHA256 daf995a3344ff3e6b10ccf2ca7145711277dddeff4eba00ecfe7fbad87bed2c7
Malware Config
Extracted
-
redline
-
185.223.92.157:7659
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Euphoriah.exe"C:\Users\Admin\AppData\Local\Temp\Euphoriah.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/964-55-0x0000000000290000-0x00000000002F0000-memory.dmp
memory/964-57-0x0000000002760000-0x0000000002761000-memory.dmp
memory/964-56-0x0000000075141000-0x0000000075143000-memory.dmp
memory/964-59-0x0000000002720000-0x0000000002721000-memory.dmp
memory/964-60-0x0000000002790000-0x0000000002791000-memory.dmp
memory/964-65-0x0000000003450000-0x0000000003451000-memory.dmp
memory/964-64-0x0000000002780000-0x0000000002781000-memory.dmp
memory/964-66-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-67-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/964-68-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-63-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/964-69-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/964-71-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/964-72-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-74-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/964-75-0x0000000000960000-0x0000000000961000-memory.dmp
memory/964-73-0x00000000003F0000-0x00000000003F1000-memory.dmp
memory/964-80-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-79-0x00000000009A0000-0x00000000009A1000-memory.dmp
memory/964-82-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/964-84-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/964-85-0x0000000002670000-0x0000000002671000-memory.dmp
memory/964-88-0x0000000002690000-0x0000000002691000-memory.dmp
memory/964-90-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-91-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-92-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-94-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-101-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/964-104-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/964-105-0x0000000002850000-0x0000000002851000-memory.dmp
memory/964-107-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/964-106-0x0000000000BC0000-0x0000000000BC1000-memory.dmp
memory/964-103-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/964-102-0x0000000002860000-0x0000000002861000-memory.dmp
memory/964-100-0x0000000002800000-0x0000000002801000-memory.dmp
memory/964-99-0x0000000002840000-0x0000000002841000-memory.dmp
memory/964-98-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/964-97-0x0000000002820000-0x0000000002821000-memory.dmp
memory/964-96-0x0000000002810000-0x0000000002811000-memory.dmp
memory/964-108-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/964-95-0x00000000003A0000-0x00000000003A1000-memory.dmp
memory/964-93-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-89-0x0000000002700000-0x0000000002701000-memory.dmp
memory/964-87-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/964-86-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/964-83-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/964-81-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-78-0x0000000000980000-0x0000000000981000-memory.dmp
memory/964-77-0x00000000003D0000-0x00000000003D1000-memory.dmp
memory/964-76-0x00000000003B0000-0x00000000003B1000-memory.dmp
memory/964-70-0x0000000003440000-0x0000000003441000-memory.dmp
memory/964-62-0x0000000002740000-0x0000000002741000-memory.dmp
memory/964-61-0x0000000002750000-0x0000000002751000-memory.dmp
memory/964-58-0x0000000002770000-0x0000000002771000-memory.dmp
memory/1160-109-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1160-110-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1160-116-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1160-117-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1160-119-0x0000000000400000-0x0000000000401000-memory.dmp
memory/1160-121-0x0000000002450000-0x0000000002451000-memory.dmp