Analysis
- max time kernel
136s - max time network
136s - platform
windows7_x64 - resource
win7-en-20211104 - submitted
27/11/2021, 00:56
General
- Target bf1c0c4be6f214d0f6228fac5ded3f58.exe
- Size 1.4MB
- Sample211127-bac7lsfhel
- SHA256 08381d5b4bffb1a943f62143f1dcd3ca6ff468e62c3499869dec4e4072f44bcd
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf1c0c4be6f214d0f6228fac5ded3f58.exe"C:\Users\Admin\AppData\Local\Temp\bf1c0c4be6f214d0f6228fac5ded3f58.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1724-55-0x0000000075D01000-0x0000000075D03000-memory.dmp
memory/1724-56-0x0000000000400000-0x0000000000810000-memory.dmp
memory/1724-58-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/1724-57-0x0000000000290000-0x00000000002F0000-memory.dmp
memory/1724-59-0x0000000002800000-0x0000000002801000-memory.dmp
memory/1724-60-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/1724-61-0x0000000002820000-0x0000000002821000-memory.dmp
memory/1724-62-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/1724-63-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/1724-64-0x0000000002840000-0x0000000002841000-memory.dmp
memory/1724-65-0x0000000002810000-0x0000000002811000-memory.dmp
memory/1724-68-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-69-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-67-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-66-0x00000000034E0000-0x00000000034E1000-memory.dmp
memory/1724-70-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-71-0x0000000000880000-0x0000000000881000-memory.dmp
memory/1724-72-0x0000000000890000-0x0000000000891000-memory.dmp
memory/1724-73-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1724-74-0x0000000000860000-0x0000000000861000-memory.dmp
memory/1724-76-0x00000000008D0000-0x00000000008D1000-memory.dmp
memory/1724-75-0x00000000008B0000-0x00000000008B1000-memory.dmp
memory/1724-77-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-78-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-79-0x0000000002740000-0x0000000002741000-memory.dmp
memory/1724-80-0x0000000002750000-0x0000000002751000-memory.dmp
memory/1724-82-0x0000000002770000-0x0000000002771000-memory.dmp
memory/1724-81-0x0000000002700000-0x0000000002701000-memory.dmp
memory/1724-83-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1724-84-0x0000000002720000-0x0000000002721000-memory.dmp
memory/1724-85-0x0000000002790000-0x0000000002791000-memory.dmp
memory/1724-86-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-87-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-88-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-90-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-89-0x00000000034D0000-0x00000000034D1000-memory.dmp
memory/1724-91-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1724-92-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1724-93-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1724-94-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1724-95-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/1724-97-0x0000000002880000-0x0000000002881000-memory.dmp
memory/1724-96-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1724-98-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/1724-99-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1724-100-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1724-101-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/1724-103-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1724-102-0x0000000000920000-0x0000000000921000-memory.dmp
memory/1724-104-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1724-105-0x0000000000400000-0x0000000000402000-memory.dmp
memory/1724-107-0x0000000005BA0000-0x0000000005BA1000-memory.dmp