Analysis
-
max time kernel
154s -
max time network
160s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
02-12-2021 13:03
General
-
Target
SecuriteInfo.com.Spyware.RedLineStealer.28182.28176.exe
-
Size
217KB
-
MD5
015ed94ce4a51b250d7022a6ee042db1
-
SHA1
749b794ca8eb67f7b688712d9d3f7e74001a8d3d
-
SHA256
11b7d2de5330eded7451a4fb417b91ecad2c7d6a9aea7fee632facaf038e8750
-
SHA512
80740104f9b6e1e6d00a7d05bc7f2666695fd1965b28c9c24e83dd34d16084adf1dc21182b6bb14623d6ac735c047d1259d933aa7c4cca31a956d06fe3cb14ff
Malware Config
Signatures
-
LoaderBot
LoaderBot is a loader written in .NET downloading and executing miners.
-
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
suricata: ET MALWARE CerberTear Ransomware CnC Checkin
-
LoaderBot executable 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 2 IoCs
-
Drops startup file 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Adds Run key to start application 2 TTPs 1 IoCs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 4 IoCs
-
Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Spyware.RedLineStealer.28182.28176.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Spyware.RedLineStealer.28182.28176.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\miner.exe"C:\Users\Admin\AppData\Local\Temp\miner.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe"C:\Users\Admin\AppData\Roaming\Sysfiles\Driver.exe" -o pool.supportxmr.com:3333 -u 4942FTmVN9Hjp8FJQ9ioQy7aMJatBJ8obBpiu5LrtPescwK7dmbbXofGs8m6LZasguiDYmiAA37UUhdrZ9bdy3ZG6qWxVma -p x -k -v=0 --donate-level=0 -t 13⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
80KB
-
Filesize
128KB
-
Filesize
128KB