Analysis
- max time kernel
120s - max time network
120s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
05/12/2021, 16:29
General
- Target Trainer v5.1.3.exe
- Size 1.5MB
- Sample211205-ty8mjacfbk
- SHA256 086adff5d4c7d463878ca94751dc2f51e4e9d8f0814d59fa502f6a5c3b7be659
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trainer v5.1.3.exe"C:\Users\Admin\AppData\Local\Temp\Trainer v5.1.3.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1552-55-0x00000000757A1000-0x00000000757A3000-memory.dmp
memory/1552-56-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/1552-57-0x00000000008A0000-0x0000000000900000-memory.dmp
memory/1552-58-0x00000000023C0000-0x00000000023C1000-memory.dmp
memory/1552-60-0x0000000000B20000-0x0000000000B21000-memory.dmp
memory/1552-61-0x00000000023F0000-0x00000000023F1000-memory.dmp
memory/1552-59-0x00000000023D0000-0x00000000023D1000-memory.dmp
memory/1552-62-0x00000000023B0000-0x00000000023B1000-memory.dmp
memory/1552-67-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-93-0x0000000002870000-0x0000000002871000-memory.dmp
memory/1552-103-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1552-102-0x0000000000960000-0x0000000000961000-memory.dmp
memory/1552-104-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1552-101-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/1552-100-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1552-99-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1552-98-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/1552-97-0x0000000002450000-0x0000000002451000-memory.dmp
memory/1552-96-0x0000000002850000-0x0000000002851000-memory.dmp
memory/1552-95-0x0000000002890000-0x0000000002891000-memory.dmp
memory/1552-94-0x0000000002430000-0x0000000002431000-memory.dmp
memory/1552-92-0x0000000002860000-0x0000000002861000-memory.dmp
memory/1552-91-0x0000000000840000-0x0000000000841000-memory.dmp
memory/1552-90-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-89-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-88-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-87-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-86-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-85-0x0000000000B00000-0x0000000000B01000-memory.dmp
memory/1552-84-0x0000000000A80000-0x0000000000A81000-memory.dmp
memory/1552-83-0x0000000000AA0000-0x0000000000AA1000-memory.dmp
memory/1552-82-0x0000000000AE0000-0x0000000000AE1000-memory.dmp
memory/1552-81-0x0000000000A60000-0x0000000000A61000-memory.dmp
memory/1552-80-0x0000000000AC0000-0x0000000000AC1000-memory.dmp
memory/1552-79-0x0000000000AB0000-0x0000000000AB1000-memory.dmp
memory/1552-78-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-77-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-76-0x0000000000940000-0x0000000000941000-memory.dmp
memory/1552-75-0x0000000000920000-0x0000000000921000-memory.dmp
memory/1552-74-0x0000000000870000-0x0000000000871000-memory.dmp
memory/1552-73-0x0000000000850000-0x0000000000851000-memory.dmp
memory/1552-72-0x0000000000900000-0x0000000000901000-memory.dmp
memory/1552-71-0x0000000000890000-0x0000000000891000-memory.dmp
memory/1552-70-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-69-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-68-0x0000000003490000-0x0000000003491000-memory.dmp
memory/1552-66-0x00000000034A0000-0x00000000034A1000-memory.dmp
memory/1552-65-0x00000000023E0000-0x00000000023E1000-memory.dmp
memory/1552-64-0x0000000002410000-0x0000000002411000-memory.dmp
memory/1552-63-0x0000000000B40000-0x0000000000B41000-memory.dmp
memory/1552-105-0x0000000000400000-0x0000000000402000-memory.dmp
memory/1552-107-0x0000000005BD0000-0x0000000005BD1000-memory.dmp