Analysis
- max time kernel
83s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
05/12/2021, 16:29
General
- Target Trainer v5.1.3.exe
- Size 1.5MB
- Sample211205-ty8mjacfbk
- SHA256 086adff5d4c7d463878ca94751dc2f51e4e9d8f0814d59fa502f6a5c3b7be659
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Trainer v5.1.3.exe"C:\Users\Admin\AppData\Local\Temp\Trainer v5.1.3.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3724-118-0x0000000000400000-0x00000000007C2000-memory.dmp
memory/3724-119-0x0000000000CE0000-0x0000000000D40000-memory.dmp
memory/3724-120-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3724-121-0x0000000002870000-0x0000000002871000-memory.dmp
memory/3724-122-0x0000000002820000-0x0000000002821000-memory.dmp
memory/3724-123-0x0000000002890000-0x0000000002891000-memory.dmp
memory/3724-124-0x0000000002850000-0x0000000002851000-memory.dmp
memory/3724-126-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/3724-125-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3724-127-0x0000000002880000-0x0000000002881000-memory.dmp
memory/3724-128-0x0000000003550000-0x0000000003551000-memory.dmp
memory/3724-129-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-130-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-131-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-133-0x0000000002530000-0x0000000002531000-memory.dmp
memory/3724-132-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-134-0x0000000002650000-0x0000000002651000-memory.dmp
memory/3724-136-0x0000000000400000-0x0000000000402000-memory.dmp
memory/3724-135-0x00000000024F0000-0x00000000024F1000-memory.dmp
memory/3724-139-0x0000000002670000-0x0000000002671000-memory.dmp
memory/3724-138-0x0000000002510000-0x0000000002511000-memory.dmp
memory/3724-140-0x0000000002690000-0x0000000002691000-memory.dmp
memory/3724-141-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-143-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/3724-142-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-144-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/3724-145-0x0000000002770000-0x0000000002771000-memory.dmp
memory/3724-147-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/3724-148-0x0000000002790000-0x0000000002791000-memory.dmp
memory/3724-149-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3724-146-0x00000000027E0000-0x00000000027E1000-memory.dmp
memory/3724-150-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-153-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-154-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-155-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3724-156-0x0000000002910000-0x0000000002911000-memory.dmp
memory/3724-151-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-152-0x0000000003540000-0x0000000003541000-memory.dmp
memory/3724-158-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/3724-157-0x0000000002920000-0x0000000002921000-memory.dmp
memory/3724-160-0x0000000002900000-0x0000000002901000-memory.dmp
memory/3724-159-0x0000000002940000-0x0000000002941000-memory.dmp
memory/3724-161-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3724-163-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3724-162-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3724-164-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3724-165-0x0000000002950000-0x0000000002951000-memory.dmp
memory/3724-167-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3724-168-0x00000000024E0000-0x00000000024E1000-memory.dmp
memory/3724-166-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/3724-169-0x0000000005C40000-0x0000000005C41000-memory.dmp
memory/3724-170-0x00000000062E0000-0x00000000062E1000-memory.dmp
memory/3724-171-0x0000000006310000-0x0000000006311000-memory.dmp
memory/3724-172-0x0000000006420000-0x0000000006421000-memory.dmp
memory/3724-173-0x00000000064B0000-0x00000000064B1000-memory.dmp
memory/3724-174-0x0000000006490000-0x0000000006491000-memory.dmp
memory/3724-175-0x0000000006640000-0x0000000006641000-memory.dmp
memory/3724-176-0x0000000006B50000-0x0000000006B51000-memory.dmp
memory/3724-177-0x0000000007000000-0x0000000007001000-memory.dmp
memory/3724-178-0x0000000007190000-0x0000000007191000-memory.dmp
memory/3724-179-0x00000000074D0000-0x00000000074D1000-memory.dmp
memory/3724-180-0x0000000007570000-0x0000000007571000-memory.dmp
memory/3724-181-0x0000000007750000-0x0000000007751000-memory.dmp
memory/3724-182-0x0000000008020000-0x0000000008021000-memory.dmp