Analysis
- max time kernel
101s - max time network
124s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
06/12/2021, 04:33
General
- Target SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exe
- Size 997KB
- Sample211206-e6ks4sdcgp
- SHA256 daa44b180ded811edeb606767992fffcace2ed07dc7e37413fcb24c5edc9fec7
Malware Config
Extracted
-
redline
-
12345
-
45.150.67.236:33584
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 17 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exe2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exeC:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.Steam.23048.15661.5439.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\xfiles.exe"C:\Users\Admin\AppData\Roaming\xfiles.exe"3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1224 -s 18084⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1224-151-0x0000027E1C8F0000-0x0000027E1C8F2000-memory.dmp
memory/1224-156-0x0000027E37770000-0x0000027E37AC9000-memory.dmp
memory/1224-148-0x0000027E1A710000-0x0000027E1A711000-memory.dmp
memory/1224-161-0x00007FFBC5BC0000-0x00007FFBC5D9B000-memory.dmp
memory/1224-159-0x0000027E1C8F5000-0x0000027E1C8F7000-memory.dmp
memory/1224-150-0x0000027E350D0000-0x0000027E35436000-memory.dmp
memory/1224-158-0x0000027E354B0000-0x0000027E354B1000-memory.dmp
memory/1224-157-0x0000027E39650000-0x0000027E398D0000-memory.dmp
memory/1224-152-0x0000027E35910000-0x0000027E35911000-memory.dmp
memory/1224-155-0x0000027E1C8F4000-0x0000027E1C8F5000-memory.dmp
memory/1224-154-0x0000027E1C8F2000-0x0000027E1C8F4000-memory.dmp
memory/1224-153-0x0000027E1C730000-0x0000027E1C731000-memory.dmp
memory/4292-121-0x0000000002880000-0x0000000002881000-memory.dmp
memory/4292-118-0x0000000000480000-0x0000000000481000-memory.dmp
memory/4292-122-0x0000000004F90000-0x0000000004F91000-memory.dmp
memory/4292-123-0x0000000005810000-0x0000000005811000-memory.dmp
memory/4292-125-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/4292-120-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/4292-124-0x0000000005380000-0x0000000005381000-memory.dmp
memory/4356-133-0x0000000004FD0000-0x0000000004FD1000-memory.dmp
memory/4356-134-0x0000000004F00000-0x0000000004F01000-memory.dmp
memory/4356-142-0x0000000008710000-0x0000000008711000-memory.dmp
memory/4356-140-0x00000000063A0000-0x00000000063A1000-memory.dmp
memory/4356-138-0x0000000005C90000-0x0000000005C91000-memory.dmp
memory/4356-137-0x0000000005290000-0x0000000005291000-memory.dmp
memory/4356-136-0x0000000004F40000-0x0000000004F41000-memory.dmp
memory/4356-135-0x0000000004DF0000-0x00000000053F6000-memory.dmp
memory/4356-143-0x0000000008930000-0x0000000008931000-memory.dmp
memory/4356-141-0x00000000061C0000-0x00000000061C1000-memory.dmp
memory/4356-132-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/4356-131-0x0000000005400000-0x0000000005401000-memory.dmp
memory/4356-126-0x0000000000400000-0x0000000000420000-memory.dmp