Analysis
- max time kernel
118s - max time network
119s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
06/12/2021, 12:02
General
- Target d92025812d4642f4e303f29f39e9915c.exe
- Size 1019KB
- Sample211206-n7gbradhhr
- SHA256 fae4a37cca9fa9a55c2176ed4b0bb02e655a125e00096a4bfb7d536ca5ff9cb5
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Program crash 2 IoCs
- Suspicious behavior: EnumeratesProcesses 28 IoCs
- Suspicious use of AdjustPrivilegeToken 5 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d92025812d4642f4e303f29f39e9915c.exe"C:\Users\Admin\AppData\Local\Temp\d92025812d4642f4e303f29f39e9915c.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Disturbers.exe"C:\Users\Admin\AppData\Local\Temp\Disturbers.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 1492 -s 18123⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
C:\Users\Admin\AppData\Local\Temp\Installs.exe"C:\Users\Admin\AppData\Local\Temp\Installs.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3932 -s 15923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1492-160-0x0000017F5E540000-0x0000017F5E795000-memory.dmp
memory/1492-159-0x0000017F5E1C0000-0x0000017F5E532000-memory.dmp
memory/1492-158-0x0000017F40C85000-0x0000017F40C87000-memory.dmp
memory/1492-157-0x0000017F40C84000-0x0000017F40C85000-memory.dmp
memory/1492-156-0x0000017F40C82000-0x0000017F40C84000-memory.dmp
memory/1492-155-0x0000017F40C80000-0x0000017F40C82000-memory.dmp
memory/1492-154-0x0000017F5AE80000-0x0000017F5B200000-memory.dmp
memory/1492-161-0x0000017F40DD0000-0x0000017F40DD1000-memory.dmp
memory/1492-162-0x0000017F5EC70000-0x0000017F5EC71000-memory.dmp
memory/1492-146-0x0000017F404E0000-0x0000017F404E1000-memory.dmp
memory/1492-163-0x00007FF9587D0000-0x00007FF9589AB000-memory.dmp
memory/2376-139-0x0000000005F50000-0x0000000005F51000-memory.dmp
memory/2376-132-0x0000000002D60000-0x0000000002D61000-memory.dmp
memory/2376-137-0x0000000005E60000-0x0000000005E61000-memory.dmp
memory/2376-138-0x0000000005F80000-0x0000000005F81000-memory.dmp
memory/2376-118-0x00000000013C0000-0x000000000154C000-memory.dmp
memory/2376-140-0x0000000007390000-0x0000000007391000-memory.dmp
memory/2376-141-0x0000000006C70000-0x0000000006C71000-memory.dmp
memory/2376-142-0x0000000008910000-0x0000000008911000-memory.dmp
memory/2376-135-0x0000000005290000-0x0000000005291000-memory.dmp
memory/2376-134-0x000000006FC50000-0x000000006FC9B000-memory.dmp
memory/2376-133-0x0000000004FC0000-0x0000000004FC1000-memory.dmp
memory/2376-131-0x00000000744F0000-0x0000000075838000-memory.dmp
memory/2376-119-0x0000000000E80000-0x0000000000E81000-memory.dmp
memory/2376-136-0x00000000062E0000-0x00000000062E1000-memory.dmp
memory/2376-120-0x0000000074080000-0x0000000074242000-memory.dmp
memory/2376-130-0x00000000766F0000-0x0000000076C74000-memory.dmp
memory/2376-121-0x0000000073B40000-0x0000000073C31000-memory.dmp
memory/2376-129-0x0000000002F60000-0x0000000002F61000-memory.dmp
memory/2376-128-0x00000000050D0000-0x00000000050D1000-memory.dmp
memory/2376-127-0x0000000002DE0000-0x0000000002DE1000-memory.dmp
memory/2376-126-0x00000000055D0000-0x00000000055D1000-memory.dmp
memory/2376-125-0x0000000071A00000-0x0000000071A80000-memory.dmp
memory/2376-123-0x00000000013C0000-0x00000000013C1000-memory.dmp
memory/2376-122-0x0000000000EE0000-0x0000000000F25000-memory.dmp
memory/3932-153-0x0000000000E20000-0x0000000000E22000-memory.dmp
memory/3932-151-0x0000000000640000-0x0000000000641000-memory.dmp