Analysis

  • max time kernel
    117s
  • max time network
    117s
  • platform
    windows7_x64
  • resource
    win7-en-20211208
  • submitted
    13-12-2021 20:12

General

  • Target

    80bc1183c4d901de4fd1365eccd0f147.exe

  • Size

    883KB

  • MD5

    80bc1183c4d901de4fd1365eccd0f147

  • SHA1

    d725b0664493a90ff4538bdc5f98d6161748e501

  • SHA256

    f2b68fa107745b515e611eee99231eab7e03e022b4ff8af2bfe3b779ffbf61c4

  • SHA512

    d62d9eae278c92f3041ebf63b38469465d4ecd3c555501b8dea73475d03572965af599455c75c34b3eb766212df0ba20a4a6c7c03ef262b38c871c4e29883385

Malware Config

Extracted

Family

redline

Botnet

r1

C2

101.99.93.44:21060

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload ⋅ 5 IoCs
  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 1 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\80bc1183c4d901de4fd1365eccd0f147.exe
    "C:\Users\Admin\AppData\Local\Temp\80bc1183c4d901de4fd1365eccd0f147.exe"
    Suspicious use of SetThreadContext
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:1844
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_regbrowsers.exe"
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:676

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Discovery

        Execution

          Exfiltration

            Impact

              Initial Access

                Lateral Movement

                  Persistence

                    Privilege Escalation

                      Replay Monitor

                      00:00 00:00

                      Downloads

                      • memory/676-59-0x0000000000400000-0x0000000000420000-memory.dmp
                      • memory/676-60-0x0000000000400000-0x0000000000420000-memory.dmp
                      • memory/676-61-0x0000000000400000-0x0000000000420000-memory.dmp
                      • memory/676-62-0x0000000000400000-0x0000000000420000-memory.dmp
                      • memory/676-63-0x0000000000400000-0x0000000000420000-memory.dmp
                      • memory/676-64-0x000000000041903E-mapping.dmp
                      • memory/676-65-0x0000000000400000-0x0000000000420000-memory.dmp
                      • memory/676-67-0x0000000004A70000-0x0000000004A71000-memory.dmp
                      • memory/1844-54-0x00000000009A0000-0x00000000009A1000-memory.dmp
                      • memory/1844-56-0x0000000075341000-0x0000000075343000-memory.dmp
                      • memory/1844-57-0x0000000004B80000-0x0000000004B81000-memory.dmp
                      • memory/1844-58-0x0000000000350000-0x000000000035F000-memory.dmp