Analysis
- max time kernel
122s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
15/12/2021, 04:49
General
- Target b36de850fd13d0662d85125a47fc558c.exe
- Size 1.3MB
- Sample211215-ffn9aahgap
- SHA256 4872e763d2a902c252dc3932e1ff2f68eadea9ab52e5031239885c41212eb978
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b36de850fd13d0662d85125a47fc558c.exe"C:\Users\Admin\AppData\Local\Temp\b36de850fd13d0662d85125a47fc558c.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3484-115-0x0000000000400000-0x0000000000762000-memory.dmp
memory/3484-117-0x0000000002940000-0x0000000002941000-memory.dmp
memory/3484-116-0x0000000000DA0000-0x0000000000E00000-memory.dmp
memory/3484-118-0x0000000002950000-0x0000000002951000-memory.dmp
memory/3484-119-0x0000000002900000-0x0000000002901000-memory.dmp
memory/3484-120-0x0000000002970000-0x0000000002971000-memory.dmp
memory/3484-121-0x0000000002930000-0x0000000002931000-memory.dmp
memory/3484-122-0x0000000002920000-0x0000000002921000-memory.dmp
memory/3484-123-0x0000000002990000-0x0000000002991000-memory.dmp
memory/3484-124-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3484-125-0x0000000003630000-0x0000000003631000-memory.dmp
memory/3484-127-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-126-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-128-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-129-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-130-0x0000000002710000-0x0000000002711000-memory.dmp
memory/3484-131-0x0000000002720000-0x0000000002721000-memory.dmp
memory/3484-132-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/3484-133-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/3484-135-0x0000000002770000-0x0000000002771000-memory.dmp
memory/3484-134-0x0000000002750000-0x0000000002751000-memory.dmp
memory/3484-136-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-138-0x0000000002890000-0x0000000002891000-memory.dmp
memory/3484-137-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-139-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/3484-140-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3484-141-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/3484-142-0x0000000002870000-0x0000000002871000-memory.dmp
memory/3484-143-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3484-145-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/3484-147-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-144-0x0000000000400000-0x0000000000402000-memory.dmp
memory/3484-149-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-148-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-151-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-150-0x0000000003620000-0x0000000003621000-memory.dmp
memory/3484-152-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3484-153-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/3484-154-0x0000000002A00000-0x0000000002A01000-memory.dmp
memory/3484-155-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/3484-156-0x0000000002A20000-0x0000000002A21000-memory.dmp
memory/3484-157-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/3484-158-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/3484-160-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3484-159-0x0000000002A40000-0x0000000002A41000-memory.dmp
memory/3484-161-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3484-162-0x0000000002A30000-0x0000000002A31000-memory.dmp
memory/3484-163-0x0000000002780000-0x0000000002781000-memory.dmp
memory/3484-164-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3484-165-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/3484-166-0x0000000005D40000-0x0000000005D41000-memory.dmp
memory/3484-167-0x00000000063C0000-0x00000000063C1000-memory.dmp
memory/3484-168-0x00000000063F0000-0x00000000063F1000-memory.dmp
memory/3484-169-0x0000000006500000-0x0000000006501000-memory.dmp
memory/3484-170-0x0000000006580000-0x0000000006581000-memory.dmp
memory/3484-171-0x00000000066D0000-0x00000000066D1000-memory.dmp
memory/3484-172-0x0000000006720000-0x0000000006721000-memory.dmp
memory/3484-173-0x00000000067A0000-0x00000000067A1000-memory.dmp
memory/3484-174-0x0000000006840000-0x0000000006841000-memory.dmp
memory/3484-175-0x0000000007040000-0x0000000007041000-memory.dmp
memory/3484-176-0x00000000071C0000-0x00000000071C1000-memory.dmp
memory/3484-177-0x0000000008490000-0x0000000008491000-memory.dmp
memory/3484-178-0x0000000008680000-0x0000000008681000-memory.dmp