Analysis
- max time kernel
120s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
17/12/2021, 11:21
General
- Target cc2f338306f88a416e0f4b4efd537a244a907275e2ca8.exe
- Size 1.7MB
- Sample211217-nfzzsaechk
- SHA256 cc2f338306f88a416e0f4b4efd537a244a907275e2ca866ce176b7cd957bd0d5
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cc2f338306f88a416e0f4b4efd537a244a907275e2ca8.exe"C:\Users\Admin\AppData\Local\Temp\cc2f338306f88a416e0f4b4efd537a244a907275e2ca8.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2672-115-0x0000000000D70000-0x0000000000DD0000-memory.dmp
memory/2672-116-0x0000000000400000-0x000000000082A000-memory.dmp
memory/2672-117-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/2672-118-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/2672-119-0x0000000002880000-0x0000000002881000-memory.dmp
memory/2672-120-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/2672-121-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/2672-123-0x0000000002910000-0x0000000002911000-memory.dmp
memory/2672-122-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/2672-125-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/2672-124-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/2672-126-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-127-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-129-0x0000000000400000-0x0000000000402000-memory.dmp
memory/2672-128-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-130-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-132-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/2672-134-0x0000000000D50000-0x0000000000D51000-memory.dmp
memory/2672-133-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/2672-135-0x0000000002680000-0x0000000002681000-memory.dmp
memory/2672-136-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/2672-137-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/2672-138-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-139-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-140-0x0000000002810000-0x0000000002811000-memory.dmp
memory/2672-141-0x0000000002820000-0x0000000002821000-memory.dmp
memory/2672-142-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/2672-143-0x0000000002840000-0x0000000002841000-memory.dmp
memory/2672-145-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/2672-144-0x0000000002800000-0x0000000002801000-memory.dmp
memory/2672-147-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-146-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2672-148-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-149-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-150-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-151-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/2672-152-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2672-154-0x0000000002980000-0x0000000002981000-memory.dmp
memory/2672-153-0x0000000002970000-0x0000000002971000-memory.dmp
memory/2672-155-0x0000000002930000-0x0000000002931000-memory.dmp
memory/2672-157-0x0000000002960000-0x0000000002961000-memory.dmp
memory/2672-156-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/2672-158-0x0000000002950000-0x0000000002951000-memory.dmp
memory/2672-159-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/2672-160-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2672-161-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2672-162-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/2672-164-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2672-163-0x0000000002700000-0x0000000002701000-memory.dmp
memory/2672-165-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/2672-166-0x0000000005CB0000-0x0000000005CB1000-memory.dmp
memory/2672-167-0x0000000006340000-0x0000000006341000-memory.dmp
memory/2672-168-0x0000000006370000-0x0000000006371000-memory.dmp
memory/2672-169-0x0000000006480000-0x0000000006481000-memory.dmp
memory/2672-170-0x0000000006510000-0x0000000006511000-memory.dmp
memory/2672-171-0x0000000006500000-0x0000000006501000-memory.dmp
memory/2672-172-0x00000000066A0000-0x00000000066A1000-memory.dmp
memory/2672-173-0x0000000006AC0000-0x0000000006AC1000-memory.dmp
memory/2672-174-0x0000000007130000-0x0000000007131000-memory.dmp
memory/2672-175-0x00000000071E0000-0x00000000071E1000-memory.dmp
memory/2672-176-0x0000000007530000-0x0000000007531000-memory.dmp
memory/2672-177-0x00000000075F0000-0x00000000075F1000-memory.dmp
memory/2672-178-0x0000000007810000-0x0000000007811000-memory.dmp
memory/2672-179-0x0000000007E20000-0x0000000007E21000-memory.dmp