Analysis

  • max time kernel
    123s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10-en-20211208
  • submitted
    20-12-2021 17:13

General

  • Target

    0aef3aef127a4f780fc0166e4ed8ebac.exe

  • Size

    549KB

  • MD5

    0aef3aef127a4f780fc0166e4ed8ebac

  • SHA1

    de5e59cd81f17027d811400bc7d48765e1d55df2

  • SHA256

    e7aa0daa42cf46f9268775f5deff2b2f9574ef893202491521e89a7540688152

  • SHA512

    1cd35a889aebf12b42b43eb83aa8c224e1896045c37b0f08f89b5910ff55e15bcba9e215f97ead7432dc47796263508906287e184ab9f6c602097f7eb93ce5fa

Malware Config

Extracted

Family

redline

Botnet

10

C2

18.191.251.199:45097

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
    "C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2688
    • C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
      C:\Users\Admin\AppData\Local\Temp\0aef3aef127a4f780fc0166e4ed8ebac.exe
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      PID:3988

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\0aef3aef127a4f780fc0166e4ed8ebac.exe.log
    MD5

    41fbed686f5700fc29aaccf83e8ba7fd

    SHA1

    5271bc29538f11e42a3b600c8dc727186e912456

    SHA256

    df4e9d012687cdabd15e86bf37be15d6c822e1f50dde530a02468f0006586437

    SHA512

    234b2235c1ced25810a4121c5eabcbf9f269e82c126a1adc363ee34478173f8b462e90eb53f5f11533641663350b90ec1e2360fd805b10c041fab12f4da7a034

  • memory/2688-118-0x00000000002D0000-0x00000000002D1000-memory.dmp
    Filesize

    4KB

  • memory/2688-120-0x0000000004B40000-0x0000000004B41000-memory.dmp
    Filesize

    4KB

  • memory/2688-121-0x0000000004C60000-0x0000000004C61000-memory.dmp
    Filesize

    4KB

  • memory/2688-122-0x0000000004AA0000-0x0000000004AA1000-memory.dmp
    Filesize

    4KB

  • memory/2688-123-0x0000000004B20000-0x0000000004B21000-memory.dmp
    Filesize

    4KB

  • memory/2688-124-0x00000000053F0000-0x00000000053F1000-memory.dmp
    Filesize

    4KB

  • memory/3988-131-0x0000000005510000-0x0000000005511000-memory.dmp
    Filesize

    4KB

  • memory/3988-129-0x00000000059F0000-0x00000000059F1000-memory.dmp
    Filesize

    4KB

  • memory/3988-130-0x00000000053E0000-0x00000000053E1000-memory.dmp
    Filesize

    4KB

  • memory/3988-126-0x0000000000419322-mapping.dmp
  • memory/3988-132-0x00000000053E0000-0x00000000059E6000-memory.dmp
    Filesize

    6.0MB

  • memory/3988-133-0x0000000005450000-0x0000000005451000-memory.dmp
    Filesize

    4KB

  • memory/3988-134-0x0000000005490000-0x0000000005491000-memory.dmp
    Filesize

    4KB

  • memory/3988-135-0x0000000005780000-0x0000000005781000-memory.dmp
    Filesize

    4KB

  • memory/3988-138-0x0000000006450000-0x0000000006451000-memory.dmp
    Filesize

    4KB

  • memory/3988-140-0x0000000006580000-0x0000000006581000-memory.dmp
    Filesize

    4KB

  • memory/3988-141-0x0000000008180000-0x0000000008181000-memory.dmp
    Filesize

    4KB

  • memory/3988-142-0x0000000008880000-0x0000000008881000-memory.dmp
    Filesize

    4KB

  • memory/3988-125-0x0000000000400000-0x0000000000422000-memory.dmp
    Filesize

    136KB