Analysis
- max time kernel
119s - max time network
128s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
25/12/2021, 05:11
General
- Target a9b14886ee101a248039aa9b60202afd.exe
- Size 1.6MB
- Sample211225-ft93xafeej
- SHA256 ca5bd676278cfa46a1630e6d98cf4651a3a3b0a7a11fe0e0ca727be261e04e94
Malware Config
Extracted
-
redline
-
178.20.44.131:8842
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 3 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9b14886ee101a248039aa9b60202afd.exe"C:\Users\Admin\AppData\Local\Temp\a9b14886ee101a248039aa9b60202afd.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3664-115-0x0000000000400000-0x000000000082A000-memory.dmp
memory/3664-116-0x0000000000D90000-0x0000000000DF0000-memory.dmp
memory/3664-117-0x00000000028C0000-0x00000000028C1000-memory.dmp
memory/3664-118-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/3664-119-0x0000000002880000-0x0000000002881000-memory.dmp
memory/3664-120-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/3664-121-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/3664-122-0x00000000028A0000-0x00000000028A1000-memory.dmp
memory/3664-123-0x0000000002910000-0x0000000002911000-memory.dmp
memory/3664-124-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/3664-125-0x00000000035B0000-0x00000000035B1000-memory.dmp
memory/3664-126-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-127-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-128-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-129-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-130-0x0000000002690000-0x0000000002691000-memory.dmp
memory/3664-132-0x0000000000D40000-0x0000000000D41000-memory.dmp
memory/3664-131-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/3664-133-0x0000000000D60000-0x0000000000D61000-memory.dmp
memory/3664-134-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/3664-135-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/3664-136-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-137-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-139-0x0000000002820000-0x0000000002821000-memory.dmp
memory/3664-138-0x0000000002810000-0x0000000002811000-memory.dmp
memory/3664-140-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/3664-141-0x0000000002840000-0x0000000002841000-memory.dmp
memory/3664-142-0x0000000002800000-0x0000000002801000-memory.dmp
memory/3664-143-0x00000000027F0000-0x00000000027F1000-memory.dmp
memory/3664-145-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-144-0x0000000002860000-0x0000000002861000-memory.dmp
memory/3664-146-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-149-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-147-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-148-0x00000000035A0000-0x00000000035A1000-memory.dmp
memory/3664-150-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/3664-152-0x0000000002980000-0x0000000002981000-memory.dmp
memory/3664-151-0x0000000002970000-0x0000000002971000-memory.dmp
memory/3664-153-0x0000000002930000-0x0000000002931000-memory.dmp
memory/3664-154-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/3664-155-0x0000000002960000-0x0000000002961000-memory.dmp
memory/3664-156-0x0000000002950000-0x0000000002951000-memory.dmp
memory/3664-157-0x00000000029C0000-0x00000000029C1000-memory.dmp
memory/3664-158-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/3664-159-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/3664-161-0x0000000002700000-0x0000000002701000-memory.dmp
memory/3664-160-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/3664-162-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/3664-163-0x0000000000D30000-0x0000000000D31000-memory.dmp
memory/3664-164-0x0000000000400000-0x000000000082A000-memory.dmp
memory/3664-165-0x0000000000400000-0x000000000082A000-memory.dmp
memory/3664-166-0x0000000005D20000-0x0000000006326000-memory.dmp
memory/3664-167-0x0000000006340000-0x0000000006352000-memory.dmp
memory/3664-168-0x0000000006370000-0x000000000647A000-memory.dmp
memory/3664-169-0x0000000006610000-0x0000000006611000-memory.dmp
memory/3664-170-0x0000000006480000-0x00000000064BE000-memory.dmp
memory/3664-171-0x0000000006500000-0x000000000654B000-memory.dmp
memory/3664-172-0x00000000066A0000-0x0000000006706000-memory.dmp
memory/3664-173-0x0000000006AC0000-0x0000000006B36000-memory.dmp
memory/3664-174-0x0000000006C10000-0x0000000006CA2000-memory.dmp
memory/3664-175-0x0000000006CB0000-0x00000000071AE000-memory.dmp
memory/3664-176-0x0000000007430000-0x000000000744E000-memory.dmp
memory/3664-177-0x0000000008890000-0x0000000008A52000-memory.dmp
memory/3664-178-0x0000000008A90000-0x0000000008FBC000-memory.dmp