Analysis
- max time kernel
117s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
29/12/2021, 07:57
General
- Target OneWay Hack.exe
- Size 985KB
- Sample211229-js9mjaefc3
- SHA256 ac8bc27c6868bbb4b617b4280d8e400e6c9dda52c3ffda8a5603fe378374f69e
Malware Config
Extracted
-
redline
-
95.143.178.139:9006
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\OneWay Hack.exe"C:\Users\Admin\AppData\Local\Temp\OneWay Hack.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3676-115-0x00000000008A0000-0x000000000099A000-memory.dmp
memory/3676-116-0x00000000008A0000-0x000000000099A000-memory.dmp
memory/3676-117-0x00000000056F0000-0x0000000005BEE000-memory.dmp
memory/3676-118-0x0000000005290000-0x0000000005322000-memory.dmp
memory/3676-119-0x0000000005630000-0x00000000056A6000-memory.dmp
memory/3676-120-0x0000000005230000-0x000000000524E000-memory.dmp
memory/3676-121-0x0000000005C00000-0x0000000005C0A000-memory.dmp
memory/3676-122-0x0000000005D60000-0x0000000005D61000-memory.dmp
memory/4104-123-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4104-125-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4104-126-0x0000000000400000-0x0000000000422000-memory.dmp
memory/4104-127-0x0000000005C30000-0x0000000006236000-memory.dmp
memory/4104-128-0x0000000005660000-0x0000000005672000-memory.dmp
memory/4104-129-0x0000000005790000-0x000000000589A000-memory.dmp
memory/4104-130-0x00000000056F0000-0x0000000005756000-memory.dmp
memory/4104-131-0x0000000006240000-0x000000000627E000-memory.dmp
memory/4104-132-0x00000000062D0000-0x000000000631B000-memory.dmp
memory/4104-133-0x00000000068F0000-0x00000000068F1000-memory.dmp
memory/4104-134-0x0000000007020000-0x000000000751E000-memory.dmp
memory/4104-135-0x0000000006BB0000-0x0000000006C26000-memory.dmp
memory/4104-136-0x0000000006CD0000-0x0000000006D62000-memory.dmp
memory/4104-137-0x0000000006E70000-0x0000000006E8E000-memory.dmp
memory/4104-138-0x0000000006F00000-0x0000000006F50000-memory.dmp
memory/4104-139-0x00000000077F0000-0x00000000079B2000-memory.dmp
memory/4104-140-0x0000000007EF0000-0x000000000841C000-memory.dmp