Analysis
- max time kernel
122s - max time network
124s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
01/01/2022, 15:49
General
- Target 09566600dd6a4f448ec8843c80b2e38a.exe
- Size 1.4MB
- Sample220101-s9b72agccp
- SHA256 2fa8fb2ee024e1a7c5a27fd07f4892b5e4c13c1d71624086ef3594a0644ceffb
Malware Config
Extracted
-
redline
-
95.143.178.139:9006
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 6 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09566600dd6a4f448ec8843c80b2e38a.exe"C:\Users\Admin\AppData\Local\Temp\09566600dd6a4f448ec8843c80b2e38a.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-109-0x0000000000400000-0x0000000000420000-memory.dmp
memory/628-110-0x0000000000400000-0x0000000000420000-memory.dmp
memory/628-116-0x0000000000400000-0x0000000000420000-memory.dmp
memory/628-117-0x0000000000400000-0x0000000000420000-memory.dmp
memory/628-121-0x0000000000C80000-0x0000000000C81000-memory.dmp
memory/628-120-0x0000000000400000-0x0000000000420000-memory.dmp
memory/628-119-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1656-81-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-84-0x0000000002620000-0x0000000002621000-memory.dmp
memory/1656-58-0x0000000000290000-0x00000000002F0000-memory.dmp
memory/1656-63-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1656-62-0x0000000002680000-0x0000000002681000-memory.dmp
memory/1656-61-0x00000000026D0000-0x00000000026D1000-memory.dmp
memory/1656-64-0x00000000026F0000-0x00000000026F1000-memory.dmp
memory/1656-65-0x00000000026B0000-0x00000000026B1000-memory.dmp
memory/1656-67-0x00000000026A0000-0x00000000026A1000-memory.dmp
memory/1656-66-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1656-68-0x0000000002710000-0x0000000002711000-memory.dmp
memory/1656-71-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-72-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-70-0x00000000033B0000-0x00000000033B1000-memory.dmp
memory/1656-73-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-69-0x00000000026E0000-0x00000000026E1000-memory.dmp
memory/1656-74-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-75-0x0000000000790000-0x0000000000791000-memory.dmp
memory/1656-77-0x0000000000750000-0x0000000000751000-memory.dmp
memory/1656-76-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/1656-79-0x00000000007C0000-0x00000000007C1000-memory.dmp
memory/1656-78-0x0000000000770000-0x0000000000771000-memory.dmp
memory/1656-60-0x00000000026C0000-0x00000000026C1000-memory.dmp
memory/1656-80-0x0000000000820000-0x0000000000821000-memory.dmp
memory/1656-83-0x0000000002610000-0x0000000002611000-memory.dmp
memory/1656-82-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-85-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/1656-59-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1656-86-0x0000000002640000-0x0000000002641000-memory.dmp
memory/1656-88-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/1656-87-0x0000000002600000-0x0000000002601000-memory.dmp
memory/1656-89-0x0000000002660000-0x0000000002661000-memory.dmp
memory/1656-90-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-92-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-91-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-93-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-95-0x0000000000740000-0x0000000000741000-memory.dmp
memory/1656-94-0x00000000033A0000-0x00000000033A1000-memory.dmp
memory/1656-97-0x0000000002780000-0x0000000002781000-memory.dmp
memory/1656-96-0x0000000002770000-0x0000000002771000-memory.dmp
memory/1656-98-0x0000000002730000-0x0000000002731000-memory.dmp
memory/1656-100-0x0000000002760000-0x0000000002761000-memory.dmp
memory/1656-99-0x00000000027A0000-0x00000000027A1000-memory.dmp
memory/1656-102-0x00000000027C0000-0x00000000027C1000-memory.dmp
memory/1656-101-0x0000000002750000-0x0000000002751000-memory.dmp
memory/1656-103-0x0000000000740000-0x0000000000741000-memory.dmp
memory/1656-57-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1656-56-0x0000000000400000-0x0000000000729000-memory.dmp
memory/1656-55-0x00000000763B1000-0x00000000763B3000-memory.dmp
memory/1656-104-0x0000000000740000-0x0000000000741000-memory.dmp
memory/1656-106-0x0000000000830000-0x0000000000831000-memory.dmp
memory/1656-105-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/1656-107-0x0000000000740000-0x0000000000741000-memory.dmp
memory/1656-108-0x0000000000740000-0x0000000000741000-memory.dmp