Analysis
- max time kernel
123s - max time network
126s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
01/01/2022, 15:49
General
- Target 09566600dd6a4f448ec8843c80b2e38a.exe
- Size 1.4MB
- Sample220101-s9b72agccp
- SHA256 2fa8fb2ee024e1a7c5a27fd07f4892b5e4c13c1d71624086ef3594a0644ceffb
Malware Config
Extracted
-
redline
-
95.143.178.139:9006
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Suspicious use of NtCreateProcessExOtherParentProcess 1 IoCs
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks whether UAC is enabled 1 TTPs 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Suspicious behavior: EnumeratesProcesses 13 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\09566600dd6a4f448ec8843c80b2e38a.exe"C:\Users\Admin\AppData\Local\Temp\09566600dd6a4f448ec8843c80b2e38a.exe"1⤵
- Checks BIOS information in registry
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4092 -s 5322⤵
- Suspicious use of NtCreateProcessExOtherParentProcess
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1040-135-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1040-202-0x000000000B0F0000-0x000000000B2B2000-memory.dmp
memory/1040-197-0x000000000A2E0000-0x000000000A346000-memory.dmp
memory/1040-196-0x0000000009A00000-0x0000000009A1E000-memory.dmp
memory/1040-195-0x0000000009A20000-0x0000000009AB2000-memory.dmp
memory/1040-194-0x0000000009900000-0x0000000009976000-memory.dmp
memory/1040-191-0x000000000A5E0000-0x000000000AADE000-memory.dmp
memory/1040-185-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/1040-184-0x00000000095C0000-0x000000000960B000-memory.dmp
memory/1040-183-0x00000000094C0000-0x0000000009AC6000-memory.dmp
memory/1040-182-0x0000000009580000-0x00000000095BE000-memory.dmp
memory/1040-181-0x0000000009650000-0x000000000975A000-memory.dmp
memory/1040-180-0x0000000009520000-0x0000000009532000-memory.dmp
memory/1040-179-0x0000000009AD0000-0x000000000A0D6000-memory.dmp
memory/1040-163-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1040-161-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1040-156-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/1040-148-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/1040-147-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/4092-154-0x0000000002830000-0x0000000002831000-memory.dmp
memory/4092-166-0x00000000029A0000-0x00000000029A1000-memory.dmp
memory/4092-139-0x0000000002520000-0x0000000002521000-memory.dmp
memory/4092-143-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/4092-141-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/4092-134-0x00000000025C0000-0x00000000025C1000-memory.dmp
memory/4092-145-0x0000000002720000-0x0000000002721000-memory.dmp
memory/4092-133-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-149-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-150-0x0000000002840000-0x0000000002841000-memory.dmp
memory/4092-132-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-146-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-151-0x0000000002850000-0x0000000002851000-memory.dmp
memory/4092-152-0x0000000002800000-0x0000000002801000-memory.dmp
memory/4092-153-0x0000000002870000-0x0000000002871000-memory.dmp
memory/4092-116-0x00000000028F0000-0x00000000028F1000-memory.dmp
memory/4092-131-0x0000000000400000-0x0000000000729000-memory.dmp
memory/4092-155-0x0000000002820000-0x0000000002821000-memory.dmp
memory/4092-157-0x0000000002890000-0x0000000002891000-memory.dmp
memory/4092-158-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-159-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-130-0x0000000000400000-0x0000000000729000-memory.dmp
memory/4092-160-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-128-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-164-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-165-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4092-162-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-136-0x00000000025D0000-0x00000000025D1000-memory.dmp
memory/4092-167-0x00000000029B0000-0x00000000029B1000-memory.dmp
memory/4092-168-0x0000000002960000-0x0000000002961000-memory.dmp
memory/4092-169-0x00000000029D0000-0x00000000029D1000-memory.dmp
memory/4092-170-0x0000000002990000-0x0000000002991000-memory.dmp
memory/4092-171-0x0000000002980000-0x0000000002981000-memory.dmp
memory/4092-172-0x00000000029F0000-0x00000000029F1000-memory.dmp
memory/4092-173-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4092-174-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4092-175-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/4092-176-0x0000000002730000-0x0000000002731000-memory.dmp
memory/4092-177-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4092-178-0x0000000002510000-0x0000000002511000-memory.dmp
memory/4092-129-0x00000000035D0000-0x00000000035D1000-memory.dmp
memory/4092-127-0x00000000035E0000-0x00000000035E1000-memory.dmp
memory/4092-125-0x0000000002910000-0x0000000002911000-memory.dmp
memory/4092-126-0x0000000000400000-0x0000000000729000-memory.dmp
memory/4092-124-0x0000000002940000-0x0000000002941000-memory.dmp
memory/4092-123-0x0000000000400000-0x0000000000729000-memory.dmp
memory/4092-122-0x00000000028D0000-0x00000000028D1000-memory.dmp
memory/4092-120-0x00000000028E0000-0x00000000028E1000-memory.dmp
memory/4092-121-0x0000000000400000-0x0000000000729000-memory.dmp
memory/4092-118-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/4092-119-0x0000000002920000-0x0000000002921000-memory.dmp
memory/4092-117-0x0000000002900000-0x0000000002901000-memory.dmp
memory/4092-115-0x0000000002530000-0x0000000002590000-memory.dmp