Analysis
- max time kernel
122s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 00:18
General
- Target 1053a56cd35c2f1f56454de2b68b2e07.exe
- Size 858KB
- Sample220107-alm1hsbfh6
- SHA256 9c183568a371d5bfd048cb80caed15756b50d8cb7f5e3e8ec6bce045c35216ed
Malware Config
Extracted
-
redline
-
49.12.47.66:27973
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1053a56cd35c2f1f56454de2b68b2e07.exe"C:\Users\Admin\AppData\Local\Temp\1053a56cd35c2f1f56454de2b68b2e07.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe#cmd2⤵
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2476-115-0x0000000000E20000-0x0000000000EFC000-memory.dmp
memory/2476-116-0x0000000000E20000-0x0000000000EFC000-memory.dmp
memory/2476-117-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/2476-118-0x0000000005E00000-0x00000000062FE000-memory.dmp
memory/2476-119-0x00000000057A0000-0x0000000005832000-memory.dmp
memory/2476-120-0x0000000005C00000-0x0000000005C76000-memory.dmp
memory/2476-121-0x0000000005840000-0x000000000585E000-memory.dmp
memory/2476-122-0x0000000005D40000-0x0000000005D4A000-memory.dmp
memory/3740-123-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3740-125-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3740-126-0x0000000000400000-0x0000000000422000-memory.dmp
memory/3740-127-0x00000000057E0000-0x0000000005DE6000-memory.dmp
memory/3740-128-0x0000000005210000-0x0000000005222000-memory.dmp
memory/3740-129-0x0000000005340000-0x000000000544A000-memory.dmp
memory/3740-130-0x00000000052A0000-0x0000000005306000-memory.dmp
memory/3740-131-0x00000000056B0000-0x00000000056EE000-memory.dmp
memory/3740-132-0x0000000005730000-0x000000000577B000-memory.dmp
memory/3740-133-0x00000000065D0000-0x00000000065D1000-memory.dmp
memory/3740-134-0x0000000006BE0000-0x00000000070DE000-memory.dmp
memory/3740-135-0x0000000006760000-0x00000000067D6000-memory.dmp
memory/3740-136-0x0000000006880000-0x0000000006912000-memory.dmp
memory/3740-137-0x0000000006920000-0x000000000693E000-memory.dmp
memory/3740-138-0x0000000008160000-0x0000000008322000-memory.dmp
memory/3740-139-0x0000000008860000-0x0000000008D8C000-memory.dmp