Analysis
- max time kernel
119s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 19:52
General
- Target 201a75533e813778f5278f107505b384.exe
- Size 279KB
- Sample220126-ylek5shfcq
- SHA256 0ebf44ed5f0614c08d4e5f25fb08cd33fa5ec7baa6a5c9c4c19d41dbf3e9df08
Malware Config
Extracted
-
redline
-
Mastif
-
81.91.178.186:19410
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 64 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\201a75533e813778f5278f107505b384.exe"C:\Users\Admin\AppData\Local\Temp\201a75533e813778f5278f107505b384.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Test-Connection google.com; Test-Connection yahoo.com; Test-Connection youtube.com; Test-Connection google.com2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\201a75533e813778f5278f107505b384.exeC:\Users\Admin\AppData\Local\Temp\201a75533e813778f5278f107505b384.exe2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1384-410-0x0000000005480000-0x0000000005A86000-memory.dmp
memory/1384-412-0x0000000005040000-0x000000000514A000-memory.dmp
memory/1384-418-0x0000000006320000-0x0000000006370000-memory.dmp
memory/1384-417-0x0000000006010000-0x000000000602E000-memory.dmp
memory/1384-416-0x0000000005E70000-0x0000000005F02000-memory.dmp
memory/1384-415-0x0000000004E70000-0x0000000005476000-memory.dmp
memory/1384-414-0x0000000004FB0000-0x0000000004FFB000-memory.dmp
memory/1384-408-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1384-419-0x0000000006BE0000-0x0000000006DA2000-memory.dmp
memory/1384-411-0x0000000004F10000-0x0000000004F22000-memory.dmp
memory/1384-413-0x0000000004F70000-0x0000000004FAE000-memory.dmp
memory/1384-420-0x00000000072E0000-0x000000000780C000-memory.dmp
memory/2580-404-0x00000000055F0000-0x0000000005730000-memory.dmp
memory/2580-115-0x0000000000E40000-0x0000000000E8C000-memory.dmp
memory/2580-407-0x00000000062C0000-0x000000000630C000-memory.dmp
memory/2580-406-0x0000000006120000-0x0000000006156000-memory.dmp
memory/2580-405-0x00000000056C0000-0x000000000570C000-memory.dmp
memory/3964-125-0x0000000008590000-0x00000000088E0000-memory.dmp
memory/3964-146-0x000000000ADE0000-0x000000000B458000-memory.dmp
memory/3964-141-0x00000000077D3000-0x00000000077D4000-memory.dmp
memory/3964-138-0x000000000A260000-0x000000000A75E000-memory.dmp
memory/3964-137-0x0000000009C40000-0x0000000009C62000-memory.dmp
memory/3964-136-0x0000000009940000-0x000000000995A000-memory.dmp
memory/3964-135-0x0000000009CC0000-0x0000000009D54000-memory.dmp
memory/3964-128-0x0000000008C20000-0x0000000008C96000-memory.dmp
memory/3964-127-0x0000000007DB0000-0x0000000007DFB000-memory.dmp
memory/3964-126-0x0000000007C30000-0x0000000007C4C000-memory.dmp
memory/3964-124-0x0000000008520000-0x0000000008586000-memory.dmp
memory/3964-123-0x00000000084B0000-0x0000000008516000-memory.dmp
memory/3964-122-0x0000000007AA0000-0x0000000007AC2000-memory.dmp
memory/3964-121-0x00000000077D2000-0x00000000077D3000-memory.dmp
memory/3964-120-0x0000000007E10000-0x0000000008438000-memory.dmp
memory/3964-119-0x00000000077D0000-0x00000000077D1000-memory.dmp
memory/3964-118-0x00000000050B0000-0x00000000050E6000-memory.dmp