Analysis
- max time kernel
4294203s - max time network
165s - platform
windows7_x64 - resource
win7-20220310-en - submitted
25/03/2022, 00:39
General
- Target 8e053405793e2bda9a6de93379fe5188.exe
- Size 623KB
- Sample220325-azmlxaeabl
- SHA256 feb32b614bc7f38cc0b553b5fee80b7e68ad8ae78df1f1cae4016a5aa1c4677a
Malware Config
Extracted
-
redline
-
mix20.03
-
185.215.113.17:7700
-
auth_value
97d68809327425ee29120657cb17339b
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
suricata: ET MALWARE Terse alphanumeric executable downloader high likelihood of being hostile
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 4 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e053405793e2bda9a6de93379fe5188.exe"C:\Users\Admin\AppData\Local\Temp\8e053405793e2bda9a6de93379fe5188.exe"1⤵
- Loads dropped DLL
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\dwefr\neofiten.exeneofiten.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1740-54-0x000000000066B000-0x00000000006D7000-memory.dmp
memory/1740-55-0x0000000075441000-0x0000000075443000-memory.dmp
memory/1740-56-0x000000000066B000-0x00000000006D7000-memory.dmp
memory/1740-57-0x0000000000250000-0x000000000031E000-memory.dmp
memory/1740-58-0x0000000000400000-0x00000000004D4000-memory.dmp
memory/1976-63-0x000000000063B000-0x0000000000668000-memory.dmp
memory/1976-64-0x000000000063B000-0x0000000000668000-memory.dmp
memory/1976-65-0x0000000000230000-0x000000000026A000-memory.dmp
memory/1976-66-0x0000000000400000-0x0000000000490000-memory.dmp
memory/1976-67-0x0000000001E50000-0x0000000001E86000-memory.dmp
memory/1976-68-0x0000000004730000-0x0000000004764000-memory.dmp
memory/1976-69-0x00000000048E4000-0x00000000048E6000-memory.dmp