Analysis
- max time kernel
4294181s - max time network
123s - platform
windows7_x64 - resource
win7-20220311-en - submitted
26/03/2022, 06:40
General
- Target ANTIBAN.exe
- Size 595KB
- Sample220326-hfbpashdb8
- SHA256 bfc74cb119f38986f6b4a00e3a342363221201b0375ea9331edd63c8ac1470d0
Score
10/10
Malware Config
Extracted
Family
-
redline
C2
-
91.243.32.216:38206
Attributes
-
auth_value
1759966b9bc387bf5f5f4ba30a48570d
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 16 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ANTIBAN.exe"C:\Users\Admin\AppData\Local\Temp\ANTIBAN.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/304-72-0x00000000002C0000-0x00000000002CA000-memory.dmp
memory/1836-64-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1836-66-0x0000000075D31000-0x0000000075D33000-memory.dmp
memory/1836-65-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1836-56-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1836-58-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2024-54-0x0000000000360000-0x00000000003C0000-memory.dmp
memory/2024-55-0x00000000031F0000-0x00000000031F3000-memory.dmp