Analysis
- max time kernel
131s - max time network
155s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
26/03/2022, 06:40
General
- Target ANTIBAN.exe
- Size 595KB
- Sample220326-hfbpashdb8
- SHA256 bfc74cb119f38986f6b4a00e3a342363221201b0375ea9331edd63c8ac1470d0
Malware Config
Extracted
-
redline
-
91.243.32.216:38206
-
auth_value
1759966b9bc387bf5f5f4ba30a48570d
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ANTIBAN.exe"C:\Users\Admin\AppData\Local\Temp\ANTIBAN.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\cheat.exe"C:\Users\Admin\AppData\Local\Temp\cheat.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2380-131-0x0000000003300000-0x0000000003303000-memory.dmp
memory/2380-130-0x0000000002220000-0x0000000002280000-memory.dmp
memory/3444-144-0x00000000061A0000-0x0000000006232000-memory.dmp
memory/3444-147-0x0000000006C10000-0x0000000006C60000-memory.dmp
memory/3444-140-0x0000000005360000-0x000000000546A000-memory.dmp
memory/3444-141-0x0000000005290000-0x00000000052CC000-memory.dmp
memory/3444-142-0x00000000055B0000-0x0000000005616000-memory.dmp
memory/3444-143-0x0000000006660000-0x0000000006C04000-memory.dmp
memory/3444-138-0x0000000005790000-0x0000000005DA8000-memory.dmp
memory/3444-145-0x0000000006240000-0x00000000062B6000-memory.dmp
memory/3444-146-0x0000000006360000-0x000000000637E000-memory.dmp
memory/3444-139-0x0000000005230000-0x0000000005242000-memory.dmp
memory/3444-148-0x0000000006F30000-0x00000000070F2000-memory.dmp
memory/3444-149-0x0000000007630000-0x0000000007B5C000-memory.dmp
memory/3444-133-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4308-153-0x0000000000B50000-0x0000000000B5A000-memory.dmp
memory/4308-154-0x0000000005460000-0x000000000546A000-memory.dmp