Analysis

  • max time kernel
    141s
  • max time network
    183s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    29-04-2022 13:10

General

  • Target

    MVPInstaller.exe

  • Size

    255KB

  • MD5

    883eb374a6710283bab49bd840d911c7

  • SHA1

    29416739657f2d2b7a900dca6ddeda755852818e

  • SHA256

    24bde190edd5fda4b47d376abef29d385d655c11ccfdeb314ffced065675cad4

  • SHA512

    b2a159e495624cee478be7d3ff409c9d89eb6e8cb021904ab302df4910874013a305ea10100fae12685d8fc0694d84c553e4f61a194498fd0d5ee2bf6cc5527d

Malware Config

Extracted

Family

redline

Botnet

1

C2

116.202.19.253:30602

Attributes
auth_value
da0d7d77d8ec04c55cc5ace3d9113a5c

Signatures 8

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 4 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 2 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 8 IoCs

Processes 2

  • C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
    "C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe"
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:2580
    • C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
      C:\Users\Admin\AppData\Local\Temp\MVPInstaller.exe
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      PID:3800

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Discovery

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\MVPInstaller.exe.log
                      MD5

                      df27a876383bd81dfbcb457a9fa9f09d

                      SHA1

                      1bbc4ab95c89d02ec1d217f0255205787999164e

                      SHA256

                      8940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc

                      SHA512

                      fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844

                    • memory/2580-131-0x0000000005F30000-0x00000000064D4000-memory.dmp
                    • memory/2580-132-0x0000000005890000-0x0000000005922000-memory.dmp
                    • memory/2580-133-0x0000000005880000-0x000000000588A000-memory.dmp
                    • memory/2580-130-0x0000000000E50000-0x0000000000E92000-memory.dmp
                    • memory/3800-138-0x0000000004CE0000-0x0000000004CF2000-memory.dmp
                    • memory/3800-135-0x0000000000400000-0x000000000041C000-memory.dmp
                    • memory/3800-137-0x0000000005270000-0x0000000005888000-memory.dmp
                    • memory/3800-134-0x0000000000000000-mapping.dmp
                    • memory/3800-139-0x0000000004E10000-0x0000000004F1A000-memory.dmp
                    • memory/3800-140-0x0000000004D40000-0x0000000004D7C000-memory.dmp
                    • memory/3800-141-0x0000000005080000-0x00000000050E6000-memory.dmp
                    • memory/3800-142-0x0000000005D10000-0x0000000005D86000-memory.dmp
                    • memory/3800-143-0x0000000005EE0000-0x0000000005EFE000-memory.dmp
                    • memory/3800-144-0x0000000007570000-0x0000000007732000-memory.dmp
                    • memory/3800-145-0x0000000007C70000-0x000000000819C000-memory.dmp
                    • memory/3800-146-0x0000000006840000-0x0000000006890000-memory.dmp