Overview
overview
10Static
static
DATA PROTE...32.dll
windows7_x64
1DATA PROTE...32.dll
windows10-2004_x64
1DATA PROTE...se.dll
windows7_x64
1DATA PROTE...se.dll
windows10-2004_x64
1DATA PROTE...l3.dll
windows7_x64
1DATA PROTE...l3.dll
windows10-2004_x64
1Video.mp4.scr
windows7_x64
10Video.mp4.scr
windows10-2004_x64
10Analysis
-
max time kernel
144s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 10:46
Static task
static1
Behavioral task
behavioral1
Sample
DATA PROTECTION/advapi32.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DATA PROTECTION/advapi32.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
DATA PROTECTION/combase.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
DATA PROTECTION/combase.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
DATA PROTECTION/freebl3.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
DATA PROTECTION/freebl3.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Video.mp4.scr
Resource
win7-20220414-en
General
-
Target
Video.mp4.scr
-
Size
700.0MB
-
MD5
403fc6029a35c21a7d31d657cec40f0a
-
SHA1
f669ea4ffe545d76eb329dfd10e3fe6145e0950d
-
SHA256
30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb
-
SHA512
37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843
Malware Config
Extracted
redline
1
62.204.41.177:9425
-
auth_value
2c239ad7c28c8eab1f9626557bb9457a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral8/memory/3004-136-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Video.mp4.scrdescription pid process target process PID 4324 set thread context of 3004 4324 Video.mp4.scr Video.mp4.scr -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
Video.mp4.scrVideo.mp4.scrpid process 4324 Video.mp4.scr 4324 Video.mp4.scr 4324 Video.mp4.scr 4324 Video.mp4.scr 4324 Video.mp4.scr 4324 Video.mp4.scr 3004 Video.mp4.scr -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Video.mp4.scrVideo.mp4.scrdescription pid process Token: SeDebugPrivilege 4324 Video.mp4.scr Token: SeDebugPrivilege 3004 Video.mp4.scr -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
Video.mp4.scrdescription pid process target process PID 4324 wrote to memory of 4852 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 4852 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 4852 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr PID 4324 wrote to memory of 3004 4324 Video.mp4.scr Video.mp4.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr"C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\Video.mp4.scr.logFilesize
1KB
MD5df27a876383bd81dfbcb457a9fa9f09d
SHA11bbc4ab95c89d02ec1d217f0255205787999164e
SHA2568940500d6f057583903fde1af0287e27197410415639fc69beb39475fa5240dc
SHA512fe68271375002cfcf8585c92b948ae47cd1632919c43db4bc738e2bc85ceea6dd30880dba27df9c3317531f1017624d4bd8979e6c5fad58112c7aa1189f0b844
-
memory/3004-142-0x00000000058F0000-0x0000000005956000-memory.dmpFilesize
408KB
-
memory/3004-135-0x0000000000000000-mapping.dmp
-
memory/3004-139-0x0000000005460000-0x0000000005472000-memory.dmpFilesize
72KB
-
memory/3004-147-0x0000000007780000-0x0000000007CAC000-memory.dmpFilesize
5.2MB
-
memory/3004-140-0x0000000005590000-0x000000000569A000-memory.dmpFilesize
1.0MB
-
memory/3004-136-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3004-146-0x0000000007080000-0x0000000007242000-memory.dmpFilesize
1.8MB
-
memory/3004-141-0x00000000054C0000-0x00000000054FC000-memory.dmpFilesize
240KB
-
memory/3004-145-0x0000000006E60000-0x0000000006EB0000-memory.dmpFilesize
320KB
-
memory/3004-144-0x0000000006660000-0x000000000667E000-memory.dmpFilesize
120KB
-
memory/3004-138-0x00000000059E0000-0x0000000005FF8000-memory.dmpFilesize
6.1MB
-
memory/3004-143-0x0000000006480000-0x00000000064F6000-memory.dmpFilesize
472KB
-
memory/4324-130-0x00000000008F0000-0x0000000000A76000-memory.dmpFilesize
1.5MB
-
memory/4324-132-0x0000000005460000-0x00000000054F2000-memory.dmpFilesize
584KB
-
memory/4324-133-0x00000000055F0000-0x00000000055FA000-memory.dmpFilesize
40KB
-
memory/4324-131-0x0000000005970000-0x0000000005F14000-memory.dmpFilesize
5.6MB
-
memory/4852-134-0x0000000000000000-mapping.dmp