Analysis

  • max time kernel
    264s
  • max time network
    460s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 14:14

General

  • Target

    Video.mp4.scr

  • Size

    700MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.177:9425

Attributes
  • auth_value

    2c239ad7c28c8eab1f9626557bb9457a

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      2⤵
        PID:4996

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Credential Access

    Credentials in Files

    2
    T1081

    Discovery

    Query Registry

    1
    T1012

    Collection

    Data from Local System

    2
    T1005

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3816-130-0x0000000000E90000-0x0000000001016000-memory.dmp
      Filesize

      1MB

    • memory/3816-131-0x0000000005F80000-0x0000000006524000-memory.dmp
      Filesize

      5MB

    • memory/3816-132-0x00000000058C0000-0x0000000005952000-memory.dmp
      Filesize

      584KB

    • memory/3816-133-0x0000000005890000-0x000000000589A000-memory.dmp
      Filesize

      40KB

    • memory/4996-134-0x0000000000000000-mapping.dmp
    • memory/4996-135-0x0000000000400000-0x0000000000420000-memory.dmp
      Filesize

      128KB

    • memory/4996-136-0x0000000005F20000-0x0000000006538000-memory.dmp
      Filesize

      6MB

    • memory/4996-137-0x00000000059C0000-0x00000000059D2000-memory.dmp
      Filesize

      72KB

    • memory/4996-138-0x0000000005AF0000-0x0000000005BFA000-memory.dmp
      Filesize

      1MB

    • memory/4996-139-0x0000000005A20000-0x0000000005A5C000-memory.dmp
      Filesize

      240KB

    • memory/4996-140-0x00000000065F0000-0x0000000006656000-memory.dmp
      Filesize

      408KB

    • memory/4996-141-0x00000000068E0000-0x0000000006956000-memory.dmp
      Filesize

      472KB

    • memory/4996-142-0x0000000006BC0000-0x0000000006BDE000-memory.dmp
      Filesize

      120KB

    • memory/4996-143-0x0000000001780000-0x00000000017D0000-memory.dmp
      Filesize

      320KB