Overview
overview
10Static
static
DATA PROTE...32.dll
windows7_x64
1DATA PROTE...32.dll
windows10-2004_x64
1DATA PROTE...se.dll
windows7_x64
1DATA PROTE...se.dll
windows10-2004_x64
1DATA PROTE...l3.dll
windows7_x64
1DATA PROTE...l3.dll
windows10-2004_x64
1Video.mp4.scr
windows7_x64
1Video.mp4.scr
windows10-2004_x64
10Analysis
-
max time kernel
264s -
max time network
460s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
02-05-2022 14:14
Static task
static1
Behavioral task
behavioral1
Sample
DATA PROTECTION/advapi32.dll
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
DATA PROTECTION/advapi32.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral3
Sample
DATA PROTECTION/combase.dll
Resource
win7-20220414-en
Behavioral task
behavioral4
Sample
DATA PROTECTION/combase.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral5
Sample
DATA PROTECTION/freebl3.dll
Resource
win7-20220414-en
Behavioral task
behavioral6
Sample
DATA PROTECTION/freebl3.dll
Resource
win10v2004-20220414-en
Behavioral task
behavioral7
Sample
Video.mp4.scr
Resource
win7-20220414-en
General
-
Target
Video.mp4.scr
-
Size
700MB
-
MD5
403fc6029a35c21a7d31d657cec40f0a
-
SHA1
f669ea4ffe545d76eb329dfd10e3fe6145e0950d
-
SHA256
30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb
-
SHA512
37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843
Malware Config
Extracted
redline
1
62.204.41.177:9425
-
auth_value
2c239ad7c28c8eab1f9626557bb9457a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral8/memory/4996-135-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
Video.mp4.scrdescription pid process target process PID 3816 set thread context of 4996 3816 Video.mp4.scr Video.mp4.scr -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Video.mp4.scrpid process 3816 Video.mp4.scr 3816 Video.mp4.scr -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Video.mp4.scrdescription pid process Token: SeDebugPrivilege 3816 Video.mp4.scr -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
Video.mp4.scrdescription pid process target process PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr PID 3816 wrote to memory of 4996 3816 Video.mp4.scr Video.mp4.scr
Processes
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr"C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Video.mp4.scrC:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Downloads
-
memory/3816-130-0x0000000000E90000-0x0000000001016000-memory.dmpFilesize
1MB
-
memory/3816-131-0x0000000005F80000-0x0000000006524000-memory.dmpFilesize
5MB
-
memory/3816-132-0x00000000058C0000-0x0000000005952000-memory.dmpFilesize
584KB
-
memory/3816-133-0x0000000005890000-0x000000000589A000-memory.dmpFilesize
40KB
-
memory/4996-134-0x0000000000000000-mapping.dmp
-
memory/4996-135-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/4996-136-0x0000000005F20000-0x0000000006538000-memory.dmpFilesize
6MB
-
memory/4996-137-0x00000000059C0000-0x00000000059D2000-memory.dmpFilesize
72KB
-
memory/4996-138-0x0000000005AF0000-0x0000000005BFA000-memory.dmpFilesize
1MB
-
memory/4996-139-0x0000000005A20000-0x0000000005A5C000-memory.dmpFilesize
240KB
-
memory/4996-140-0x00000000065F0000-0x0000000006656000-memory.dmpFilesize
408KB
-
memory/4996-141-0x00000000068E0000-0x0000000006956000-memory.dmpFilesize
472KB
-
memory/4996-142-0x0000000006BC0000-0x0000000006BDE000-memory.dmpFilesize
120KB
-
memory/4996-143-0x0000000001780000-0x00000000017D0000-memory.dmpFilesize
320KB