Analysis

  • max time kernel
    264s
  • max time network
    460s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 14:14

General

  • Target

    Video.mp4.scr

  • Size

    700MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.177:9425

Attributes
auth_value
2c239ad7c28c8eab1f9626557bb9457a

Signatures 9

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload ⋅ 1 IoCs
  • Reads user/profile data of web browsers ⋅ 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting ⋅ 2 TTPs
  • Checks installed software on the system ⋅ 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext ⋅ 1 IoCs
  • Suspicious behavior: EnumeratesProcesses ⋅ 2 IoCs
  • Suspicious use of AdjustPrivilegeToken ⋅ 1 IoCs
  • Suspicious use of WriteProcessMemory ⋅ 8 IoCs

Processes 2

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    Suspicious use of SetThreadContext
    Suspicious behavior: EnumeratesProcesses
    Suspicious use of AdjustPrivilegeToken
    Suspicious use of WriteProcessMemory
    PID:3816
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      PID:4996

Network

MITRE ATT&CK Matrix

Command and Control

    Credential Access

    Defense Evasion

      Discovery

      Execution

        Exfiltration

          Impact

            Initial Access

              Lateral Movement

                Persistence

                  Privilege Escalation

                    Replay Monitor

                    00:00 00:00

                    Downloads

                    • memory/3816-130-0x0000000000E90000-0x0000000001016000-memory.dmp
                    • memory/3816-131-0x0000000005F80000-0x0000000006524000-memory.dmp
                    • memory/3816-132-0x00000000058C0000-0x0000000005952000-memory.dmp
                    • memory/3816-133-0x0000000005890000-0x000000000589A000-memory.dmp
                    • memory/4996-134-0x0000000000000000-mapping.dmp
                    • memory/4996-135-0x0000000000400000-0x0000000000420000-memory.dmp
                    • memory/4996-136-0x0000000005F20000-0x0000000006538000-memory.dmp
                    • memory/4996-137-0x00000000059C0000-0x00000000059D2000-memory.dmp
                    • memory/4996-138-0x0000000005AF0000-0x0000000005BFA000-memory.dmp
                    • memory/4996-139-0x0000000005A20000-0x0000000005A5C000-memory.dmp
                    • memory/4996-140-0x00000000065F0000-0x0000000006656000-memory.dmp
                    • memory/4996-141-0x00000000068E0000-0x0000000006956000-memory.dmp
                    • memory/4996-142-0x0000000006BC0000-0x0000000006BDE000-memory.dmp
                    • memory/4996-143-0x0000000001780000-0x00000000017D0000-memory.dmp