Analysis

  • max time kernel
    139s
  • max time network
    197s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    02-05-2022 18:12

General

  • Target

    Video.mp4.scr

  • Size

    700MB

  • MD5

    403fc6029a35c21a7d31d657cec40f0a

  • SHA1

    f669ea4ffe545d76eb329dfd10e3fe6145e0950d

  • SHA256

    30ce43a0bfd9ea9192aa6df32035f8c1876d106ec369256a04c1bc0fa6b3dadb

  • SHA512

    37aaeb0390e7dfed9d7976847a84a9656a95472a0f891e0a6a541d691c895852821533f6b8865acb0e170d67aad0e5b6c5bfaa87799391b82350acb3df9c8843

Malware Config

Extracted

Family

redline

Botnet

1

C2

62.204.41.177:9425

Attributes
  • auth_value

    2c239ad7c28c8eab1f9626557bb9457a

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
    "C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr" /S
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4248
    • C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      C:\Users\Admin\AppData\Local\Temp\Video.mp4.scr
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3612

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3612-138-0x0000000005AE0000-0x0000000005BEA000-memory.dmp
    Filesize

    1MB

  • memory/3612-140-0x0000000005F10000-0x0000000005F76000-memory.dmp
    Filesize

    408KB

  • memory/3612-145-0x0000000007E00000-0x000000000832C000-memory.dmp
    Filesize

    5MB

  • memory/3612-144-0x0000000007700000-0x00000000078C2000-memory.dmp
    Filesize

    1MB

  • memory/3612-143-0x0000000007250000-0x00000000072A0000-memory.dmp
    Filesize

    320KB

  • memory/3612-135-0x0000000000400000-0x0000000000420000-memory.dmp
    Filesize

    128KB

  • memory/3612-142-0x0000000006AB0000-0x0000000006ACE000-memory.dmp
    Filesize

    120KB

  • memory/3612-136-0x0000000005FD0000-0x00000000065E8000-memory.dmp
    Filesize

    6MB

  • memory/3612-134-0x0000000000000000-mapping.dmp
  • memory/3612-139-0x0000000005A10000-0x0000000005A4C000-memory.dmp
    Filesize

    240KB

  • memory/3612-137-0x00000000059B0000-0x00000000059C2000-memory.dmp
    Filesize

    72KB

  • memory/3612-141-0x00000000069B0000-0x0000000006A26000-memory.dmp
    Filesize

    472KB

  • memory/4248-131-0x00000000052F0000-0x0000000005894000-memory.dmp
    Filesize

    5MB

  • memory/4248-130-0x0000000000180000-0x0000000000306000-memory.dmp
    Filesize

    1MB

  • memory/4248-133-0x0000000004CD0000-0x0000000004CDA000-memory.dmp
    Filesize

    40KB

  • memory/4248-132-0x0000000004D40000-0x0000000004DD2000-memory.dmp
    Filesize

    584KB