Analysis

  • max time kernel
    43s
  • max time network
    46s
  • platform
    windows7_x64
  • resource
    win7-20220414-en
  • submitted
    24-05-2022 08:32

General

  • Target

    6bec6567b548e88bb2d3c6c5a5b6c6e3.exe

  • Size

    413KB

  • MD5

    6bec6567b548e88bb2d3c6c5a5b6c6e3

  • SHA1

    3a1ecd0376d9fe226be03aac878480d1843145e0

  • SHA256

    b9e0c8e042db79dc1fccc2f56905f637b89fd12fb2f29d5aa0bde9c6cd201ed4

  • SHA512

    83fa72c29c71ef8caad41ab3698507199a264e51347112bdce1bd7d6d0426090d519bd4f965745893d495ee093277593d438db1cb0daabb0b1e3cc0fbe488a9b

Malware Config

Extracted

Family

redline

Botnet

redline

C2

193.106.191.225:15304

Attributes
  • auth_value

    7357e43942d666e37ce6cba9e0dcacd9

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6bec6567b548e88bb2d3c6c5a5b6c6e3.exe
    "C:\Users\Admin\AppData\Local\Temp\6bec6567b548e88bb2d3c6c5a5b6c6e3.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1756

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-54-0x0000000000B40000-0x0000000000B74000-memory.dmp
    Filesize

    208KB

  • memory/1756-55-0x0000000002500000-0x0000000002534000-memory.dmp
    Filesize

    208KB

  • memory/1756-57-0x00000000001B0000-0x00000000001EA000-memory.dmp
    Filesize

    232KB

  • memory/1756-56-0x00000000002CE000-0x00000000002FA000-memory.dmp
    Filesize

    176KB

  • memory/1756-58-0x0000000000400000-0x0000000000930000-memory.dmp
    Filesize

    5.2MB

  • memory/1756-59-0x00000000753B1000-0x00000000753B3000-memory.dmp
    Filesize

    8KB