Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20220414-en - submitted
14/07/2022, 14:41
General
- Target db2432e8e08e1b6fd784c26b3a753115.exe
- Size 219KB
- Sample220714-r2eshshaaj
- SHA256 b5b66ebc918b440dbe042fa1ac958ee4bc6a1bb2249a77d69d25d2c9ed4f6dc1
Malware Config
Extracted
-
redline
-
@KabanaKusok
-
62.204.41.144:14096
-
auth_value
75c79f82a7ba65b9453ab8eeb67288f0
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 4 IoCs
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious behavior: GetForegroundWindowSpam 1 IoCs
- Suspicious behavior: MapViewOfSection 1 IoCs
- Suspicious use of AdjustPrivilegeToken 14 IoCs
- Suspicious use of WriteProcessMemory 20 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\db2432e8e08e1b6fd784c26b3a753115.exe"C:\Users\Admin\AppData\Local\Temp\db2432e8e08e1b6fd784c26b3a753115.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
-
C:\Users\Admin\AppData\Local\Temp\43CF.exeC:\Users\Admin\AppData\Local\Temp\43CF.exe1⤵
- Executes dropped EXE
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\43CF.exeC:\Users\Admin\AppData\Local\Temp\43CF.exe2⤵
- Executes dropped EXE
-
-
C:\Users\Admin\AppData\Local\Temp\43CF.exeC:\Users\Admin\AppData\Local\Temp\43CF.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\4864.exeC:\Users\Admin\AppData\Local\Temp\4864.exe1⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
43CF.exe.log
43CF.exe
43CF.exe
43CF.exe
43CF.exe
4864.exe
4864.exe
memory/968-170-0x0000000007810000-0x0000000007D3C000-memory.dmp
memory/968-171-0x0000000002D70000-0x0000000002DC0000-memory.dmp
memory/968-164-0x0000000000400000-0x0000000000420000-memory.dmp
memory/968-169-0x0000000007110000-0x00000000072D2000-memory.dmp
memory/968-168-0x0000000006220000-0x000000000623E000-memory.dmp
memory/968-167-0x0000000005A30000-0x0000000005AA6000-memory.dmp
memory/1792-133-0x0000000000400000-0x0000000000634000-memory.dmp
memory/1792-130-0x00000000006BD000-0x00000000006CB000-memory.dmp
memory/1792-132-0x0000000000400000-0x0000000000634000-memory.dmp
memory/1792-131-0x0000000002230000-0x0000000002239000-memory.dmp
memory/2020-138-0x0000000005A00000-0x0000000005FA4000-memory.dmp
memory/2020-143-0x00000000053B0000-0x00000000053BA000-memory.dmp
memory/2020-139-0x0000000005300000-0x0000000005392000-memory.dmp
memory/2020-137-0x0000000000900000-0x0000000000944000-memory.dmp
memory/4376-150-0x0000000000C2D000-0x0000000000C57000-memory.dmp
memory/4376-152-0x0000000000400000-0x0000000000A33000-memory.dmp
memory/4376-156-0x0000000005D20000-0x0000000005E2A000-memory.dmp
memory/4376-157-0x0000000005E70000-0x0000000005EAC000-memory.dmp
memory/4376-151-0x0000000000AB0000-0x0000000000AE8000-memory.dmp
memory/4376-160-0x0000000000C2D000-0x0000000000C57000-memory.dmp
memory/4376-154-0x0000000005D00000-0x0000000005D12000-memory.dmp
memory/4376-153-0x00000000056B0000-0x0000000005CC8000-memory.dmp
memory/4472-159-0x00000000067E0000-0x00000000067FA000-memory.dmp
memory/4472-155-0x00000000062E0000-0x00000000062FE000-memory.dmp
memory/4472-149-0x0000000005DF0000-0x0000000005E56000-memory.dmp
memory/4472-148-0x0000000005D80000-0x0000000005DE6000-memory.dmp
memory/4472-147-0x0000000005330000-0x0000000005352000-memory.dmp
memory/4472-146-0x0000000005650000-0x0000000005C78000-memory.dmp
memory/4472-145-0x00000000029D0000-0x0000000002A06000-memory.dmp
memory/4472-158-0x0000000007B40000-0x00000000081BA000-memory.dmp