Analysis
- max time kernel
109s - max time network
114s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
- submitted
27/08/2022, 00:36
General
- Target f238d234749b0c7bdddfd9a5b851ccbdee1b4dcbde43d.exe
- Size 919KB
- Sample220827-axyamabfen
- SHA256 f238d234749b0c7bdddfd9a5b851ccbdee1b4dcbde43d3affd488c48b53d306b
Malware Config
Extracted
-
redline
-
37.1.208.45:20832
-
auth_value
094fde2e383371e2560d6478c169cc6c
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 6 IoCs
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\f238d234749b0c7bdddfd9a5b851ccbdee1b4dcbde43d.exe"C:\Users\Admin\AppData\Local\Temp\f238d234749b0c7bdddfd9a5b851ccbdee1b4dcbde43d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMgAwAA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_compiler.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/456-61-0x000000006EA60000-0x000000006F00B000-memory.dmp
memory/456-59-0x000000006EA60000-0x000000006F00B000-memory.dmp
memory/456-60-0x000000006EA60000-0x000000006F00B000-memory.dmp
memory/1448-66-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1448-63-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1448-65-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1448-62-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1448-67-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1448-70-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1448-72-0x0000000000400000-0x0000000000420000-memory.dmp
memory/1944-56-0x0000000005840000-0x00000000059BE000-memory.dmp
memory/1944-55-0x0000000076831000-0x0000000076833000-memory.dmp
memory/1944-54-0x0000000000210000-0x00000000002FC000-memory.dmp