Analysis
- max time kernel
90s - max time network
130s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
26/09/2022, 15:16
General
- Target chrom.exe
- Size 3.9MB
- Sample220926-snfy4abbf3
- SHA256 2d241ce3d2981c29545a11c13ec0ecd7e021759d35dea0c762bb0c63bb1b555d
Malware Config
Extracted
-
redline
-
Crypt_Mastif
-
194.36.177.60:81
-
auth_value
26018289184445b16046125f5e616df6
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- YTStealer
YTStealer is a malware designed to steal YouTube authentication cookies.
- YTStealer payload 3 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- UPX packed file 5 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 4 IoCs
- Suspicious use of WriteProcessMemory 15 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\chrom.exe"C:\Users\Admin\AppData\Local\Temp\chrom.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQA1AA==2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\chrom.exeC:\Users\Admin\AppData\Local\Temp\chrom.exe2⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"C:\Users\Admin\AppData\Local\Temp\22windows_64.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell "" "Get-WmiObject Win32_PortConnector"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
chrom.exe.log
ModuleAnalysisCache
StartupProfileData-NonInteractive
22windows_64.exe
22windows_64.exe
memory/364-132-0x0000000000B90000-0x0000000000F76000-memory.dmp
memory/364-133-0x0000000007190000-0x00000000071B2000-memory.dmp
memory/936-140-0x0000000007110000-0x000000000778A000-memory.dmp
memory/936-139-0x0000000005A80000-0x0000000005A9E000-memory.dmp
memory/936-141-0x0000000005F90000-0x0000000005FAA000-memory.dmp
memory/936-135-0x0000000002150000-0x0000000002186000-memory.dmp
memory/936-138-0x0000000005300000-0x0000000005366000-memory.dmp
memory/936-136-0x0000000004BF0000-0x0000000005218000-memory.dmp
memory/936-137-0x0000000005290000-0x00000000052F6000-memory.dmp
memory/3400-152-0x000000000B3E0000-0x000000000B90C000-memory.dmp
memory/3400-145-0x0000000006390000-0x00000000069A8000-memory.dmp
memory/3400-149-0x000000000A2B0000-0x000000000A342000-memory.dmp
memory/3400-150-0x000000000A900000-0x000000000AEA4000-memory.dmp
memory/3400-151-0x000000000A700000-0x000000000A8C2000-memory.dmp
memory/3400-147-0x0000000009020000-0x0000000009032000-memory.dmp
memory/3400-153-0x0000000005DF0000-0x0000000005E66000-memory.dmp
memory/3400-154-0x0000000005E70000-0x0000000005EC0000-memory.dmp
memory/3400-146-0x00000000090D0000-0x00000000091DA000-memory.dmp
memory/3400-148-0x0000000009080000-0x00000000090BC000-memory.dmp
memory/3400-143-0x0000000000400000-0x0000000000428000-memory.dmp
memory/4620-159-0x0000000000150000-0x0000000000F62000-memory.dmp
memory/4620-158-0x0000000000150000-0x0000000000F62000-memory.dmp
memory/4620-166-0x0000000000150000-0x0000000000F62000-memory.dmp
memory/4760-161-0x000001EEE0370000-0x000001EEE0392000-memory.dmp
memory/4760-164-0x00007FFFE70A0000-0x00007FFFE7B61000-memory.dmp
memory/4760-165-0x00007FFFE70A0000-0x00007FFFE7B61000-memory.dmp