Analysis
- max time kernel
63s - max time network
126s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
- submitted
09/10/2022, 01:14
General
- Target b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a5.exe
- Size 463KB
- Sample221009-blm6ysgbfj
- SHA256 b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a58c9c183b33f02c2fcd8
Malware Config
Extracted
-
redline
-
newpatch13
-
lanalannnal.xyz:81
-
auth_value
b3a5f8bc32de5f2abc4d5f99402f33ab
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a5.exe"C:\Users\Admin\AppData\Local\Temp\b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a5.exeC:\Users\Admin\AppData\Local\Temp\b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a5.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
b2dbec9d623300bf09f55ec179a2b5e4cd5a4c6cea7a5.exe.log
memory/2284-141-0x0000000005450000-0x0000000005462000-memory.dmp
memory/2284-140-0x0000000005520000-0x000000000562A000-memory.dmp
memory/2284-145-0x0000000009110000-0x000000000963C000-memory.dmp
memory/2284-144-0x0000000008A10000-0x0000000008BD2000-memory.dmp
memory/2284-138-0x0000000000400000-0x0000000000428000-memory.dmp
memory/2284-139-0x00000000059A0000-0x0000000005FB8000-memory.dmp
memory/2284-143-0x0000000006A30000-0x0000000006A96000-memory.dmp
memory/2284-142-0x00000000054D0000-0x000000000550C000-memory.dmp
memory/2580-132-0x0000000000CC0000-0x0000000000D3A000-memory.dmp
memory/2580-134-0x0000000007CE0000-0x0000000007D72000-memory.dmp
memory/2580-136-0x0000000007CB0000-0x0000000007CCE000-memory.dmp
memory/2580-135-0x0000000008000000-0x0000000008076000-memory.dmp
memory/2580-133-0x00000000081F0000-0x0000000008794000-memory.dmp