Analysis
- max time kernel
61s - max time network
181s - platform
windows10-1703_x64 - resource
win10-20220901-en - resource tags
- submitted
27/10/2022, 22:19
General
- Target d83ac009521c27f71fcb6d2306c4ac7f613bc4487913c1f1bec7eefdae8e4ae5.exe
- Size 555KB
- Sample221027-18ln3sdfg9
- SHA256 d83ac009521c27f71fcb6d2306c4ac7f613bc4487913c1f1bec7eefdae8e4ae5
Malware Config
Extracted
-
redline
-
CHUBAKA
-
77.73.133.87:25907
-
auth_value
1317d86704d0c967986f3aa7c5c95a1a
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\d83ac009521c27f71fcb6d2306c4ac7f613bc4487913c1f1bec7eefdae8e4ae5.exe"C:\Users\Admin\AppData\Local\Temp\d83ac009521c27f71fcb6d2306c4ac7f613bc4487913c1f1bec7eefdae8e4ae5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d83ac009521c27f71fcb6d2306c4ac7f613bc4487913c1f1bec7eefdae8e4ae5.exe"C:\Users\Admin\AppData\Local\Temp\d83ac009521c27f71fcb6d2306c4ac7f613bc4487913c1f1bec7eefdae8e4ae5.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4800-120-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-121-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-122-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-123-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-124-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-125-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-126-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-127-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-128-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-129-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-130-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-131-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-132-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-133-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-134-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-135-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-136-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-137-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-138-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-139-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-140-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/4800-141-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-142-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5096-144-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-145-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-146-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-147-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-148-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-149-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5096-150-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-151-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-152-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-153-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-154-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-155-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-156-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-157-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-158-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-160-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-159-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-161-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-162-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-163-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-165-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-164-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5096-166-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-167-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-168-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-169-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5096-170-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-171-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-172-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-173-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-174-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-175-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-176-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-177-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-178-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-179-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-180-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-181-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-182-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-183-0x00000000048B0000-0x00000000048EE000-memory.dmp
memory/5096-184-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-185-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-186-0x0000000077530000-0x00000000776BE000-memory.dmp
memory/5096-188-0x0000000004A50000-0x0000000004F4E000-memory.dmp
memory/5096-190-0x0000000004940000-0x000000000497C000-memory.dmp
memory/5096-192-0x0000000004990000-0x0000000004A22000-memory.dmp
memory/5096-208-0x0000000005210000-0x0000000005816000-memory.dmp
memory/5096-209-0x0000000005020000-0x000000000512A000-memory.dmp
memory/5096-211-0x0000000005160000-0x0000000005172000-memory.dmp
memory/5096-213-0x0000000005180000-0x00000000051BE000-memory.dmp
memory/5096-215-0x0000000005920000-0x000000000596B000-memory.dmp
memory/5096-219-0x0000000000400000-0x0000000000441000-memory.dmp
memory/5096-221-0x0000000005A80000-0x0000000005AE6000-memory.dmp
memory/5096-229-0x00000000062B0000-0x0000000006472000-memory.dmp
memory/5096-230-0x0000000006480000-0x00000000069AC000-memory.dmp
memory/5096-240-0x0000000000400000-0x0000000000441000-memory.dmp