Analysis

  • max time kernel
    91s
  • max time network
    154s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-10-2022 09:06

General

  • Target

    43c315ec3be59be4ef5aa52e440fc10c.exe

  • Size

    1.4MB

  • MD5

    43c315ec3be59be4ef5aa52e440fc10c

  • SHA1

    c9b68a94fbd7519a290ec60d3a8a1eae2d8b4b84

  • SHA256

    5207dd47df6e282ee4d949282a96f83bbda7be328f65719113623512df7e4015

  • SHA512

    5914162996616ac7ffdf3a403ce24cf4645daa8af74f2b27c3c85486f38f2f80abed19e80621fe82a738e9b03a99a6e5c22121252dc450eb1e2dc4e60203b213

  • SSDEEP

    12288:OnjobNrYynWZQzjFeM6DJOjB9sTTHyeGkwhr402Gjaaz97PxYPKrzD0o9sIheoT:0ynYQb6VOKHwS0l3zVxRwo

Malware Config

Extracted

Family

redline

Botnet

K F

C2

168.119.65.166:21269

Attributes
  • auth_value

    201fc523e44306a8f2aa3fe14a3de780

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Obfuscated with Agile.Net obfuscator 1 IoCs

    Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\43c315ec3be59be4ef5aa52e440fc10c.exe
    "C:\Users\Admin\AppData\Local\Temp\43c315ec3be59be4ef5aa52e440fc10c.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1792
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc UwB0AGEAcgB0AC0AUwBsAGUAZQBwACAALQBTAGUAYwBvAG4AZABzACAAMQAyAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1808
    • C:\Users\Admin\AppData\Local\Temp\43c315ec3be59be4ef5aa52e440fc10c.exe
      C:\Users\Admin\AppData\Local\Temp\43c315ec3be59be4ef5aa52e440fc10c.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3196

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\43c315ec3be59be4ef5aa52e440fc10c.exe.log
    Filesize

    1KB

    MD5

    9aba658a35d2242208dff358cd27a85a

    SHA1

    836c4d918822cadf9aed063eefd83aa98b30c7c9

    SHA256

    616f7d5fce01e5d984b0395a4776e74977cda10e5f0c325cea4164f1f676e626

    SHA512

    b9d5d874d48eb3a504bd5864e6579e7d38d3c5e37816a6caa4ae471d89841dc6bb7c02b3d6ee80d5d2055341997bc4e0560257f15006d5d8e5313686e21bee79

  • memory/1792-133-0x00000000068C0000-0x0000000006E64000-memory.dmp
    Filesize

    5.6MB

  • memory/1792-134-0x00000000063F0000-0x0000000006482000-memory.dmp
    Filesize

    584KB

  • memory/1792-135-0x0000000006600000-0x0000000006622000-memory.dmp
    Filesize

    136KB

  • memory/1792-132-0x0000000000E30000-0x0000000000F9E000-memory.dmp
    Filesize

    1.4MB

  • memory/1808-138-0x0000000004CD0000-0x00000000052F8000-memory.dmp
    Filesize

    6.2MB

  • memory/1808-137-0x0000000002630000-0x0000000002666000-memory.dmp
    Filesize

    216KB

  • memory/1808-139-0x00000000054E0000-0x0000000005546000-memory.dmp
    Filesize

    408KB

  • memory/1808-140-0x00000000055C0000-0x0000000005626000-memory.dmp
    Filesize

    408KB

  • memory/1808-141-0x0000000005BE0000-0x0000000005BFE000-memory.dmp
    Filesize

    120KB

  • memory/1808-142-0x0000000007220000-0x000000000789A000-memory.dmp
    Filesize

    6.5MB

  • memory/1808-143-0x00000000060F0000-0x000000000610A000-memory.dmp
    Filesize

    104KB

  • memory/1808-136-0x0000000000000000-mapping.dmp
  • memory/3196-144-0x0000000000000000-mapping.dmp
  • memory/3196-145-0x0000000000400000-0x000000000041C000-memory.dmp
    Filesize

    112KB

  • memory/3196-147-0x0000000005CB0000-0x00000000062C8000-memory.dmp
    Filesize

    6.1MB

  • memory/3196-148-0x0000000005C20000-0x0000000005C32000-memory.dmp
    Filesize

    72KB

  • memory/3196-149-0x0000000007640000-0x000000000774A000-memory.dmp
    Filesize

    1.0MB

  • memory/3196-150-0x00000000075B0000-0x00000000075EC000-memory.dmp
    Filesize

    240KB

  • memory/3196-151-0x00000000083C0000-0x0000000008582000-memory.dmp
    Filesize

    1.8MB

  • memory/3196-152-0x0000000008AC0000-0x0000000008FEC000-memory.dmp
    Filesize

    5.2MB

  • memory/3196-153-0x0000000008890000-0x0000000008906000-memory.dmp
    Filesize

    472KB

  • memory/3196-154-0x0000000008850000-0x000000000886E000-memory.dmp
    Filesize

    120KB

  • memory/3196-155-0x00000000089D0000-0x0000000008A20000-memory.dmp
    Filesize

    320KB