Analysis

  • max time kernel
    90s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    26-01-2023 21:46

General

  • Target

    tmp77EA.tmp.exe

  • Size

    2.3MB

  • MD5

    1d85c4d35f557fbbde158258300b753f

  • SHA1

    1a0f596ee4f5abdb3dc3bad8a1247625fce982ea

  • SHA256

    36ccb94aa071489c4f03b72cd09c2560e40d66e541e006b5f6ca1b6e84ef2e1a

  • SHA512

    09aa7748f392dd2104672e4f774d717298659bb6df21db51de8455e01dba0ee0d5761ecf7cf5bd24eaae80943b91ed4ab189d1e1a0df9621636bb33a2e2cdd52

  • SSDEEP

    49152:Vg9FpS1fbJT9VhpwKxh5ors6lz1u1M6s1V2hcCudLP1FqDfk:S9FpYJT9pw+2sMz1u1M6s/2HIPjqDc

Malware Config

Extracted

Family

redline

Botnet

redline

C2

79.137.133.225:25999

Attributes
  • auth_value

    38284dbf15da9b4a9eaee0ef0d2b343f

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of SetThreadContext 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\tmp77EA.tmp.exe
    "C:\Users\Admin\AppData\Local\Temp\tmp77EA.tmp.exe"
    1⤵
    • Checks computer location settings
    • Suspicious use of SetThreadContext
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4856
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ENC cwB0AGEAcgB0AC0AcwBsAGUAZQBwACAALQBzAGUAYwBvAG4AZABzACAAMgAwAA==
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4576
    • C:\Users\Admin\AppData\Local\Temp\tmp77EA.tmp.exe
      C:\Users\Admin\AppData\Local\Temp\tmp77EA.tmp.exe
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:3132

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\tmp77EA.tmp.exe.log
    Filesize

    1KB

    MD5

    2bea5ace75c1c406471930d05acf41f1

    SHA1

    fb20b843c1bf0340d17793752b9bca1e2e0333ba

    SHA256

    56036effd69e1a8cf8f77bb8acfee51f312865979e734638a2ad8f089d078d73

    SHA512

    86a8af16f5ff8436418bddb4ff59211c770353416ef262bad0a36b2b5afa1ab766c63fd93a5d02c323c0504e10bbff43d5ff6cadc01739f64e135a6a9b388b1c

  • memory/3132-144-0x0000000000000000-mapping.dmp
  • memory/3132-154-0x0000000007F10000-0x000000000843C000-memory.dmp
    Filesize

    5.2MB

  • memory/3132-153-0x0000000007140000-0x0000000007302000-memory.dmp
    Filesize

    1.8MB

  • memory/3132-152-0x0000000006570000-0x00000000065C0000-memory.dmp
    Filesize

    320KB

  • memory/3132-151-0x00000000064F0000-0x0000000006566000-memory.dmp
    Filesize

    472KB

  • memory/3132-150-0x0000000005540000-0x000000000557C000-memory.dmp
    Filesize

    240KB

  • memory/3132-149-0x00000000054E0000-0x00000000054F2000-memory.dmp
    Filesize

    72KB

  • memory/3132-148-0x00000000055B0000-0x00000000056BA000-memory.dmp
    Filesize

    1.0MB

  • memory/3132-147-0x0000000005A30000-0x0000000006048000-memory.dmp
    Filesize

    6.1MB

  • memory/3132-145-0x0000000000400000-0x0000000000432000-memory.dmp
    Filesize

    200KB

  • memory/4576-137-0x0000000005FD0000-0x0000000006036000-memory.dmp
    Filesize

    408KB

  • memory/4576-141-0x0000000006B70000-0x0000000006B8A000-memory.dmp
    Filesize

    104KB

  • memory/4576-140-0x0000000007F00000-0x000000000857A000-memory.dmp
    Filesize

    6.5MB

  • memory/4576-139-0x0000000006690000-0x00000000066AE000-memory.dmp
    Filesize

    120KB

  • memory/4576-138-0x0000000006040000-0x00000000060A6000-memory.dmp
    Filesize

    408KB

  • memory/4576-136-0x0000000005830000-0x0000000005E58000-memory.dmp
    Filesize

    6.2MB

  • memory/4576-135-0x00000000030F0000-0x0000000003126000-memory.dmp
    Filesize

    216KB

  • memory/4576-134-0x0000000000000000-mapping.dmp
  • memory/4856-143-0x0000000006EF0000-0x0000000007494000-memory.dmp
    Filesize

    5.6MB

  • memory/4856-142-0x00000000059D0000-0x0000000005A62000-memory.dmp
    Filesize

    584KB

  • memory/4856-132-0x0000000000870000-0x0000000000ACE000-memory.dmp
    Filesize

    2.4MB

  • memory/4856-133-0x0000000005820000-0x0000000005842000-memory.dmp
    Filesize

    136KB