Analysis
- max time kernel
145s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20230220-en - resource tags
- submitted
24/03/2023, 22:28
General
- Target SecuriteInfo.com.Win32.CrypterX-gen.18764.12891.exe
- Size 2.6MB
- Sample230324-2dmtbsbh6v
- SHA256 41d1e68ca8ce71c9900d8e02c93a9e23a1f7ae02aec9b3b61b39fc410262fdad
Malware Config
Extracted
-
redline
-
7
-
89.22.237.107:44745
-
auth_value
9fb4a4a8b5764119b91a5d9c6a94b401
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Identifies VirtualBox via ACPI registry values (likely anti-VM) 2 TTPs 1 IoCs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Identifies Wine through registry keys 2 TTPs 1 IoCs
Wine is a compatibility layer capable of running Windows applications, which can be used as sandboxing environment.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.18764.12891.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Win32.CrypterX-gen.18764.12891.exe"1⤵
- Identifies VirtualBox via ACPI registry values (likely anti-VM)
- Checks BIOS information in registry
- Identifies Wine through registry keys
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AppLaunch.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\AppLaunch.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3088-145-0x0000000000400000-0x00000000009E0000-memory.dmp
memory/3088-135-0x0000000004B90000-0x0000000004B91000-memory.dmp
memory/3088-134-0x0000000004BC0000-0x0000000004BC1000-memory.dmp
memory/3088-136-0x0000000004BD0000-0x0000000004BD1000-memory.dmp
memory/3088-137-0x0000000004BB0000-0x0000000004BB2000-memory.dmp
memory/3088-138-0x0000000004BA0000-0x0000000004BA1000-memory.dmp
memory/3088-139-0x0000000004BE0000-0x0000000004BE1000-memory.dmp
memory/3088-133-0x0000000000400000-0x00000000009E0000-memory.dmp
memory/5044-147-0x0000000005150000-0x000000000525A000-memory.dmp
memory/5044-146-0x00000000055D0000-0x0000000005BE8000-memory.dmp
memory/5044-140-0x0000000000400000-0x0000000000432000-memory.dmp
memory/5044-148-0x0000000005080000-0x0000000005092000-memory.dmp
memory/5044-149-0x00000000050E0000-0x000000000511C000-memory.dmp
memory/5044-150-0x0000000005380000-0x0000000005390000-memory.dmp
memory/5044-151-0x0000000005400000-0x0000000005466000-memory.dmp
memory/5044-152-0x0000000005FA0000-0x0000000006032000-memory.dmp
memory/5044-153-0x00000000065F0000-0x0000000006B94000-memory.dmp
memory/5044-154-0x0000000006390000-0x0000000006552000-memory.dmp
memory/5044-155-0x00000000070D0000-0x00000000075FC000-memory.dmp
memory/5044-156-0x0000000005380000-0x0000000005390000-memory.dmp