Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240215-en -
resource tags
arch:x64arch:x86image:win7-20240215-enlocale:en-usos:windows7-x64system -
submitted
01-03-2024 16:48
Behavioral task
behavioral1
Sample
Aurora_V2/Aurora.exe
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
Aurora_V2/Aurora.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Aurora_V2/scripts/scripts.dll
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Aurora_V2/scripts/scripts.dll
Resource
win10v2004-20240226-en
General
-
Target
Aurora_V2/Aurora.exe
-
Size
620KB
-
MD5
403c733d425c072e88fc4a61595519dc
-
SHA1
ad25c881299ef6ac612ea36cdd40884caa479ba4
-
SHA256
96666cb323337b2fc5e3b87369639e637df2bb864a18422fd115c0f8f198b879
-
SHA512
1a30c2be85ec14cb644f3a81062a05b2759c09b6e29245a6856320f47865cd207b694feac6951e1d91c2350cfbe0bdbca2b302d02e92e3286de7bd2b9aafcf3e
-
SSDEEP
12288:vSIl566+QljEifBxARfzH5tCe7xChZZ8F39YaLFWlrSpKKIul5:Z5qUEi0RfzF7cH8waLQlaIul5
Malware Config
Extracted
redline
@dxrkl0rd
45.15.156.167:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2800-0-0x00000000002E0000-0x0000000000330000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
Aurora.exepid process 2800 Aurora.exe 2800 Aurora.exe 2800 Aurora.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Aurora.exedescription pid process Token: SeDebugPrivilege 2800 Aurora.exe
Processes
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\94308059B57B3142E455B38A6EB92015Filesize
67KB
MD5753df6889fd7410a2e9fe333da83a429
SHA13c425f16e8267186061dd48ac1c77c122962456e
SHA256b42dc237e44cbc9a43400e7d3f9cbd406dbdefd62bfe87328f8663897d69df78
SHA5129d56f79410ad0cf852c74c3ef9454e7ae86e80bdd6ff67773994b48ccac71142bcf5c90635da6a056e1406e81e64674db9584928e867c55b77b59e2851cf6444
-
C:\Users\Admin\AppData\Local\Temp\Tar2C93.tmpFilesize
175KB
MD5dd73cead4b93366cf3465c8cd32e2796
SHA174546226dfe9ceb8184651e920d1dbfb432b314e
SHA256a6752b7851b591550e4625b832a393aabcc428de18d83e8593cd540f7d7cae22
SHA512ce1bdd595065c94fa528badf4a6a8777893807d6789267612755df818ba6ffe55e4df429710aea29526ee4aa8ef20e25f2f05341da53992157d21ae032c0fb63
-
memory/2800-0-0x00000000002E0000-0x0000000000330000-memory.dmpFilesize
320KB
-
memory/2800-4-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB
-
memory/2800-5-0x0000000004FA0000-0x0000000004FE0000-memory.dmpFilesize
256KB
-
memory/2800-44-0x0000000074670000-0x0000000074D5E000-memory.dmpFilesize
6.9MB