Analysis

  • max time kernel
    108s
  • max time network
    122s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240508-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
  • submitted
    09-05-2024 14:29

General

  • Target

    cbd8058875fbf90f6f6a3c6825fab01a2bac4ffb1903f2a0405d451060ea1a48.exe

  • Size

    983KB

  • MD5

    0f5dcf244539e44929a29fdc2bee6cf0

  • SHA1

    d12c4a1527a6910e0f45e5d61c3f0f027cd65892

  • SHA256

    cbd8058875fbf90f6f6a3c6825fab01a2bac4ffb1903f2a0405d451060ea1a48

  • SHA512

    34b382df4ab8246c87c8a49acf7f37b33ed252c75b94fe47db7699ad20906abbd42b58ce953a5547da064b5fe93c38eab8d64299f85f99706cb8154af039a0fa

  • SSDEEP

    12288:dN53wXdk+4w8ea9YVhYu48bkEXjTvrVbJWekouloWnxfKuXl/DeeQA:dN5edk+4wv+YVhYu4rCTvhFanR3XlCm

Malware Config

Extracted

Family

redline

Botnet

5195552529

C2

https://pastebin.com/raw/NgsUAPya

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cbd8058875fbf90f6f6a3c6825fab01a2bac4ffb1903f2a0405d451060ea1a48.exe
    "C:\Users\Admin\AppData\Local\Temp\cbd8058875fbf90f6f6a3c6825fab01a2bac4ffb1903f2a0405d451060ea1a48.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:4628
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
        PID:2524
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1440
      • C:\Windows\SysWOW64\WerFault.exe
        C:\Windows\SysWOW64\WerFault.exe -u -p 4628 -s 320
        2⤵
        • Program crash
        PID:624
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4628 -ip 4628
      1⤵
        PID:2768

      Network

      MITRE ATT&CK Matrix ATT&CK v13

      Credential Access

      Unsecured Credentials

      2
      T1552

      Credentials In Files

      2
      T1552.001

      Discovery

      Query Registry

      1
      T1012

      Collection

      Data from Local System

      2
      T1005

      Command and Control

      Web Service

      1
      T1102

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • memory/1440-8-0x00000000064F0000-0x000000000652C000-memory.dmp
        Filesize

        240KB

      • memory/1440-2-0x00000000743DE000-0x00000000743DF000-memory.dmp
        Filesize

        4KB

      • memory/1440-9-0x0000000006530000-0x000000000657C000-memory.dmp
        Filesize

        304KB

      • memory/1440-10-0x0000000006850000-0x0000000006A12000-memory.dmp
        Filesize

        1.8MB

      • memory/1440-4-0x0000000005C90000-0x00000000062A8000-memory.dmp
        Filesize

        6.1MB

      • memory/1440-5-0x00000000056E0000-0x00000000056F2000-memory.dmp
        Filesize

        72KB

      • memory/1440-6-0x0000000005810000-0x000000000591A000-memory.dmp
        Filesize

        1.0MB

      • memory/1440-7-0x00000000743D0000-0x0000000074B80000-memory.dmp
        Filesize

        7.7MB

      • memory/1440-18-0x00000000743D0000-0x0000000074B80000-memory.dmp
        Filesize

        7.7MB

      • memory/1440-1-0x0000000000400000-0x0000000000422000-memory.dmp
        Filesize

        136KB

      • memory/1440-3-0x00000000051C0000-0x0000000005226000-memory.dmp
        Filesize

        408KB

      • memory/1440-11-0x0000000006F50000-0x000000000747C000-memory.dmp
        Filesize

        5.2MB

      • memory/1440-12-0x0000000006A20000-0x0000000006AB2000-memory.dmp
        Filesize

        584KB

      • memory/1440-13-0x0000000007A30000-0x0000000007FD4000-memory.dmp
        Filesize

        5.6MB

      • memory/1440-14-0x0000000006CC0000-0x0000000006D36000-memory.dmp
        Filesize

        472KB

      • memory/1440-15-0x0000000006D60000-0x0000000006D7E000-memory.dmp
        Filesize

        120KB

      • memory/1440-16-0x00000000074D0000-0x0000000007520000-memory.dmp
        Filesize

        320KB

      • memory/4628-0-0x0000000000F36000-0x0000000000F37000-memory.dmp
        Filesize

        4KB