Analysis
- max time kernel
150s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
22/10/2024, 03:19
General
- Target 75d666ab409f01a0164213b301ba23bd21cf5f5780bbeaf5cc701439a282f6cf.exe
- Size 275KB
- Sample241022-dvgrmstflg
- SHA256 75d666ab409f01a0164213b301ba23bd21cf5f5780bbeaf5cc701439a282f6cf
Malware Config
Extracted
-
redline
-
Diamotrix
-
176.111.174.140:1912
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Downloads MZ/PE file
- Drops file in Drivers directory 1 IoCs
- Drops startup file 1 IoCs
- Executes dropped EXE 3 IoCs
- Loads dropped DLL 5 IoCs
- Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Adds Run key to start application 2 TTPs 1 IoCs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Detects Pyinstaller 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Modifies registry class 2 IoCs
- Suspicious behavior: EnumeratesProcesses 64 IoCs
- Suspicious use of AdjustPrivilegeToken 34 IoCs
- Suspicious use of UnmapMainImage 1 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\75d666ab409f01a0164213b301ba23bd21cf5f5780bbeaf5cc701439a282f6cf.exe"C:\Users\Admin\AppData\Local\Temp\75d666ab409f01a0164213b301ba23bd21cf5f5780bbeaf5cc701439a282f6cf.exe"2⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch -p -s LSM3⤵
- Drops file in Drivers directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
-
-
C:\Users\Admin\AppData\Local\Temp\8EB3.tmp.x.exe"C:\Users\Admin\AppData\Local\Temp\8EB3.tmp.x.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\9AAB.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\9AAB.tmp.zx.exe"2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9AAB.tmp.zx.exe"C:\Users\Admin\AppData\Local\Temp\9AAB.tmp.zx.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Credential Access
Credentials from Password Stores
1Credentials from Web Browsers
1Unsecured Credentials
2Credentials In Files
2Replay Monitor
Loading Replay Monitor...
Downloads
8EB3.tmp.x.exe
9AAB.tmp.zx.exe
VCRUNTIME140.dll
_ctypes.pyd
libffi-7.dll
python38.dll
ucrtbase.dll
3E7854C280E62458504893.exe
hosts
memory/3484-205-0x00000000032E0000-0x0000000003322000-memory.dmp
memory/3484-206-0x0000000008DE0000-0x0000000008E35000-memory.dmp
memory/3484-57-0x00000000031E0000-0x000000000321E000-memory.dmp
memory/3484-59-0x00000000032E0000-0x0000000003322000-memory.dmp
memory/3484-60-0x00000000032E0000-0x0000000003322000-memory.dmp
memory/3484-63-0x0000000008DE0000-0x0000000008E35000-memory.dmp
memory/3484-65-0x0000000008DE0000-0x0000000008E35000-memory.dmp
memory/3484-61-0x00000000089E0000-0x0000000008A28000-memory.dmp
memory/3484-74-0x00007FFBC6120000-0x00007FFBC6121000-memory.dmp
memory/3816-80-0x0000000006070000-0x0000000006614000-memory.dmp
memory/3816-78-0x00007FFBC60D0000-0x00007FFBC6129000-memory.dmp
memory/3816-88-0x0000000005CB0000-0x0000000005CFC000-memory.dmp
memory/3816-79-0x0000000000EF0000-0x0000000000F42000-memory.dmp
memory/3816-84-0x0000000006C40000-0x0000000007258000-memory.dmp
memory/3816-83-0x0000000005A00000-0x0000000005A0A000-memory.dmp
memory/3816-82-0x00007FFBC60D0000-0x00007FFBC6129000-memory.dmp
memory/3816-81-0x0000000005960000-0x00000000059F2000-memory.dmp
memory/3816-87-0x0000000005C70000-0x0000000005CAC000-memory.dmp
memory/3816-86-0x0000000005BD0000-0x0000000005BE2000-memory.dmp
memory/3816-85-0x0000000005D80000-0x0000000005E8A000-memory.dmp
memory/3816-207-0x0000000006620000-0x0000000006686000-memory.dmp
memory/3816-215-0x00007FFBC60D0000-0x00007FFBC6129000-memory.dmp
memory/3816-209-0x0000000008160000-0x00000000081B0000-memory.dmp
memory/3816-210-0x00007FFBC60D0000-0x00007FFBC6129000-memory.dmp
memory/3816-211-0x00007FFBC60D0000-0x00007FFBC6129000-memory.dmp
memory/3816-212-0x0000000007750000-0x0000000007912000-memory.dmp
memory/3816-213-0x00000000086E0000-0x0000000008C0C000-memory.dmp
memory/4168-208-0x00007FF623390000-0x00007FF6233DB000-memory.dmp