Analysis
- max time kernel
27s - max time network
113s - platform
windows10_x64 - resource
win10v20201028 - submitted
15/01/2021, 06:44
General
- Target addc4da6b84c4cdef13423e06dcd1492.exe
- Size 319KB
- Sample210115-efjsbj1nle
- SHA256 c69abca6861cab059b6ae9f8745b25359ab757af64c6388efd386d04f87bafda
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\addc4da6b84c4cdef13423e06dcd1492.exe"C:\Users\Admin\AppData\Local\Temp\addc4da6b84c4cdef13423e06dcd1492.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3372-2-0x0000000004B70000-0x0000000004B71000-memory.dmp
memory/3372-3-0x0000000006870000-0x0000000006871000-memory.dmp
memory/3372-4-0x0000000073810000-0x0000000073EFE000-memory.dmp
memory/3372-5-0x0000000006790000-0x00000000067B9000-memory.dmp
memory/3372-6-0x0000000008F80000-0x0000000008F81000-memory.dmp
memory/3372-7-0x0000000006820000-0x0000000006847000-memory.dmp
memory/3372-8-0x0000000009480000-0x0000000009481000-memory.dmp
memory/3372-9-0x0000000009A90000-0x0000000009A91000-memory.dmp
memory/3372-10-0x0000000009AB0000-0x0000000009AB1000-memory.dmp
memory/3372-11-0x0000000009B10000-0x0000000009B11000-memory.dmp
memory/3372-12-0x0000000009C90000-0x0000000009C91000-memory.dmp
memory/3372-13-0x000000000A970000-0x000000000A971000-memory.dmp
memory/3372-14-0x000000000AB40000-0x000000000AB41000-memory.dmp
memory/3372-15-0x000000000B170000-0x000000000B171000-memory.dmp
memory/3372-16-0x000000000B230000-0x000000000B231000-memory.dmp
memory/3372-17-0x000000000B2C0000-0x000000000B2C1000-memory.dmp
memory/3372-18-0x000000000C350000-0x000000000C351000-memory.dmp
memory/3372-19-0x000000000C3D0000-0x000000000C3D1000-memory.dmp
memory/3372-20-0x000000000C770000-0x000000000C771000-memory.dmp