Analysis
- max time kernel
19s - max time network
17s - platform
windows7_x64 - resource
win7v20201028 - submitted
16/01/2021, 07:28
General
- Target e67709406599e20361572245e391a5f1.exe
- Size 352KB
- Sample210116-81frsbem9e
- SHA256 7d2193feb3fb2e72cea88023a60aae9defeae560358eddcba59d97bd8234bec9
Score
10/10
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e67709406599e20361572245e391a5f1.exe"C:\Users\Admin\AppData\Local\Temp\e67709406599e20361572245e391a5f1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1824-2-0x00000000047FC000-0x00000000047FD000-memory.dmp
memory/1824-3-0x0000000006010000-0x0000000006021000-memory.dmp
memory/1824-4-0x0000000006010000-0x0000000006021000-memory.dmp
memory/1824-5-0x0000000073980000-0x000000007406E000-memory.dmp
memory/1824-6-0x00000000047B0000-0x00000000047D9000-memory.dmp
memory/1824-7-0x0000000006260000-0x0000000006287000-memory.dmp