Analysis

  • max time kernel
    21s
  • max time network
    19s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    20-01-2021 14:31

General

  • Target

    85976e531510c3f092d3a7e8ca5d04fd.exe

  • Size

    324KB

  • MD5

    85976e531510c3f092d3a7e8ca5d04fd

  • SHA1

    f58570d7373d487c7d3e01d4de09ab456408a046

  • SHA256

    d5a592a952140b52fde783c6281f82986a3aee2f05de63fe7b6ff2d76db11670

  • SHA512

    096b15da27c008c7889ed897f8331db4e9fc80b281172b4e7ba601585988b8f279af88db2cbe4327eea1d4938324c3890d2a2dae24bef8429a1f85d173c3ea09

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\85976e531510c3f092d3a7e8ca5d04fd.exe
    "C:\Users\Admin\AppData\Local\Temp\85976e531510c3f092d3a7e8ca5d04fd.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1852

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1852-2-0x0000000004940000-0x0000000004951000-memory.dmp

    Filesize

    68KB

  • memory/1852-3-0x00000000061C0000-0x00000000061D1000-memory.dmp

    Filesize

    68KB

  • memory/1852-5-0x0000000000230000-0x0000000000265000-memory.dmp

    Filesize

    212KB

  • memory/1852-6-0x0000000000400000-0x0000000000438000-memory.dmp

    Filesize

    224KB

  • memory/1852-4-0x00000000747C0000-0x0000000074EAE000-memory.dmp

    Filesize

    6.9MB

  • memory/1852-7-0x00000000061C0000-0x00000000061E9000-memory.dmp

    Filesize

    164KB

  • memory/1852-13-0x00000000061F0000-0x0000000006218000-memory.dmp

    Filesize

    160KB

  • memory/1852-16-0x0000000006243000-0x0000000006244000-memory.dmp

    Filesize

    4KB

  • memory/1852-15-0x0000000006242000-0x0000000006243000-memory.dmp

    Filesize

    4KB

  • memory/1852-14-0x0000000006241000-0x0000000006242000-memory.dmp

    Filesize

    4KB

  • memory/1852-17-0x0000000006244000-0x0000000006246000-memory.dmp

    Filesize

    8KB