Analysis
-
max time kernel
149s -
max time network
113s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
10-02-2021 13:01
General
-
Target
feb57ff3d961685dc7a12fcb2ef8ba63.exe
-
Size
338KB
-
MD5
feb57ff3d961685dc7a12fcb2ef8ba63
-
SHA1
9fbceb22b3468083f3aa583e4183f4c9e407bcd9
-
SHA256
97059b74b76a880fae49ca4bfa64953cb694e60195a387018440066e5c0cf853
-
SHA512
8d61eac914c1cfc296e898772505a3646ede92e20855da5e5d0271fc856143a486f3efde7172ae09b46a4cbdfd37d547afddb86f3e5946a460372986fa0759a8
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 28 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
-
Suspicious use of WriteProcessMemory 2 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\feb57ff3d961685dc7a12fcb2ef8ba63.exe"C:\Users\Admin\AppData\Local\Temp\feb57ff3d961685dc7a12fcb2ef8ba63.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\o.exe"C:\Users\Admin\AppData\Local\Temp\o.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
f254515cdf3cf10e1555046493c5bee8
SHA14eee393ad747349fda88bf5690dbb60aa450eced
SHA25624be4bd66f7e47dee0a64925c1ceee243396c06d18c00fb16ce54204cb9b096e
SHA512c6e06be4c7b9150e99d1708b6b45153de4d850490274ea6672177bcbbdde676aed3a2a038dd14936b54b68bcc46f7fdc382db82a26b5776e9ca81d6dc14362b1
-
MD5
f254515cdf3cf10e1555046493c5bee8
SHA14eee393ad747349fda88bf5690dbb60aa450eced
SHA25624be4bd66f7e47dee0a64925c1ceee243396c06d18c00fb16ce54204cb9b096e
SHA512c6e06be4c7b9150e99d1708b6b45153de4d850490274ea6672177bcbbdde676aed3a2a038dd14936b54b68bcc46f7fdc382db82a26b5776e9ca81d6dc14362b1
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
176KB
-
Filesize
4KB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
228KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
216KB
-
-
Filesize
9.6MB
-
Filesize
8KB