Analysis
-
max time kernel
20s -
max time network
19s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-02-2021 19:43
Static task
static1
Behavioral task
behavioral1
Sample
e9f2ded2b4be33b68f4d84e93df358bd.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
e9f2ded2b4be33b68f4d84e93df358bd.exe
Resource
win10v20201028
General
-
Target
e9f2ded2b4be33b68f4d84e93df358bd.exe
-
Size
241KB
-
MD5
e9f2ded2b4be33b68f4d84e93df358bd
-
SHA1
a8f8dce913a1ea9c34d6325b9cc855a6d94e4d10
-
SHA256
e99ab798099b3c352427b7808b0a2c7e73854aaeb34001f17852e288af321f6c
-
SHA512
6b228430c543064062a40fd89a7cff6864394a49dc62d37ab5e67a2d8f44d4253377be695b786e60e771b7fb5c19fb867a7c942b664a8effbd985ef01652ddf8
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1832-7-0x0000000004840000-0x000000000486C000-memory.dmp family_redline behavioral1/memory/1832-13-0x0000000004880000-0x00000000048AA000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e9f2ded2b4be33b68f4d84e93df358bd.exepid process 1832 e9f2ded2b4be33b68f4d84e93df358bd.exe 1832 e9f2ded2b4be33b68f4d84e93df358bd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e9f2ded2b4be33b68f4d84e93df358bd.exedescription pid process Token: SeDebugPrivilege 1832 e9f2ded2b4be33b68f4d84e93df358bd.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1832-2-0x0000000002D50000-0x0000000002D61000-memory.dmpFilesize
68KB
-
memory/1832-3-0x0000000004740000-0x0000000004751000-memory.dmpFilesize
68KB
-
memory/1832-4-0x0000000073980000-0x000000007406E000-memory.dmpFilesize
6.9MB
-
memory/1832-5-0x00000000003B0000-0x00000000003E6000-memory.dmpFilesize
216KB
-
memory/1832-6-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/1832-7-0x0000000004840000-0x000000000486C000-memory.dmpFilesize
176KB
-
memory/1832-13-0x0000000004880000-0x00000000048AA000-memory.dmpFilesize
168KB
-
memory/1832-16-0x0000000007023000-0x0000000007024000-memory.dmpFilesize
4KB
-
memory/1832-15-0x0000000007022000-0x0000000007023000-memory.dmpFilesize
4KB
-
memory/1832-17-0x0000000007024000-0x0000000007026000-memory.dmpFilesize
8KB
-
memory/1832-14-0x0000000007021000-0x0000000007022000-memory.dmpFilesize
4KB