Analysis
-
max time kernel
24s -
max time network
66s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-02-2021 19:43
Static task
static1
Behavioral task
behavioral1
Sample
e9f2ded2b4be33b68f4d84e93df358bd.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
e9f2ded2b4be33b68f4d84e93df358bd.exe
Resource
win10v20201028
General
-
Target
e9f2ded2b4be33b68f4d84e93df358bd.exe
-
Size
241KB
-
MD5
e9f2ded2b4be33b68f4d84e93df358bd
-
SHA1
a8f8dce913a1ea9c34d6325b9cc855a6d94e4d10
-
SHA256
e99ab798099b3c352427b7808b0a2c7e73854aaeb34001f17852e288af321f6c
-
SHA512
6b228430c543064062a40fd89a7cff6864394a49dc62d37ab5e67a2d8f44d4253377be695b786e60e771b7fb5c19fb867a7c942b664a8effbd985ef01652ddf8
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/972-7-0x0000000004A70000-0x0000000004A9C000-memory.dmp family_redline behavioral2/memory/972-11-0x0000000004C30000-0x0000000004C5A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e9f2ded2b4be33b68f4d84e93df358bd.exepid process 972 e9f2ded2b4be33b68f4d84e93df358bd.exe 972 e9f2ded2b4be33b68f4d84e93df358bd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e9f2ded2b4be33b68f4d84e93df358bd.exedescription pid process Token: SeDebugPrivilege 972 e9f2ded2b4be33b68f4d84e93df358bd.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/972-2-0x0000000003320000-0x0000000003321000-memory.dmpFilesize
4KB
-
memory/972-3-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/972-4-0x0000000002D10000-0x0000000002D46000-memory.dmpFilesize
216KB
-
memory/972-5-0x0000000000400000-0x0000000000439000-memory.dmpFilesize
228KB
-
memory/972-6-0x0000000073850000-0x0000000073F3E000-memory.dmpFilesize
6.9MB
-
memory/972-7-0x0000000004A70000-0x0000000004A9C000-memory.dmpFilesize
176KB
-
memory/972-8-0x0000000004CA0000-0x0000000004CA1000-memory.dmpFilesize
4KB
-
memory/972-9-0x0000000004CA2000-0x0000000004CA3000-memory.dmpFilesize
4KB
-
memory/972-10-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/972-11-0x0000000004C30000-0x0000000004C5A000-memory.dmpFilesize
168KB
-
memory/972-12-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/972-13-0x0000000004CA3000-0x0000000004CA4000-memory.dmpFilesize
4KB
-
memory/972-14-0x0000000004E80000-0x0000000004E81000-memory.dmpFilesize
4KB
-
memory/972-15-0x00000000078F0000-0x00000000078F1000-memory.dmpFilesize
4KB
-
memory/972-16-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/972-17-0x0000000007F90000-0x0000000007F91000-memory.dmpFilesize
4KB
-
memory/972-18-0x0000000004CA4000-0x0000000004CA6000-memory.dmpFilesize
8KB
-
memory/972-19-0x0000000008100000-0x0000000008101000-memory.dmpFilesize
4KB
-
memory/972-20-0x0000000008280000-0x0000000008281000-memory.dmpFilesize
4KB
-
memory/972-21-0x0000000008E40000-0x0000000008E41000-memory.dmpFilesize
4KB
-
memory/972-22-0x0000000009030000-0x0000000009031000-memory.dmpFilesize
4KB
-
memory/972-23-0x0000000009670000-0x0000000009671000-memory.dmpFilesize
4KB
-
memory/972-24-0x0000000009720000-0x0000000009721000-memory.dmpFilesize
4KB
-
memory/972-25-0x0000000009FC0000-0x0000000009FC1000-memory.dmpFilesize
4KB