Analysis
-
max time kernel
101s -
max time network
103s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
14-02-2021 16:31
General
-
Target
7ab1ee8789d848137fb8bb8811c3eecd.exe
-
Size
1.1MB
-
MD5
7ab1ee8789d848137fb8bb8811c3eecd
-
SHA1
52059dafa51bd8e656ad357855424f3c32bdcd3f
-
SHA256
20510b85596724711f8fb4c7111055086f6e44845206038fa7b7c4bcfebf2265
-
SHA512
45aa42289af1c90ea612fac02b332b84620d60e1199999c17ad20d7ab21a27d55ddeac226ef0a0c359cc9832e45252f5df0259d94e748c699523290591466933
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7ab1ee8789d848137fb8bb8811c3eecd.exe"C:\Users\Admin\AppData\Local\Temp\7ab1ee8789d848137fb8bb8811c3eecd.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7ab1ee8789d848137fb8bb8811c3eecd.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
168KB
-
-
Filesize
6.9MB
-
Filesize
168KB
-
Filesize
4KB
-
Filesize
6.9MB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
300KB