Analysis
-
max time kernel
146s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
15-02-2021 10:17
Static task
static1
Behavioral task
behavioral1
Sample
FC33.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
FC33.exe
Resource
win10v20201028
General
-
Target
FC33.exe
-
Size
19KB
-
MD5
5898d001eedb60a637f9334965e241a9
-
SHA1
59d543084a8230ac387dee45b027c47282256d02
-
SHA256
08eb269d6c3bfaf4d3cde53a987e0adc96a171235d3c34e3c6e9422920e793dd
-
SHA512
d8be87bddd9f289597221d864370dfdd1ea94d2910837e211f34eec0fee56477672d98bd0565059389ff6d9ac79002f0ffa792feb84db02b18f432c6174e71e0
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3084-11-0x0000000002BD0000-0x0000000002BF4000-memory.dmp family_redline behavioral2/memory/3084-13-0x0000000002D70000-0x0000000002D92000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
chrome.exepid process 3084 chrome.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
FC33.exedescription pid process target process PID 4764 set thread context of 3084 4764 FC33.exe chrome.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
FC33.exechrome.exedescription pid process Token: SeDebugPrivilege 4764 FC33.exe Token: SeDebugPrivilege 3084 chrome.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
FC33.exedescription pid process target process PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe PID 4764 wrote to memory of 3084 4764 FC33.exe chrome.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\FC33.exe"C:\Users\Admin\AppData\Local\Temp\FC33.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome.exe"C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Google\Chrome\User Data\Default\chrome.exeMD5
6a673bfc3b67ae9782cb31af2f234c68
SHA17544e89566d91e84e3cd437b9a073e5f6b56566e
SHA256978a4093058aa2ebf05dc353897d90d950324389879b57741b64160825b5ec0e
SHA51272c302372ce87ceda2a3c70a6005d3f9c112f1641bc7fe6824c718971233e66c07e2996d2785fa358566c38714c25ea812c05c7cfd2f588284849d495fd24f39
-
memory/3084-13-0x0000000002D70000-0x0000000002D92000-memory.dmpFilesize
136KB
-
memory/3084-21-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/3084-6-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3084-7-0x000000000040CD2F-mapping.dmp
-
memory/3084-12-0x0000000005780000-0x0000000005781000-memory.dmpFilesize
4KB
-
memory/3084-9-0x00000000029D0000-0x00000000029D1000-memory.dmpFilesize
4KB
-
memory/3084-10-0x0000000073380000-0x0000000073A6E000-memory.dmpFilesize
6.9MB
-
memory/3084-14-0x0000000006290000-0x0000000006291000-memory.dmpFilesize
4KB
-
memory/3084-23-0x0000000002994000-0x0000000002996000-memory.dmpFilesize
8KB
-
memory/3084-22-0x00000000055B0000-0x00000000055B1000-memory.dmpFilesize
4KB
-
memory/3084-11-0x0000000002BD0000-0x0000000002BF4000-memory.dmpFilesize
144KB
-
memory/3084-15-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/3084-16-0x00000000052B0000-0x00000000052B1000-memory.dmpFilesize
4KB
-
memory/3084-17-0x0000000000400000-0x0000000000435000-memory.dmpFilesize
212KB
-
memory/3084-18-0x0000000002990000-0x0000000002991000-memory.dmpFilesize
4KB
-
memory/3084-19-0x0000000002992000-0x0000000002993000-memory.dmpFilesize
4KB
-
memory/3084-20-0x0000000002993000-0x0000000002994000-memory.dmpFilesize
4KB
-
memory/4764-2-0x00000000732D0000-0x00000000739BE000-memory.dmpFilesize
6.9MB
-
memory/4764-5-0x0000000004980000-0x0000000004981000-memory.dmpFilesize
4KB
-
memory/4764-3-0x00000000000C0000-0x00000000000C1000-memory.dmpFilesize
4KB