Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
05-03-2021 14:17
Static task
static1
Behavioral task
behavioral1
Sample
88f3149589f79c88dba9a8710c59f8bf.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
88f3149589f79c88dba9a8710c59f8bf.exe
Resource
win10v20201028
General
-
Target
88f3149589f79c88dba9a8710c59f8bf.exe
-
Size
317KB
-
MD5
88f3149589f79c88dba9a8710c59f8bf
-
SHA1
97dcefb3f0b8d74b054894a514e344a3920c1f31
-
SHA256
61afa5c0da0fb5b87aa1dc81df5153152a1321d9daf6eb7e220299cf483f453c
-
SHA512
5e51cf28e030acaa0d9025c2298d6f6706aefcc301af76a4d5782ff253c173824592de4c8a9a66d16589214d88a800d0b7d5f601d75fbfa0c1d8af0c1cf30098
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
88f3149589f79c88dba9a8710c59f8bf.exepid process 1596 88f3149589f79c88dba9a8710c59f8bf.exe 1596 88f3149589f79c88dba9a8710c59f8bf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
88f3149589f79c88dba9a8710c59f8bf.exedescription pid process Token: SeDebugPrivilege 1596 88f3149589f79c88dba9a8710c59f8bf.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1596-2-0x0000000002E40000-0x0000000002E51000-memory.dmpFilesize
68KB
-
memory/1596-3-0x0000000004760000-0x0000000004771000-memory.dmpFilesize
68KB
-
memory/1596-4-0x0000000000270000-0x00000000002A5000-memory.dmpFilesize
212KB
-
memory/1596-5-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1596-6-0x0000000074350000-0x0000000074A3E000-memory.dmpFilesize
6.9MB
-
memory/1596-7-0x0000000002C70000-0x0000000002C9A000-memory.dmpFilesize
168KB
-
memory/1596-8-0x0000000004640000-0x0000000004668000-memory.dmpFilesize
160KB
-
memory/1596-10-0x0000000004D42000-0x0000000004D43000-memory.dmpFilesize
4KB
-
memory/1596-9-0x0000000004D41000-0x0000000004D42000-memory.dmpFilesize
4KB
-
memory/1596-11-0x0000000004D43000-0x0000000004D44000-memory.dmpFilesize
4KB
-
memory/1596-12-0x0000000004D44000-0x0000000004D46000-memory.dmpFilesize
8KB