Analysis
-
max time kernel
130s -
max time network
131s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-05-2021 10:01
Behavioral task
behavioral1
Sample
7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe
Resource
win10v20210408
General
-
Target
7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe
-
Size
91KB
-
MD5
0ba6261401e0f3cff99d77300dfcfea8
-
SHA1
97facb0813150932fcd2c6ae52a305873c208cdd
-
SHA256
7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6bb99c5256670b47edd33
-
SHA512
2d069264f8a9f0c9b80a5d9f64ac159ac6c073aefa2e179618568e50401715b6c1526bdc4094b1493affccedefa86328dfbe84209b5432669b02a4ddf8d3beec
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exepid process 1000 7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe 1000 7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exedescription pid process Token: SeDebugPrivilege 1000 7f991d43aa3e97b19b8e9f50e538b3906f43ee091fb6b.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1000-114-0x0000000000D50000-0x0000000000D51000-memory.dmpFilesize
4KB
-
memory/1000-116-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/1000-117-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/1000-118-0x0000000005700000-0x0000000005701000-memory.dmpFilesize
4KB
-
memory/1000-119-0x0000000005740000-0x0000000005741000-memory.dmpFilesize
4KB
-
memory/1000-120-0x0000000005640000-0x0000000005C46000-memory.dmpFilesize
6.0MB
-
memory/1000-121-0x00000000059E0000-0x00000000059E1000-memory.dmpFilesize
4KB
-
memory/1000-122-0x00000000067B0000-0x00000000067B1000-memory.dmpFilesize
4KB
-
memory/1000-123-0x0000000006D50000-0x0000000006D51000-memory.dmpFilesize
4KB
-
memory/1000-124-0x0000000007420000-0x0000000007421000-memory.dmpFilesize
4KB
-
memory/1000-125-0x0000000007B20000-0x0000000007B21000-memory.dmpFilesize
4KB
-
memory/1000-126-0x0000000007250000-0x0000000007251000-memory.dmpFilesize
4KB