Analysis
- max time kernel
45s - max time network
121s - platform
windows10_x64 - resource
win10v20210408 - submitted
19/06/2021, 04:32
General
- Target 5003b53b6ce2876394d79229aa0c2597.exe
- Size 378KB
- Sample210619-nd42qerf2s
- SHA256 34c3d185dc61472fccfc4b49d646ccca9d057596dc8947e62773ca63205ef67b
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5003b53b6ce2876394d79229aa0c2597.exe"C:\Users\Admin\AppData\Local\Temp\5003b53b6ce2876394d79229aa0c2597.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/664-114-0x0000000000900000-0x0000000000A4A000-memory.dmp
memory/664-115-0x0000000000400000-0x00000000008FD000-memory.dmp
memory/664-116-0x0000000002930000-0x000000000294A000-memory.dmp
memory/664-118-0x0000000005262000-0x0000000005263000-memory.dmp
memory/664-117-0x0000000005260000-0x0000000005261000-memory.dmp
memory/664-119-0x0000000005263000-0x0000000005264000-memory.dmp
memory/664-120-0x0000000005270000-0x0000000005271000-memory.dmp
memory/664-121-0x0000000002A00000-0x0000000002A19000-memory.dmp
memory/664-122-0x0000000005770000-0x0000000005771000-memory.dmp
memory/664-123-0x0000000002AD0000-0x0000000002AD1000-memory.dmp
memory/664-124-0x0000000005080000-0x0000000005081000-memory.dmp
memory/664-125-0x0000000005264000-0x0000000005266000-memory.dmp
memory/664-126-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/664-127-0x0000000005D80000-0x0000000005D81000-memory.dmp
memory/664-128-0x0000000006A30000-0x0000000006A31000-memory.dmp
memory/664-129-0x0000000006C00000-0x0000000006C01000-memory.dmp
memory/664-130-0x0000000007230000-0x0000000007231000-memory.dmp
memory/664-131-0x00000000076C0000-0x00000000076C1000-memory.dmp