Analysis
- max time kernel
138s - max time network
141s - platform
windows10_x64 - resource
win10v20210410 - submitted
24/06/2021, 08:43
General
- Target a1898e4ebec6f43b6448701b7cd456c5.exe
- Size 682KB
- Sample210624-ftmswej82x
- SHA256 393aac4cba99e10526596a762318a76c8380e1283ccf01aad2b10f5e5b0cbb90
Malware Config
Extracted
-
redline
-
HCwIKyY0PFw4GQlL
-
BS0DQyMaPBQ6IHwBKSYiBTg4F0UFLQNDICQWUQ==
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Downloads MZ/PE file
- Executes dropped EXE 1 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a1898e4ebec6f43b6448701b7cd456c5.exe"C:\Users\Admin\AppData\Local\Temp\a1898e4ebec6f43b6448701b7cd456c5.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\nailedp\edspolishpp.exeedspolishpp.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3132-122-0x0000000005760000-0x0000000005761000-memory.dmp
memory/3132-125-0x0000000000B40000-0x0000000000B6F000-memory.dmp
memory/3132-132-0x0000000005254000-0x0000000005256000-memory.dmp
memory/3132-119-0x00000000026C0000-0x00000000026DB000-memory.dmp
memory/3132-120-0x0000000005260000-0x0000000005261000-memory.dmp
memory/3132-121-0x0000000002750000-0x0000000002769000-memory.dmp
memory/3132-131-0x0000000005D70000-0x0000000005D71000-memory.dmp
memory/3132-123-0x0000000002B30000-0x0000000002B31000-memory.dmp
memory/3132-124-0x00000000050A0000-0x00000000050A1000-memory.dmp
memory/3132-127-0x0000000005250000-0x0000000005251000-memory.dmp
memory/3132-126-0x0000000000400000-0x0000000000908000-memory.dmp
memory/3132-129-0x0000000005253000-0x0000000005254000-memory.dmp
memory/3132-128-0x0000000005252000-0x0000000005253000-memory.dmp
memory/3132-130-0x00000000050E0000-0x00000000050E1000-memory.dmp
memory/3904-115-0x0000000000400000-0x00000000004D5000-memory.dmp
memory/3904-114-0x0000000000570000-0x00000000006BA000-memory.dmp