Analysis
-
max time kernel
43s -
max time network
45s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
21-07-2021 20:10
Static task
static1
Behavioral task
behavioral1
Sample
f859381cc1f43adaaefea79f640d9f3b.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
f859381cc1f43adaaefea79f640d9f3b.exe
Resource
win10v20210410
General
-
Target
f859381cc1f43adaaefea79f640d9f3b.exe
-
Size
246KB
-
MD5
f859381cc1f43adaaefea79f640d9f3b
-
SHA1
d3b16cf09004f93976e9523cdb74f002ee443b68
-
SHA256
cb9bdcab060d8b91eafa1dd442464cea40aa7a6547c02a4483f113f49c50ab18
-
SHA512
f2f44098ed66ac5eb795eb8ef870b05f3888fdff60f41d834a2adf31559b1bf47ad2937fa22890cbfdd75a43257f0f8fc00eaa2ed6ab2bec3df6a5e96ec299c2
Malware Config
Extracted
redline
zasavaucov.xyz:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/648-64-0x0000000000400000-0x000000000041E000-memory.dmp family_redline behavioral1/memory/648-65-0x0000000000417DD6-mapping.dmp family_redline behavioral1/memory/648-66-0x0000000000400000-0x000000000041E000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
f859381cc1f43adaaefea79f640d9f3b.exedescription pid process target process PID 1096 set thread context of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f859381cc1f43adaaefea79f640d9f3b.exepid process 648 f859381cc1f43adaaefea79f640d9f3b.exe 648 f859381cc1f43adaaefea79f640d9f3b.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f859381cc1f43adaaefea79f640d9f3b.exef859381cc1f43adaaefea79f640d9f3b.exedescription pid process Token: SeDebugPrivilege 1096 f859381cc1f43adaaefea79f640d9f3b.exe Token: SeDebugPrivilege 648 f859381cc1f43adaaefea79f640d9f3b.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
f859381cc1f43adaaefea79f640d9f3b.exedescription pid process target process PID 1096 wrote to memory of 1480 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1480 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1480 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1480 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1224 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1224 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1224 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 1224 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe PID 1096 wrote to memory of 648 1096 f859381cc1f43adaaefea79f640d9f3b.exe f859381cc1f43adaaefea79f640d9f3b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe"C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exeC:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe2⤵PID:1480
-
C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exeC:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe2⤵PID:1224
-
C:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exeC:\Users\Admin\AppData\Local\Temp\f859381cc1f43adaaefea79f640d9f3b.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:648
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/648-64-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/648-65-0x0000000000417DD6-mapping.dmp
-
memory/648-66-0x0000000000400000-0x000000000041E000-memory.dmpFilesize
120KB
-
memory/648-68-0x0000000002150000-0x0000000002151000-memory.dmpFilesize
4KB
-
memory/1096-60-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1096-62-0x0000000004700000-0x0000000004701000-memory.dmpFilesize
4KB
-
memory/1096-63-0x00000000003D0000-0x00000000003DF000-memory.dmpFilesize
60KB