Analysis

  • max time kernel
    121s
  • max time network
    123s
  • platform
    windows7_x64
  • resource
    win7v20210410
  • submitted
    21-07-2021 22:03

General

  • Target

    55eb0f78b0b98719ecc423744ee2a11a.exe

  • Size

    324KB

  • MD5

    55eb0f78b0b98719ecc423744ee2a11a

  • SHA1

    a352fbf68b0d3441008e9efdaf1871dd61e9223c

  • SHA256

    309aa6af647b1267fef90257e69cfe6be01ed03d3bbcc512dba951bbf4056916

  • SHA512

    d10a1e8177acd6d18d3195d0652802340970d56a583c5da855f1fded033ea470bfddbc7676688d7045ba03c1a065cf958b989aa7d0c6b5e49c7f78e5855bdce0

Malware Config

Extracted

Family

redline

C2

woltelorda.xyz:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55eb0f78b0b98719ecc423744ee2a11a.exe
    "C:\Users\Admin\AppData\Local\Temp\55eb0f78b0b98719ecc423744ee2a11a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1756

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1756-60-0x00000000001B0000-0x00000000001DF000-memory.dmp

    Filesize

    188KB

  • memory/1756-61-0x0000000000400000-0x0000000002B95000-memory.dmp

    Filesize

    39.6MB

  • memory/1756-62-0x0000000002C50000-0x0000000002C6B000-memory.dmp

    Filesize

    108KB

  • memory/1756-63-0x0000000002CE0000-0x0000000002CF9000-memory.dmp

    Filesize

    100KB

  • memory/1756-65-0x0000000007092000-0x0000000007093000-memory.dmp

    Filesize

    4KB

  • memory/1756-66-0x0000000007093000-0x0000000007094000-memory.dmp

    Filesize

    4KB

  • memory/1756-64-0x0000000007091000-0x0000000007092000-memory.dmp

    Filesize

    4KB

  • memory/1756-67-0x0000000007094000-0x0000000007096000-memory.dmp

    Filesize

    8KB