Analysis
-
max time kernel
16s -
max time network
116s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
21-07-2021 22:03
General
-
Target
55eb0f78b0b98719ecc423744ee2a11a.exe
-
Size
324KB
-
MD5
55eb0f78b0b98719ecc423744ee2a11a
-
SHA1
a352fbf68b0d3441008e9efdaf1871dd61e9223c
-
SHA256
309aa6af647b1267fef90257e69cfe6be01ed03d3bbcc512dba951bbf4056916
-
SHA512
d10a1e8177acd6d18d3195d0652802340970d56a583c5da855f1fded033ea470bfddbc7676688d7045ba03c1a065cf958b989aa7d0c6b5e49c7f78e5855bdce0
Score
10/10
Malware Config
Extracted
Family
redline
C2
woltelorda.xyz:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\55eb0f78b0b98719ecc423744ee2a11a.exe"C:\Users\Admin\AppData\Local\Temp\55eb0f78b0b98719ecc423744ee2a11a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
696KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
100KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
39.6MB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB