Analysis

  • max time kernel
    16s
  • max time network
    116s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    21-07-2021 22:03

General

  • Target

    55eb0f78b0b98719ecc423744ee2a11a.exe

  • Size

    324KB

  • MD5

    55eb0f78b0b98719ecc423744ee2a11a

  • SHA1

    a352fbf68b0d3441008e9efdaf1871dd61e9223c

  • SHA256

    309aa6af647b1267fef90257e69cfe6be01ed03d3bbcc512dba951bbf4056916

  • SHA512

    d10a1e8177acd6d18d3195d0652802340970d56a583c5da855f1fded033ea470bfddbc7676688d7045ba03c1a065cf958b989aa7d0c6b5e49c7f78e5855bdce0

Malware Config

Extracted

Family

redline

C2

woltelorda.xyz:80

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\55eb0f78b0b98719ecc423744ee2a11a.exe
    "C:\Users\Admin\AppData\Local\Temp\55eb0f78b0b98719ecc423744ee2a11a.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3244

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3244-114-0x0000000002C40000-0x0000000002CEE000-memory.dmp

    Filesize

    696KB

  • memory/3244-115-0x0000000004850000-0x000000000486B000-memory.dmp

    Filesize

    108KB

  • memory/3244-116-0x0000000007220000-0x0000000007221000-memory.dmp

    Filesize

    4KB

  • memory/3244-117-0x0000000004B60000-0x0000000004B79000-memory.dmp

    Filesize

    100KB

  • memory/3244-118-0x0000000007720000-0x0000000007721000-memory.dmp

    Filesize

    4KB

  • memory/3244-119-0x0000000007180000-0x0000000007181000-memory.dmp

    Filesize

    4KB

  • memory/3244-120-0x00000000071A0000-0x00000000071A1000-memory.dmp

    Filesize

    4KB

  • memory/3244-121-0x0000000000400000-0x0000000002B95000-memory.dmp

    Filesize

    39.6MB

  • memory/3244-123-0x0000000007214000-0x0000000007216000-memory.dmp

    Filesize

    8KB

  • memory/3244-122-0x0000000007210000-0x0000000007211000-memory.dmp

    Filesize

    4KB

  • memory/3244-124-0x0000000007212000-0x0000000007213000-memory.dmp

    Filesize

    4KB

  • memory/3244-125-0x0000000007213000-0x0000000007214000-memory.dmp

    Filesize

    4KB

  • memory/3244-126-0x0000000007D30000-0x0000000007D31000-memory.dmp

    Filesize

    4KB

  • memory/3244-127-0x0000000007EB0000-0x0000000007EB1000-memory.dmp

    Filesize

    4KB

  • memory/3244-128-0x0000000008B90000-0x0000000008B91000-memory.dmp

    Filesize

    4KB

  • memory/3244-129-0x0000000008D60000-0x0000000008D61000-memory.dmp

    Filesize

    4KB

  • memory/3244-130-0x00000000093B0000-0x00000000093B1000-memory.dmp

    Filesize

    4KB

  • memory/3244-131-0x0000000009840000-0x0000000009841000-memory.dmp

    Filesize

    4KB