Analysis
-
max time kernel
19s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
04-08-2021 23:27
Behavioral task
behavioral1
Sample
e63ad2b11a3b7bd223b934477de747cb.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e63ad2b11a3b7bd223b934477de747cb.exe
Resource
win10v20210408
General
-
Target
e63ad2b11a3b7bd223b934477de747cb.exe
-
Size
105KB
-
MD5
e63ad2b11a3b7bd223b934477de747cb
-
SHA1
0af10fdb8e1a6da26b0806e66c62088927ed3f43
-
SHA256
b3b10dd428f6843a7fe7a3b32aeb530910da6bbe3bf45b6b1688b3701ace2200
-
SHA512
9b2bd45a5cdd9e81617ba9b52e3c8338b0feb9d8faafe426b65a06e22614ab2c7f7231921475a3a9106350d0117743bf6c58876a7bfe958c1ee6dd561c3a363c
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e63ad2b11a3b7bd223b934477de747cb.exepid process 640 e63ad2b11a3b7bd223b934477de747cb.exe 640 e63ad2b11a3b7bd223b934477de747cb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e63ad2b11a3b7bd223b934477de747cb.exedescription pid process Token: SeDebugPrivilege 640 e63ad2b11a3b7bd223b934477de747cb.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/640-114-0x0000000000ED0000-0x0000000000ED1000-memory.dmpFilesize
4KB
-
memory/640-116-0x0000000005D70000-0x0000000005D71000-memory.dmpFilesize
4KB
-
memory/640-117-0x0000000005820000-0x0000000005821000-memory.dmpFilesize
4KB
-
memory/640-118-0x0000000005880000-0x0000000005881000-memory.dmpFilesize
4KB
-
memory/640-119-0x00000000058C0000-0x00000000058C1000-memory.dmpFilesize
4KB
-
memory/640-120-0x0000000005760000-0x0000000005D66000-memory.dmpFilesize
6.0MB
-
memory/640-121-0x0000000005B30000-0x0000000005B31000-memory.dmpFilesize
4KB
-
memory/640-122-0x0000000006DA0000-0x0000000006DA1000-memory.dmpFilesize
4KB
-
memory/640-123-0x00000000074A0000-0x00000000074A1000-memory.dmpFilesize
4KB
-
memory/640-124-0x0000000006F70000-0x0000000006F71000-memory.dmpFilesize
4KB
-
memory/640-125-0x0000000007ED0000-0x0000000007ED1000-memory.dmpFilesize
4KB
-
memory/640-126-0x00000000072A0000-0x00000000072A1000-memory.dmpFilesize
4KB
-
memory/640-127-0x00000000073C0000-0x00000000073C1000-memory.dmpFilesize
4KB
-
memory/640-128-0x0000000007460000-0x0000000007461000-memory.dmpFilesize
4KB