Analysis
- max time kernel
18s - max time network
126s - platform
windows10_x64 - resource
win10v20210410 - submitted
18/08/2021, 13:46
General
- Target e1e11f79b7a990b4394aeaa56930ad62.exe
- Size 264KB
- Sample210818-r76cb4dzba
- SHA256 59b079bf605ddabf00d65f286c4295455047dd0941bf651acc3d3a8e9649c0bf
Malware Config
Extracted
-
redline
-
185.215.113.29:8889
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1e11f79b7a990b4394aeaa56930ad62.exe"C:\Users\Admin\AppData\Local\Temp\e1e11f79b7a990b4394aeaa56930ad62.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3952-114-0x0000000002D20000-0x0000000002D4F000-memory.dmp
memory/3952-115-0x0000000004AB0000-0x0000000004ACC000-memory.dmp
memory/3952-116-0x0000000007230000-0x0000000007231000-memory.dmp
memory/3952-117-0x0000000007200000-0x000000000721A000-memory.dmp
memory/3952-118-0x0000000007730000-0x0000000007731000-memory.dmp
memory/3952-119-0x0000000007DD0000-0x0000000007DD1000-memory.dmp
memory/3952-120-0x0000000007DF0000-0x0000000007DF1000-memory.dmp
memory/3952-121-0x0000000000400000-0x0000000002CD0000-memory.dmp
memory/3952-122-0x0000000007220000-0x0000000007221000-memory.dmp
memory/3952-124-0x0000000007223000-0x0000000007224000-memory.dmp
memory/3952-123-0x0000000007222000-0x0000000007223000-memory.dmp
memory/3952-125-0x0000000007E50000-0x0000000007E51000-memory.dmp
memory/3952-126-0x0000000007224000-0x0000000007226000-memory.dmp
memory/3952-127-0x0000000007FE0000-0x0000000007FE1000-memory.dmp
memory/3952-128-0x0000000008CC0000-0x0000000008CC1000-memory.dmp
memory/3952-129-0x0000000008E90000-0x0000000008E91000-memory.dmp
memory/3952-130-0x00000000094C0000-0x00000000094C1000-memory.dmp
memory/3952-131-0x0000000009820000-0x0000000009821000-memory.dmp
memory/3952-132-0x00000000098C0000-0x00000000098C1000-memory.dmp
memory/3952-133-0x00000000099D0000-0x00000000099D1000-memory.dmp