Analysis
-
max time kernel
122s -
max time network
174s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
23-08-2021 05:13
Static task
static1
Behavioral task
behavioral1
Sample
7021cbf39452b83c63c57bbf706f9a9e.exe
Resource
win7v20210410
General
-
Target
7021cbf39452b83c63c57bbf706f9a9e.exe
-
Size
344KB
-
MD5
7021cbf39452b83c63c57bbf706f9a9e
-
SHA1
414a61b96e04762d02e6ab60095ca8845017908f
-
SHA256
8f308760b57ddfb34fbbcd49563b3056dabdb589d1999265bc8952453c36d261
-
SHA512
706463bcc47237c4c8f16080780e925ad491b49dc77cdf0cbc1be5bb55eebae566f71093e125abb95d3d9125af9274109a349b761ba4fa61a97a042ba04fff1d
Malware Config
Extracted
redline
UPD
193.56.146.78:54955
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1660-62-0x0000000003E80000-0x0000000003E9C000-memory.dmp family_redline behavioral1/memory/1660-63-0x0000000003EF0000-0x0000000003F0A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7021cbf39452b83c63c57bbf706f9a9e.exepid process 1660 7021cbf39452b83c63c57bbf706f9a9e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7021cbf39452b83c63c57bbf706f9a9e.exedescription pid process Token: SeDebugPrivilege 1660 7021cbf39452b83c63c57bbf706f9a9e.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1660-60-0x0000000000220000-0x000000000024F000-memory.dmpFilesize
188KB
-
memory/1660-61-0x0000000000400000-0x00000000023C0000-memory.dmpFilesize
31.8MB
-
memory/1660-62-0x0000000003E80000-0x0000000003E9C000-memory.dmpFilesize
112KB
-
memory/1660-63-0x0000000003EF0000-0x0000000003F0A000-memory.dmpFilesize
104KB
-
memory/1660-65-0x00000000067C2000-0x00000000067C3000-memory.dmpFilesize
4KB
-
memory/1660-66-0x00000000067C3000-0x00000000067C4000-memory.dmpFilesize
4KB
-
memory/1660-64-0x00000000067C1000-0x00000000067C2000-memory.dmpFilesize
4KB
-
memory/1660-67-0x00000000067C4000-0x00000000067C6000-memory.dmpFilesize
8KB