Analysis
- max time kernel
30s - max time network
120s - platform
windows10_x64 - resource
win10v20210408 - submitted
26/08/2021, 06:16
General
- Target 84d4f42700e25257dd5180c30af9daec.exe
- Size 276KB
- Sample210826-wrx5dkc3va
- SHA256 95fdda1da7a2172ac7b2c0e4cf0fa1e40faf2990a46f132597271754a721300c
Malware Config
Extracted
-
redline
-
185.215.113.29:8678
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\84d4f42700e25257dd5180c30af9daec.exe"C:\Users\Admin\AppData\Local\Temp\84d4f42700e25257dd5180c30af9daec.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4796-114-0x0000000002E30000-0x0000000002E60000-memory.dmp
memory/4796-115-0x0000000000400000-0x0000000002CD5000-memory.dmp
memory/4796-116-0x0000000004C90000-0x0000000004CAD000-memory.dmp
memory/4796-117-0x0000000007480000-0x0000000007481000-memory.dmp
memory/4796-118-0x0000000007482000-0x0000000007483000-memory.dmp
memory/4796-120-0x0000000007490000-0x0000000007491000-memory.dmp
memory/4796-119-0x0000000007483000-0x0000000007484000-memory.dmp
memory/4796-121-0x0000000007340000-0x000000000735C000-memory.dmp
memory/4796-122-0x0000000007990000-0x0000000007991000-memory.dmp
memory/4796-123-0x00000000073F0000-0x00000000073F1000-memory.dmp
memory/4796-124-0x0000000007FA0000-0x0000000007FA1000-memory.dmp
memory/4796-125-0x0000000007420000-0x0000000007421000-memory.dmp
memory/4796-126-0x0000000007484000-0x0000000007486000-memory.dmp
memory/4796-127-0x00000000080D0000-0x00000000080D1000-memory.dmp
memory/4796-128-0x00000000092F0000-0x00000000092F1000-memory.dmp
memory/4796-129-0x00000000094C0000-0x00000000094C1000-memory.dmp
memory/4796-130-0x0000000009AE0000-0x0000000009AE1000-memory.dmp
memory/4796-131-0x0000000009C00000-0x0000000009C01000-memory.dmp
memory/4796-132-0x0000000009CC0000-0x0000000009CC1000-memory.dmp
memory/4796-133-0x0000000009E70000-0x0000000009E71000-memory.dmp