Analysis
- max time kernel
30s - max time network
150s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/08/2021, 20:05
General
- Target c844c77a4052cd87225ef065c71abb1d.exe
- Size 269KB
- Sample210828-ktwb8wt38s
- SHA256 d319ddd3d52abce88199f3b7d1385bb3258290139b8b05a1ef2b672af8da2fba
Malware Config
Extracted
-
redline
-
hello
-
80.66.87.33:36976
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c844c77a4052cd87225ef065c71abb1d.exe"C:\Users\Admin\AppData\Local\Temp\c844c77a4052cd87225ef065c71abb1d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/396-114-0x0000000003AE0000-0x0000000003B10000-memory.dmp
memory/396-115-0x0000000000400000-0x0000000001D91000-memory.dmp
memory/396-116-0x0000000003D40000-0x0000000003D5D000-memory.dmp
memory/396-117-0x0000000006710000-0x0000000006711000-memory.dmp
memory/396-118-0x0000000006700000-0x0000000006701000-memory.dmp
memory/396-119-0x0000000006702000-0x0000000006703000-memory.dmp
memory/396-120-0x0000000006703000-0x0000000006704000-memory.dmp
memory/396-121-0x0000000003EF0000-0x0000000003F0C000-memory.dmp
memory/396-122-0x0000000006C10000-0x0000000006C11000-memory.dmp
memory/396-123-0x0000000004060000-0x0000000004061000-memory.dmp
memory/396-124-0x0000000006530000-0x0000000006531000-memory.dmp
memory/396-125-0x0000000004090000-0x0000000004091000-memory.dmp
memory/396-126-0x0000000006704000-0x0000000006706000-memory.dmp
memory/396-127-0x0000000006670000-0x0000000006671000-memory.dmp
memory/396-128-0x00000000083B0000-0x00000000083B1000-memory.dmp
memory/396-129-0x0000000008580000-0x0000000008581000-memory.dmp
memory/396-130-0x0000000008BA0000-0x0000000008BA1000-memory.dmp
memory/396-131-0x0000000008F00000-0x0000000008F01000-memory.dmp
memory/396-132-0x0000000008FB0000-0x0000000008FB1000-memory.dmp
memory/396-133-0x0000000008F80000-0x0000000008F81000-memory.dmp
memory/396-134-0x00000000090C0000-0x00000000090C1000-memory.dmp