Analysis
-
max time kernel
58s -
max time network
132s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
30-08-2021 20:18
Static task
static1
General
-
Target
4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exe
-
Size
309KB
-
MD5
80be2cb2a90aa45b243abf22a04985bd
-
SHA1
286c7746f725429bfff7994aa79046a114edfce3
-
SHA256
4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7
-
SHA512
112b8c0505a91aeab9d99f74e2d4f73fa4fb939e7f209fe7ba0119f08b8fa6c9792e8f1e3467a0e5694b0c692b8dcff8ae800cab7312ce4fbd7dc60d47fa27c3
Malware Config
Extracted
redline
mix31.08
185.215.113.15:6043
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/800-117-0x0000000003C10000-0x0000000003C2F000-memory.dmp family_redline behavioral1/memory/800-121-0x0000000003EB0000-0x0000000003ECE000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exepid process 800 4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exedescription pid process Token: SeDebugPrivilege 800 4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exe"C:\Users\Admin\AppData\Local\Temp\4da095e0a59cecad3fbfc6fa4f33c00e71edc9fffae041a521552390825732f7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/800-114-0x0000000003AE0000-0x0000000003B10000-memory.dmpFilesize
192KB
-
memory/800-115-0x0000000000400000-0x0000000001D9A000-memory.dmpFilesize
25.6MB
-
memory/800-116-0x0000000003B90000-0x0000000003B91000-memory.dmpFilesize
4KB
-
memory/800-117-0x0000000003C10000-0x0000000003C2F000-memory.dmpFilesize
124KB
-
memory/800-118-0x0000000003B92000-0x0000000003B93000-memory.dmpFilesize
4KB
-
memory/800-119-0x0000000003B93000-0x0000000003B94000-memory.dmpFilesize
4KB
-
memory/800-120-0x0000000006520000-0x0000000006521000-memory.dmpFilesize
4KB
-
memory/800-121-0x0000000003EB0000-0x0000000003ECE000-memory.dmpFilesize
120KB
-
memory/800-122-0x0000000006A20000-0x0000000006A21000-memory.dmpFilesize
4KB
-
memory/800-123-0x0000000004070000-0x0000000004071000-memory.dmpFilesize
4KB
-
memory/800-124-0x0000000007030000-0x0000000007031000-memory.dmpFilesize
4KB
-
memory/800-125-0x0000000003B94000-0x0000000003B96000-memory.dmpFilesize
8KB
-
memory/800-126-0x0000000007140000-0x0000000007141000-memory.dmpFilesize
4KB
-
memory/800-127-0x0000000007190000-0x0000000007191000-memory.dmpFilesize
4KB
-
memory/800-128-0x0000000008370000-0x0000000008371000-memory.dmpFilesize
4KB
-
memory/800-129-0x0000000008540000-0x0000000008541000-memory.dmpFilesize
4KB
-
memory/800-130-0x0000000008B20000-0x0000000008B21000-memory.dmpFilesize
4KB
-
memory/800-131-0x0000000008E90000-0x0000000008E91000-memory.dmpFilesize
4KB
-
memory/800-132-0x0000000008F80000-0x0000000008F81000-memory.dmpFilesize
4KB
-
memory/800-133-0x0000000009180000-0x0000000009181000-memory.dmpFilesize
4KB