Overview
overview
10Static
static
10Fri191454c4b4.exe
windows7_x64
8Fri191454c4b4.exe
windows10_x64
8Fri1921f7a9d3.exe
windows7_x64
10Fri1921f7a9d3.exe
windows10_x64
10Fri192902b3c24.exe
windows7_x64
10Fri192902b3c24.exe
windows10_x64
10Fri192b9eeaa03b.exe
windows7_x64
10Fri192b9eeaa03b.exe
windows10_x64
10Fri192c305b4a.exe
windows7_x64
10Fri192c305b4a.exe
windows10_x64
10Fri192f077...dd.exe
windows7_x64
10Fri192f077...dd.exe
windows10_x64
10Fri195cd4d...97.exe
windows7_x64
10Fri195cd4d...97.exe
windows10_x64
10Fri19870e2...44.exe
windows7_x64
10Fri19870e2...44.exe
windows10_x64
10Fri19927b4...d1.exe
windows7_x64
10Fri19927b4...d1.exe
windows10_x64
10Fri19ca03f05489b.exe
windows7_x64
6Fri19ca03f05489b.exe
windows10_x64
6Fri19d30056588.exe
windows7_x64
10Fri19d30056588.exe
windows10_x64
10libcurl.dll
windows7_x64
3libcurl.dll
windows10_x64
3libcurlpp.dll
windows7_x64
libcurlpp.dll
windows10_x64
3libgcc_s_dw2-1.dll
windows7_x64
libgcc_s_dw2-1.dll
windows10_x64
3libstdc++-6.dll
windows7_x64
3libstdc++-6.dll
windows10_x64
3libwinpthread-1.dll
windows7_x64
1libwinpthread-1.dll
windows10_x64
1Analysis
-
max time kernel
61s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en -
submitted
10-09-2021 21:28
Behavioral task
behavioral1
Sample
Fri191454c4b4.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
Fri191454c4b4.exe
Resource
win10-en
Behavioral task
behavioral3
Sample
Fri1921f7a9d3.exe
Resource
win7v20210408
Behavioral task
behavioral4
Sample
Fri1921f7a9d3.exe
Resource
win10-en
Behavioral task
behavioral5
Sample
Fri192902b3c24.exe
Resource
win7-en
Behavioral task
behavioral6
Sample
Fri192902b3c24.exe
Resource
win10v20210408
Behavioral task
behavioral7
Sample
Fri192b9eeaa03b.exe
Resource
win7-en
Behavioral task
behavioral8
Sample
Fri192b9eeaa03b.exe
Resource
win10v20210408
Behavioral task
behavioral9
Sample
Fri192c305b4a.exe
Resource
win7-en
Behavioral task
behavioral10
Sample
Fri192c305b4a.exe
Resource
win10v20210408
Behavioral task
behavioral11
Sample
Fri192f077acf656dd.exe
Resource
win7-en
Behavioral task
behavioral12
Sample
Fri192f077acf656dd.exe
Resource
win10-en
Behavioral task
behavioral13
Sample
Fri195cd4dbfdf37897.exe
Resource
win7v20210408
Behavioral task
behavioral14
Sample
Fri195cd4dbfdf37897.exe
Resource
win10-en
Behavioral task
behavioral15
Sample
Fri19870e2febf5544.exe
Resource
win7v20210408
Behavioral task
behavioral16
Sample
Fri19870e2febf5544.exe
Resource
win10-en
Behavioral task
behavioral17
Sample
Fri19927b4fe38a9d1.exe
Resource
win7v20210408
Behavioral task
behavioral18
Sample
Fri19927b4fe38a9d1.exe
Resource
win10-en
Behavioral task
behavioral19
Sample
Fri19ca03f05489b.exe
Resource
win7-en
Behavioral task
behavioral20
Sample
Fri19ca03f05489b.exe
Resource
win10v20210408
Behavioral task
behavioral21
Sample
Fri19d30056588.exe
Resource
win7-en
Behavioral task
behavioral22
Sample
Fri19d30056588.exe
Resource
win10v20210408
Behavioral task
behavioral23
Sample
libcurl.dll
Resource
win7-en
Behavioral task
behavioral24
Sample
libcurl.dll
Resource
win10v20210408
Behavioral task
behavioral25
Sample
libcurlpp.dll
Resource
win7-en
Behavioral task
behavioral26
Sample
libcurlpp.dll
Resource
win10v20210408
Behavioral task
behavioral27
Sample
libgcc_s_dw2-1.dll
Resource
win7-en
Behavioral task
behavioral28
Sample
libgcc_s_dw2-1.dll
Resource
win10-en
Behavioral task
behavioral29
Sample
libstdc++-6.dll
Resource
win7v20210408
Behavioral task
behavioral30
Sample
libstdc++-6.dll
Resource
win10-en
Behavioral task
behavioral31
Sample
libwinpthread-1.dll
Resource
win7v20210408
Behavioral task
behavioral32
Sample
libwinpthread-1.dll
Resource
win10-en
General
-
Target
Fri19927b4fe38a9d1.exe
-
Size
390KB
-
MD5
17453605e54baa73884d6dce7d57d439
-
SHA1
0153451591fb1b7a5dadaf8206265c094b9f15ad
-
SHA256
065d26691736150f3643cb4bd06e991f62160406936d9053a82af11b8d0272ff
-
SHA512
8e0472691fdbd700fbc28ed4e66cdd11696df1fb70d22a35876c936484fe99acc8038683f938047493b71603012aebdd0b4fbb192e57d66d6b0e873a8d727de3
Malware Config
Extracted
redline
pab123
45.14.49.169:22411
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral18/memory/3408-116-0x0000000004970000-0x000000000498F000-memory.dmp family_redline behavioral18/memory/3408-118-0x0000000004B40000-0x0000000004B5E000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
Fri19927b4fe38a9d1.exepid process 3408 Fri19927b4fe38a9d1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Fri19927b4fe38a9d1.exedescription pid process Token: SeDebugPrivilege 3408 Fri19927b4fe38a9d1.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3408-115-0x00000000048B0000-0x00000000048E0000-memory.dmpFilesize
192KB
-
memory/3408-116-0x0000000004970000-0x000000000498F000-memory.dmpFilesize
124KB
-
memory/3408-117-0x00000000073E0000-0x00000000073E1000-memory.dmpFilesize
4KB
-
memory/3408-118-0x0000000004B40000-0x0000000004B5E000-memory.dmpFilesize
120KB
-
memory/3408-119-0x00000000078E0000-0x00000000078E1000-memory.dmpFilesize
4KB
-
memory/3408-120-0x0000000000400000-0x0000000002B6E000-memory.dmpFilesize
39.4MB
-
memory/3408-123-0x00000000073D3000-0x00000000073D4000-memory.dmpFilesize
4KB
-
memory/3408-122-0x00000000073D2000-0x00000000073D3000-memory.dmpFilesize
4KB
-
memory/3408-121-0x00000000073D0000-0x00000000073D1000-memory.dmpFilesize
4KB
-
memory/3408-124-0x0000000007280000-0x0000000007281000-memory.dmpFilesize
4KB
-
memory/3408-125-0x00000000072B0000-0x00000000072B1000-memory.dmpFilesize
4KB
-
memory/3408-126-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/3408-127-0x00000000073D4000-0x00000000073D6000-memory.dmpFilesize
8KB
-
memory/3408-128-0x0000000007F60000-0x0000000007F61000-memory.dmpFilesize
4KB
-
memory/3408-129-0x0000000009180000-0x0000000009181000-memory.dmpFilesize
4KB
-
memory/3408-130-0x0000000009350000-0x0000000009351000-memory.dmpFilesize
4KB
-
memory/3408-131-0x0000000009970000-0x0000000009971000-memory.dmpFilesize
4KB
-
memory/3408-132-0x0000000009CE0000-0x0000000009CE1000-memory.dmpFilesize
4KB
-
memory/3408-133-0x0000000009DD0000-0x0000000009DD1000-memory.dmpFilesize
4KB
-
memory/3408-134-0x0000000009D80000-0x0000000009D81000-memory.dmpFilesize
4KB