Analysis
-
max time kernel
138s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en -
submitted
13-09-2021 15:29
Static task
static1
Behavioral task
behavioral1
Sample
593a20557bc4f2e48090138ac3780b32.exe
Resource
win7-en
General
-
Target
593a20557bc4f2e48090138ac3780b32.exe
-
Size
291KB
-
MD5
593a20557bc4f2e48090138ac3780b32
-
SHA1
a570a1e1c270f4dde80689e600473f47fef6c985
-
SHA256
4965e6e224897f69fa884aded52e0dd664bc21f16a0733bd01f733dee66868e8
-
SHA512
1cf75da34b1b1b5e78de3d2a44a9a01f127ab35197b6cb6debd6212d8f6b2e492bd5d9babfb6ae0123306c306a82f7e75be6466da110ae1983048d786d5dad89
Malware Config
Extracted
redline
1309
95.217.77.23:53845
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1188-54-0x00000000003E0000-0x00000000003FF000-memory.dmp family_redline behavioral1/memory/1188-58-0x0000000003E50000-0x0000000003E6E000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
593a20557bc4f2e48090138ac3780b32.exepid process 1188 593a20557bc4f2e48090138ac3780b32.exe 1188 593a20557bc4f2e48090138ac3780b32.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
593a20557bc4f2e48090138ac3780b32.exedescription pid process Token: SeDebugPrivilege 1188 593a20557bc4f2e48090138ac3780b32.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1188-52-0x0000000000240000-0x0000000000270000-memory.dmpFilesize
192KB
-
memory/1188-53-0x0000000000400000-0x0000000002167000-memory.dmpFilesize
29.4MB
-
memory/1188-54-0x00000000003E0000-0x00000000003FF000-memory.dmpFilesize
124KB
-
memory/1188-56-0x0000000004002000-0x0000000004003000-memory.dmpFilesize
4KB
-
memory/1188-55-0x0000000004001000-0x0000000004002000-memory.dmpFilesize
4KB
-
memory/1188-57-0x0000000004003000-0x0000000004004000-memory.dmpFilesize
4KB
-
memory/1188-58-0x0000000003E50000-0x0000000003E6E000-memory.dmpFilesize
120KB
-
memory/1188-59-0x0000000004004000-0x0000000004006000-memory.dmpFilesize
8KB