Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
15-09-2021 07:11
Static task
static1
Behavioral task
behavioral1
Sample
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe
Resource
win7v20210408
General
-
Target
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe
-
Size
739KB
-
MD5
9b5c35af1cfbbd60500b69f830b51032
-
SHA1
a1053b4031ac666f846d056a08360e174b463344
-
SHA256
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96
-
SHA512
f9ca0dd8a1c95a7e7593f3733d6db6969c362c5ccf351ad423bac38e2ca4adb016618f87f3da76a17549f981e1eb5f53d3e6b0308a6354457749bf1b2e16fa72
Malware Config
Extracted
redline
adsGOOGLE
95.217.152.142:43710
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1092-63-0x0000000000400000-0x000000000044A000-memory.dmp family_redline behavioral1/memory/1092-64-0x000000000041C8BE-mapping.dmp family_redline behavioral1/memory/1092-66-0x0000000000400000-0x000000000044A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exedescription pid process target process PID 1820 set thread context of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1952 1820 WerFault.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
WerFault.exe671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exepid process 1952 WerFault.exe 1952 WerFault.exe 1952 WerFault.exe 1952 WerFault.exe 1952 WerFault.exe 1092 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 1092 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
WerFault.exepid process 1952 WerFault.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exeWerFault.exe671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exedescription pid process Token: SeDebugPrivilege 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe Token: SeDebugPrivilege 1952 WerFault.exe Token: SeDebugPrivilege 1092 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe -
Suspicious use of WriteProcessMemory 21 IoCs
Processes:
671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exedescription pid process target process PID 1820 wrote to memory of 1320 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1320 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1320 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1320 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1168 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1168 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1168 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1168 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1092 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe PID 1820 wrote to memory of 1952 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe WerFault.exe PID 1820 wrote to memory of 1952 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe WerFault.exe PID 1820 wrote to memory of 1952 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe WerFault.exe PID 1820 wrote to memory of 1952 1820 671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"2⤵
-
C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"C:\Users\Admin\AppData\Local\Temp\671faba0eb9abca8a2548f6a522ce2949b655ad273dbe8cc8db61378f088bc96.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1820 -s 6122⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-63-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1092-64-0x000000000041C8BE-mapping.dmp
-
memory/1092-66-0x0000000000400000-0x000000000044A000-memory.dmpFilesize
296KB
-
memory/1092-69-0x00000000003C0000-0x00000000003C1000-memory.dmpFilesize
4KB
-
memory/1820-60-0x0000000000030000-0x0000000000031000-memory.dmpFilesize
4KB
-
memory/1820-61-0x0000000000820000-0x0000000000821000-memory.dmpFilesize
4KB
-
memory/1820-62-0x0000000000510000-0x0000000000536000-memory.dmpFilesize
152KB
-
memory/1820-65-0x00000000003E0000-0x00000000003E3000-memory.dmpFilesize
12KB
-
memory/1952-68-0x0000000000000000-mapping.dmp
-
memory/1952-70-0x00000000004F0000-0x00000000004F1000-memory.dmpFilesize
4KB