Analysis
- max time kernel
116s - max time network
152s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
25/09/2021, 06:51
General
- Target 1ca5f33ffb87f631cf17e4fcd06eafc1.exe
- Size 361KB
- Sample210925-hmhfesafc2
- SHA256 922295fc8e35b0c40119f965ae4f9f00a4d585ec0fbccd14c34b4c1a3f012cd7
Malware Config
Extracted
-
redline
-
mix25.09
-
185.215.113.15:6043
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ca5f33ffb87f631cf17e4fcd06eafc1.exe"C:\Users\Admin\AppData\Local\Temp\1ca5f33ffb87f631cf17e4fcd06eafc1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2016-115-0x00000000049C0000-0x00000000049DF000-memory.dmp
memory/2016-116-0x0000000007290000-0x0000000007291000-memory.dmp
memory/2016-117-0x00000000070D0000-0x00000000070EE000-memory.dmp
memory/2016-119-0x0000000000400000-0x0000000002BA3000-memory.dmp
memory/2016-118-0x0000000002BB0000-0x0000000002C5E000-memory.dmp
memory/2016-120-0x0000000007280000-0x0000000007281000-memory.dmp
memory/2016-121-0x0000000007790000-0x0000000007791000-memory.dmp
memory/2016-122-0x0000000007282000-0x0000000007283000-memory.dmp
memory/2016-123-0x0000000007283000-0x0000000007284000-memory.dmp
memory/2016-124-0x0000000007180000-0x0000000007181000-memory.dmp
memory/2016-125-0x0000000007DA0000-0x0000000007DA1000-memory.dmp
memory/2016-126-0x00000000071B0000-0x00000000071B1000-memory.dmp
memory/2016-127-0x0000000007284000-0x0000000007286000-memory.dmp
memory/2016-128-0x0000000007230000-0x0000000007231000-memory.dmp
memory/2016-129-0x0000000009080000-0x0000000009081000-memory.dmp
memory/2016-130-0x0000000009250000-0x0000000009251000-memory.dmp
memory/2016-131-0x0000000009870000-0x0000000009871000-memory.dmp
memory/2016-132-0x0000000009990000-0x0000000009991000-memory.dmp
memory/2016-133-0x0000000009B50000-0x0000000009B51000-memory.dmp
memory/2016-134-0x0000000009C80000-0x0000000009C81000-memory.dmp