Analysis
- max time kernel
118s - max time network
118s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
26/09/2021, 04:05
General
- Target 36c0f009d48d0b0b54d65a86370e1d9d.exe
- Size 249KB
- Sample210926-enk16aecbm
- SHA256 e28922e1df7dabbd61838c7d0d9deaa0c1cd897620fa3988f43fb99d28bafd90
Malware Config
Extracted
-
redline
-
PUB
-
45.9.20.20:13441
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\36c0f009d48d0b0b54d65a86370e1d9d.exe"C:\Users\Admin\AppData\Local\Temp\36c0f009d48d0b0b54d65a86370e1d9d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2332-115-0x00000000022B0000-0x00000000022CF000-memory.dmp
memory/2332-117-0x0000000000400000-0x00000000004C4000-memory.dmp
memory/2332-116-0x00000000021F0000-0x0000000002220000-memory.dmp
memory/2332-119-0x0000000002732000-0x0000000002733000-memory.dmp
memory/2332-118-0x0000000002730000-0x0000000002731000-memory.dmp
memory/2332-120-0x0000000002733000-0x0000000002734000-memory.dmp
memory/2332-121-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/2332-122-0x00000000025C0000-0x00000000025DE000-memory.dmp
memory/2332-123-0x0000000005350000-0x0000000005351000-memory.dmp
memory/2332-124-0x0000000002890000-0x0000000002891000-memory.dmp
memory/2332-125-0x0000000002950000-0x0000000002951000-memory.dmp
memory/2332-126-0x00000000028B0000-0x00000000028B1000-memory.dmp
memory/2332-127-0x0000000002A60000-0x0000000002A61000-memory.dmp
memory/2332-128-0x0000000002734000-0x0000000002736000-memory.dmp
memory/2332-129-0x0000000006AE0000-0x0000000006AE1000-memory.dmp
memory/2332-130-0x00000000071E0000-0x00000000071E1000-memory.dmp
memory/2332-131-0x0000000006DA0000-0x0000000006DA1000-memory.dmp
memory/2332-132-0x0000000007160000-0x0000000007161000-memory.dmp
memory/2332-133-0x0000000007710000-0x0000000007711000-memory.dmp
memory/2332-134-0x00000000077B0000-0x00000000077B1000-memory.dmp