Analysis
-
max time kernel
144s -
max time network
139s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
26-09-2021 20:57
General
-
Target
RedLine_Stage4.exe
-
Size
118KB
-
MD5
f0f9a9448f7a0494d9bf6e11694bfce0
-
SHA1
e3d5c8af3b294813b562fead751cc5c2f5c8a51c
-
SHA256
2fe3f6fc8b9b9f4d1bddc0e97ddd64229da2a069cf199bcd435d14a3e27e4e19
-
SHA512
6e65ca507544ffe889020f61f1020aac0c3d2569985bb740ecfdbaae1c46ffaa0540dd19ca9a7a07ad31c0a743e5bb49f94cedaf585e2cccd0cecf02b7516f02
Score
7/10
Malware Config
Signatures
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\RedLine_Stage4.exe"C:\Users\Admin\AppData\Local\Temp\RedLine_Stage4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-54-0x0000000001180000-0x0000000001181000-memory.dmpFilesize
4KB
-
memory/1128-55-0x0000000000E20000-0x0000000000E21000-memory.dmpFilesize
4KB