Analysis
- max time kernel
79s - max time network
121s - platform
windows10_x64 - resource
win10-en-20210920 - submitted
08/10/2021, 15:31
General
- Target 6c87df463c7e57eca5835bfc882bb318.exe
- Size 296KB
- Sample211008-sx4fraefd8
- SHA256 902919bbb5fcfe040dfa4504239b4638bc78e1fa5e296de5fe92d0b578902355
Malware Config
Extracted
-
redline
-
new
-
45.9.20.107:46187
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\6c87df463c7e57eca5835bfc882bb318.exe"C:\Users\Admin\AppData\Local\Temp\6c87df463c7e57eca5835bfc882bb318.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2352-115-0x0000000002EE1000-0x0000000002F04000-memory.dmp
memory/2352-116-0x00000000001C0000-0x00000000001F0000-memory.dmp
memory/2352-117-0x0000000000400000-0x0000000002B8A000-memory.dmp
memory/2352-118-0x0000000004A10000-0x0000000004A2F000-memory.dmp
memory/2352-119-0x00000000074B0000-0x00000000074B1000-memory.dmp
memory/2352-120-0x00000000074B2000-0x00000000074B3000-memory.dmp
memory/2352-121-0x00000000074B3000-0x00000000074B4000-memory.dmp
memory/2352-122-0x00000000074C0000-0x00000000074C1000-memory.dmp
memory/2352-123-0x0000000004AD0000-0x0000000004AED000-memory.dmp
memory/2352-124-0x00000000079C0000-0x00000000079C1000-memory.dmp
memory/2352-125-0x0000000004D40000-0x0000000004D41000-memory.dmp
memory/2352-126-0x0000000007FD0000-0x0000000007FD1000-memory.dmp
memory/2352-127-0x0000000004D90000-0x0000000004D91000-memory.dmp
memory/2352-128-0x00000000074B4000-0x00000000074B6000-memory.dmp
memory/2352-129-0x0000000004E00000-0x0000000004E01000-memory.dmp
memory/2352-130-0x0000000008BC0000-0x0000000008BC1000-memory.dmp
memory/2352-131-0x0000000008D90000-0x0000000008D91000-memory.dmp
memory/2352-132-0x00000000093A0000-0x00000000093A1000-memory.dmp
memory/2352-133-0x0000000009700000-0x0000000009701000-memory.dmp
memory/2352-134-0x0000000009800000-0x0000000009801000-memory.dmp
memory/2352-135-0x00000000098B0000-0x00000000098B1000-memory.dmp