Analysis
-
max time kernel
81s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 15:40
Static task
static1
General
-
Target
d55df20b9c51fe7cd37a9ce10929097c50839b7a3e79a8704e1b0f77669f3915.exe
-
Size
366KB
-
MD5
2ed5329b3465224cfded0571dff66226
-
SHA1
e3eecef8e32dd47adb0d3fc8a2737af53527ffbf
-
SHA256
d55df20b9c51fe7cd37a9ce10929097c50839b7a3e79a8704e1b0f77669f3915
-
SHA512
6cc1128f7e6cb6d6fb9ab40247cc7ed352580e3208fdd07db5c6ccad8a4c036b8b45f7f2b705dd79a8c269c31c120047a3d1889424dc0604219bbd7d781a5a6f
Malware Config
Extracted
redline
UTS
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3472-116-0x0000000003680000-0x000000000369F000-memory.dmp family_redline behavioral1/memory/3472-118-0x0000000003840000-0x000000000385D000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d55df20b9c51fe7cd37a9ce10929097c50839b7a3e79a8704e1b0f77669f3915.exedescription pid process Token: SeDebugPrivilege 3472 d55df20b9c51fe7cd37a9ce10929097c50839b7a3e79a8704e1b0f77669f3915.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3472-115-0x0000000001879000-0x000000000189C000-memory.dmpFilesize
140KB
-
memory/3472-116-0x0000000003680000-0x000000000369F000-memory.dmpFilesize
124KB
-
memory/3472-117-0x0000000005FF0000-0x0000000005FF1000-memory.dmpFilesize
4KB
-
memory/3472-118-0x0000000003840000-0x000000000385D000-memory.dmpFilesize
116KB
-
memory/3472-119-0x00000000064F0000-0x00000000064F1000-memory.dmpFilesize
4KB
-
memory/3472-120-0x0000000003990000-0x0000000003991000-memory.dmpFilesize
4KB
-
memory/3472-122-0x0000000005E80000-0x0000000005E81000-memory.dmpFilesize
4KB
-
memory/3472-121-0x0000000003400000-0x0000000003430000-memory.dmpFilesize
192KB
-
memory/3472-123-0x0000000000400000-0x00000000016CE000-memory.dmpFilesize
18.8MB
-
memory/3472-126-0x0000000005FE3000-0x0000000005FE4000-memory.dmpFilesize
4KB
-
memory/3472-125-0x0000000005FE2000-0x0000000005FE3000-memory.dmpFilesize
4KB
-
memory/3472-124-0x0000000005FE0000-0x0000000005FE1000-memory.dmpFilesize
4KB
-
memory/3472-127-0x00000000039C0000-0x00000000039C1000-memory.dmpFilesize
4KB
-
memory/3472-128-0x0000000006B00000-0x0000000006B01000-memory.dmpFilesize
4KB
-
memory/3472-129-0x0000000005FE4000-0x0000000005FE6000-memory.dmpFilesize
8KB
-
memory/3472-130-0x0000000007BA0000-0x0000000007BA1000-memory.dmpFilesize
4KB
-
memory/3472-131-0x0000000007D70000-0x0000000007D71000-memory.dmpFilesize
4KB
-
memory/3472-132-0x00000000082A0000-0x00000000082A1000-memory.dmpFilesize
4KB
-
memory/3472-133-0x0000000008380000-0x0000000008381000-memory.dmpFilesize
4KB
-
memory/3472-134-0x0000000008560000-0x0000000008561000-memory.dmpFilesize
4KB
-
memory/3472-135-0x00000000085C0000-0x00000000085C1000-memory.dmpFilesize
4KB