Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
15-10-2021 15:00
Static task
static1
General
-
Target
3873da4e0a00eec58e4550d570bed9bf83584d2f66c0b087177dd0466c5cf472.exe
-
Size
366KB
-
MD5
1bb63d3a7640de5dd163d38c38899749
-
SHA1
661a4898738fb7ebb5f1b95d62d3b9c8b1b21ab9
-
SHA256
3873da4e0a00eec58e4550d570bed9bf83584d2f66c0b087177dd0466c5cf472
-
SHA512
bfcf1b163c772f9d1ee7af880c57c1836558327528e97be985e7fab31bf3579c1144c2bfe95c8e0cb81cacbcdaab7007127d629689ada0818c58c51d0bd641a6
Malware Config
Extracted
redline
PUB
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1924-118-0x0000000003550000-0x000000000356F000-memory.dmp family_redline behavioral1/memory/1924-123-0x00000000036C0000-0x00000000036DD000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3873da4e0a00eec58e4550d570bed9bf83584d2f66c0b087177dd0466c5cf472.exedescription pid process Token: SeDebugPrivilege 1924 3873da4e0a00eec58e4550d570bed9bf83584d2f66c0b087177dd0466c5cf472.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1924-116-0x0000000001870000-0x00000000018A0000-memory.dmpFilesize
192KB
-
memory/1924-117-0x0000000000400000-0x00000000016CF000-memory.dmpFilesize
18.8MB
-
memory/1924-118-0x0000000003550000-0x000000000356F000-memory.dmpFilesize
124KB
-
memory/1924-119-0x0000000005F50000-0x0000000005F51000-memory.dmpFilesize
4KB
-
memory/1924-120-0x0000000003720000-0x0000000003721000-memory.dmpFilesize
4KB
-
memory/1924-121-0x0000000003722000-0x0000000003723000-memory.dmpFilesize
4KB
-
memory/1924-122-0x0000000003723000-0x0000000003724000-memory.dmpFilesize
4KB
-
memory/1924-123-0x00000000036C0000-0x00000000036DD000-memory.dmpFilesize
116KB
-
memory/1924-124-0x0000000006450000-0x0000000006451000-memory.dmpFilesize
4KB
-
memory/1924-125-0x0000000003880000-0x0000000003881000-memory.dmpFilesize
4KB
-
memory/1924-126-0x0000000006A60000-0x0000000006A61000-memory.dmpFilesize
4KB
-
memory/1924-127-0x0000000003724000-0x0000000003726000-memory.dmpFilesize
8KB
-
memory/1924-128-0x00000000038B0000-0x00000000038B1000-memory.dmpFilesize
4KB
-
memory/1924-129-0x0000000003A70000-0x0000000003A71000-memory.dmpFilesize
4KB
-
memory/1924-130-0x00000000076E0000-0x00000000076E1000-memory.dmpFilesize
4KB
-
memory/1924-131-0x00000000078B0000-0x00000000078B1000-memory.dmpFilesize
4KB
-
memory/1924-132-0x0000000007EF0000-0x0000000007EF1000-memory.dmpFilesize
4KB
-
memory/1924-133-0x0000000007FC0000-0x0000000007FC1000-memory.dmpFilesize
4KB
-
memory/1924-134-0x00000000081C0000-0x00000000081C1000-memory.dmpFilesize
4KB
-
memory/1924-135-0x0000000008220000-0x0000000008221000-memory.dmpFilesize
4KB