Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
15-10-2021 15:11
Static task
static1
General
-
Target
70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe
-
Size
363KB
-
MD5
bef5465b8cb21c272de1a5184263fadb
-
SHA1
b40b01fcf9229a409493980a9a4b69f273652eaf
-
SHA256
70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466
-
SHA512
b4edc2d7d74865231cc3b396a2362c93301ad09278209724ae6d47eff2e9b8275e363b8493e937fa06a08b4ee7c5c5c091f3982796bdc2bdb64a7f9dcef7808f
Malware Config
Extracted
redline
bir
94.228.116.174:44006
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3088-124-0x0000000000400000-0x0000000000422000-memory.dmp family_redline behavioral1/memory/3088-125-0x000000000041B256-mapping.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exedescription pid process target process PID 3704 set thread context of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exepid process 3088 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exedescription pid process Token: SeDebugPrivilege 3088 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exedescription pid process target process PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe PID 3704 wrote to memory of 3088 3704 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe 70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe"C:\Users\Admin\AppData\Local\Temp\70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe"C:\Users\Admin\AppData\Local\Temp\70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\70c72a26044f1864f7d4db6d9a68e5a03821ef21868756d76b0ba162762cb466.exe.logMD5
0c2899d7c6746f42d5bbe088c777f94c
SHA1622f66c5f7a3c91b28a9f43ce7c6cabadbf514f1
SHA2565b0b99740cadaeff7b9891136644b396941547e20cc7eea646560d0dad5a5458
SHA512ab7a3409ed4b6ca00358330a3aa4ef6de7d81eb21a5e24bb629ef6a7c7c4e2a70ca3accfbc989ed6e495fdb8eb6203a26d6f2a37b2a5809af4276af375b49078
-
memory/3088-135-0x0000000007BE0000-0x0000000007BE1000-memory.dmpFilesize
4KB
-
memory/3088-124-0x0000000000400000-0x0000000000422000-memory.dmpFilesize
136KB
-
memory/3088-132-0x0000000005600000-0x0000000005601000-memory.dmpFilesize
4KB
-
memory/3088-130-0x0000000006490000-0x0000000006491000-memory.dmpFilesize
4KB
-
memory/3088-141-0x0000000008C50000-0x0000000008C51000-memory.dmpFilesize
4KB
-
memory/3088-140-0x0000000008A70000-0x0000000008A71000-memory.dmpFilesize
4KB
-
memory/3088-139-0x00000000088D0000-0x00000000088D1000-memory.dmpFilesize
4KB
-
memory/3088-136-0x0000000005480000-0x000000000597E000-memory.dmpFilesize
5.0MB
-
memory/3088-133-0x0000000006210000-0x0000000006211000-memory.dmpFilesize
4KB
-
memory/3088-138-0x0000000008E00000-0x0000000008E01000-memory.dmpFilesize
4KB
-
memory/3088-142-0x000000000A6F0000-0x000000000A6F1000-memory.dmpFilesize
4KB
-
memory/3088-137-0x0000000008700000-0x0000000008701000-memory.dmpFilesize
4KB
-
memory/3088-125-0x000000000041B256-mapping.dmp
-
memory/3088-134-0x0000000006320000-0x0000000006321000-memory.dmpFilesize
4KB
-
memory/3704-123-0x0000000006340000-0x000000000637E000-memory.dmpFilesize
248KB
-
memory/3704-115-0x0000000000D60000-0x0000000000D61000-memory.dmpFilesize
4KB
-
memory/3704-119-0x00000000056C0000-0x0000000005BBE000-memory.dmpFilesize
5.0MB
-
memory/3704-117-0x0000000005BC0000-0x0000000005BC1000-memory.dmpFilesize
4KB
-
memory/3704-118-0x00000000055F0000-0x00000000055F1000-memory.dmpFilesize
4KB
-
memory/3704-122-0x00000000063A0000-0x00000000063A1000-memory.dmpFilesize
4KB
-
memory/3704-121-0x00000000059C0000-0x00000000059C5000-memory.dmpFilesize
20KB
-
memory/3704-120-0x0000000005690000-0x0000000005691000-memory.dmpFilesize
4KB