Analysis
- max time kernel
122s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
16/10/2021, 22:44
General
- Target 06d45d30ef46764b117b593baedc0f74.exe
- Size 406KB
- Sample211016-2ns34accc9
- SHA256 b5fb89e564bb6fd7432c7bb71adca535e38673b7551ec7a0265ac6ba0de5e613
Malware Config
Extracted
-
redline
-
UDP
-
45.9.20.182:52236
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\06d45d30ef46764b117b593baedc0f74.exe"C:\Users\Admin\AppData\Local\Temp\06d45d30ef46764b117b593baedc0f74.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2324-117-0x0000000000400000-0x0000000000797000-memory.dmp
memory/2324-116-0x00000000024B0000-0x00000000024E0000-memory.dmp
memory/2324-118-0x00000000025E0000-0x00000000025FF000-memory.dmp
memory/2324-119-0x0000000004F70000-0x0000000004F71000-memory.dmp
memory/2324-121-0x00000000029E2000-0x00000000029E3000-memory.dmp
memory/2324-120-0x00000000029E0000-0x00000000029E1000-memory.dmp
memory/2324-122-0x00000000029E3000-0x00000000029E4000-memory.dmp
memory/2324-123-0x00000000029A0000-0x00000000029BD000-memory.dmp
memory/2324-124-0x0000000005470000-0x0000000005471000-memory.dmp
memory/2324-125-0x0000000002B70000-0x0000000002B71000-memory.dmp
memory/2324-126-0x0000000005A80000-0x0000000005A81000-memory.dmp
memory/2324-127-0x00000000029E4000-0x00000000029E6000-memory.dmp
memory/2324-128-0x0000000002BE0000-0x0000000002BE1000-memory.dmp
memory/2324-129-0x0000000005B90000-0x0000000005B91000-memory.dmp
memory/2324-130-0x00000000067B0000-0x00000000067B1000-memory.dmp
memory/2324-131-0x0000000006980000-0x0000000006981000-memory.dmp
memory/2324-132-0x0000000006FB0000-0x0000000006FB1000-memory.dmp
memory/2324-133-0x0000000007310000-0x0000000007311000-memory.dmp
memory/2324-134-0x00000000073E0000-0x00000000073E1000-memory.dmp
memory/2324-135-0x00000000075C0000-0x00000000075C1000-memory.dmp