Analysis
-
max time kernel
69s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
19-10-2021 21:50
Static task
static1
General
-
Target
4be3fe324fb0d8d1f6107bdefbb7dc9dd7d60e2194bec8e0888a706513db8a3e.exe
-
Size
337KB
-
MD5
7514208fe6966bbee46a9200f889b281
-
SHA1
30af037b575140891b22dc2d1b7918dc10d9e2d3
-
SHA256
4be3fe324fb0d8d1f6107bdefbb7dc9dd7d60e2194bec8e0888a706513db8a3e
-
SHA512
8260b325ded7cc1c3eb14476f3c781ac9a5d2e427dedeebbcbeb7d25692e60a72d4c9ea7312800bd2fd329800bda2776cee20ea032a890014ffd99bef3b44d0a
Malware Config
Extracted
redline
PUB
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2632-118-0x0000000004F70000-0x0000000004F8F000-memory.dmp family_redline behavioral1/memory/2632-122-0x0000000005120000-0x000000000513D000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4be3fe324fb0d8d1f6107bdefbb7dc9dd7d60e2194bec8e0888a706513db8a3e.exedescription pid process Token: SeDebugPrivilege 2632 4be3fe324fb0d8d1f6107bdefbb7dc9dd7d60e2194bec8e0888a706513db8a3e.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2632-117-0x0000000000400000-0x0000000002F1C000-memory.dmpFilesize
43.1MB
-
memory/2632-116-0x0000000004C60000-0x0000000004C90000-memory.dmpFilesize
192KB
-
memory/2632-118-0x0000000004F70000-0x0000000004F8F000-memory.dmpFilesize
124KB
-
memory/2632-119-0x0000000007780000-0x0000000007781000-memory.dmpFilesize
4KB
-
memory/2632-120-0x0000000007782000-0x0000000007783000-memory.dmpFilesize
4KB
-
memory/2632-121-0x0000000007790000-0x0000000007791000-memory.dmpFilesize
4KB
-
memory/2632-122-0x0000000005120000-0x000000000513D000-memory.dmpFilesize
116KB
-
memory/2632-123-0x0000000007C90000-0x0000000007C91000-memory.dmpFilesize
4KB
-
memory/2632-124-0x0000000007783000-0x0000000007784000-memory.dmpFilesize
4KB
-
memory/2632-125-0x0000000007630000-0x0000000007631000-memory.dmpFilesize
4KB
-
memory/2632-126-0x0000000007660000-0x0000000007661000-memory.dmpFilesize
4KB
-
memory/2632-127-0x0000000007784000-0x0000000007786000-memory.dmpFilesize
8KB
-
memory/2632-128-0x00000000082A0000-0x00000000082A1000-memory.dmpFilesize
4KB
-
memory/2632-129-0x0000000008310000-0x0000000008311000-memory.dmpFilesize
4KB
-
memory/2632-130-0x0000000008F30000-0x0000000008F31000-memory.dmpFilesize
4KB
-
memory/2632-131-0x0000000009100000-0x0000000009101000-memory.dmpFilesize
4KB
-
memory/2632-132-0x0000000009730000-0x0000000009731000-memory.dmpFilesize
4KB
-
memory/2632-133-0x0000000009840000-0x0000000009841000-memory.dmpFilesize
4KB
-
memory/2632-134-0x0000000009A00000-0x0000000009A01000-memory.dmpFilesize
4KB
-
memory/2632-135-0x0000000009AA0000-0x0000000009AA1000-memory.dmpFilesize
4KB