Analysis
-
max time kernel
123s -
max time network
122s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
19-10-2021 23:15
Static task
static1
Behavioral task
behavioral1
Sample
b45cf051beecc52e8b6ed4b09174d8cc.exe
Resource
win7-en-20211014
General
-
Target
b45cf051beecc52e8b6ed4b09174d8cc.exe
-
Size
391KB
-
MD5
b45cf051beecc52e8b6ed4b09174d8cc
-
SHA1
a855502e285c68192833e700dd9131b07a18e36e
-
SHA256
0526a434f116716b293f93183466497902e6188e4b83a9cab14c3aad2b4c7aa8
-
SHA512
eae9e2201763f27601f756d76b5cc116bb31e5dddf389d2164b6066930830ec83ca8745b61c62178ded1bc8cf3225ff9e1d02e42cb18a2ef7554bbd8132489b7
Malware Config
Extracted
redline
paladin
188.68.201.6:10085
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1604-58-0x0000000004990000-0x00000000049BF000-memory.dmp family_redline behavioral1/memory/1604-62-0x0000000004A50000-0x0000000004A7E000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b45cf051beecc52e8b6ed4b09174d8cc.exepid process 1604 b45cf051beecc52e8b6ed4b09174d8cc.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b45cf051beecc52e8b6ed4b09174d8cc.exedescription pid process Token: SeDebugPrivilege 1604 b45cf051beecc52e8b6ed4b09174d8cc.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1604-55-0x0000000002FDD000-0x0000000003007000-memory.dmpFilesize
168KB
-
memory/1604-56-0x00000000002C0000-0x0000000000304000-memory.dmpFilesize
272KB
-
memory/1604-57-0x0000000000400000-0x0000000002F29000-memory.dmpFilesize
43.2MB
-
memory/1604-58-0x0000000004990000-0x00000000049BF000-memory.dmpFilesize
188KB
-
memory/1604-59-0x0000000007371000-0x0000000007372000-memory.dmpFilesize
4KB
-
memory/1604-60-0x0000000007372000-0x0000000007373000-memory.dmpFilesize
4KB
-
memory/1604-61-0x0000000007373000-0x0000000007374000-memory.dmpFilesize
4KB
-
memory/1604-62-0x0000000004A50000-0x0000000004A7E000-memory.dmpFilesize
184KB
-
memory/1604-63-0x0000000007374000-0x0000000007376000-memory.dmpFilesize
8KB