Analysis
-
max time kernel
119s -
max time network
139s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
20-10-2021 00:20
Static task
static1
General
-
Target
7f6fc95590f93055956de7488fae0c6255e16d68887320efdd288f0d9f35fe4e.exe
-
Size
382KB
-
MD5
3a0d99d41fa06a2ef03594466efc783c
-
SHA1
7f9cc1be082ba5f4b826c5df2229caf49f0c9d14
-
SHA256
7f6fc95590f93055956de7488fae0c6255e16d68887320efdd288f0d9f35fe4e
-
SHA512
d176c91fe3c1d9d1661fb60c91c2b2f9c6d34d0f2c53167cbbeea5404c66924684968bf57e3d80c5307f3a347958afea024fc8539678108f85659e8c212f96dc
Malware Config
Extracted
redline
UDP
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2136-119-0x0000000004C00000-0x0000000004C1F000-memory.dmp family_redline behavioral1/memory/2136-121-0x00000000072F0000-0x000000000730D000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7f6fc95590f93055956de7488fae0c6255e16d68887320efdd288f0d9f35fe4e.exedescription pid process Token: SeDebugPrivilege 2136 7f6fc95590f93055956de7488fae0c6255e16d68887320efdd288f0d9f35fe4e.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2136-117-0x0000000000400000-0x0000000002DB7000-memory.dmpFilesize
41.7MB
-
memory/2136-116-0x0000000002DC0000-0x0000000002E6E000-memory.dmpFilesize
696KB
-
memory/2136-118-0x00000000073F0000-0x00000000073F1000-memory.dmpFilesize
4KB
-
memory/2136-119-0x0000000004C00000-0x0000000004C1F000-memory.dmpFilesize
124KB
-
memory/2136-120-0x0000000007400000-0x0000000007401000-memory.dmpFilesize
4KB
-
memory/2136-121-0x00000000072F0000-0x000000000730D000-memory.dmpFilesize
116KB
-
memory/2136-122-0x0000000007900000-0x0000000007901000-memory.dmpFilesize
4KB
-
memory/2136-123-0x0000000007390000-0x0000000007391000-memory.dmpFilesize
4KB
-
memory/2136-124-0x00000000073F2000-0x00000000073F3000-memory.dmpFilesize
4KB
-
memory/2136-125-0x00000000073F3000-0x00000000073F4000-memory.dmpFilesize
4KB
-
memory/2136-126-0x0000000007F10000-0x0000000007F11000-memory.dmpFilesize
4KB
-
memory/2136-127-0x0000000008020000-0x0000000008021000-memory.dmpFilesize
4KB
-
memory/2136-128-0x00000000073F4000-0x00000000073F6000-memory.dmpFilesize
8KB
-
memory/2136-129-0x0000000008070000-0x0000000008071000-memory.dmpFilesize
4KB
-
memory/2136-130-0x0000000008C90000-0x0000000008C91000-memory.dmpFilesize
4KB
-
memory/2136-131-0x0000000009390000-0x0000000009391000-memory.dmpFilesize
4KB
-
memory/2136-132-0x0000000008F60000-0x0000000008F61000-memory.dmpFilesize
4KB
-
memory/2136-133-0x0000000009070000-0x0000000009071000-memory.dmpFilesize
4KB
-
memory/2136-134-0x0000000009230000-0x0000000009231000-memory.dmpFilesize
4KB
-
memory/2136-135-0x00000000092B0000-0x00000000092B1000-memory.dmpFilesize
4KB