Analysis
-
max time kernel
77s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
20-10-2021 20:30
Static task
static1
General
-
Target
60d22d010b6ab552b1cb09fe3bc44283005616c0151da341df05fbabd9b07156.exe
-
Size
415KB
-
MD5
e8c25b82ba22193f590b2a88ff972f37
-
SHA1
e05c454b4f8adf375ee7e1ae41e09faa5a5c87e6
-
SHA256
60d22d010b6ab552b1cb09fe3bc44283005616c0151da341df05fbabd9b07156
-
SHA512
63c6b0905983ca1255bd968e66831b9a78bc3b022ae693b74773fff79290d4a2ca0bcd35ed6ffe4fc2ffbe50effcabe19a6447f4757d10a4d7e96f474b430c17
Malware Config
Extracted
redline
PUB
45.9.20.182:52236
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1968-118-0x0000000004CB0000-0x0000000004CCF000-memory.dmp family_redline behavioral1/memory/1968-122-0x0000000004D70000-0x0000000004D8D000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
60d22d010b6ab552b1cb09fe3bc44283005616c0151da341df05fbabd9b07156.exedescription pid process Token: SeDebugPrivilege 1968 60d22d010b6ab552b1cb09fe3bc44283005616c0151da341df05fbabd9b07156.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1968-115-0x0000000003021000-0x0000000003044000-memory.dmpFilesize
140KB
-
memory/1968-116-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/1968-117-0x0000000000400000-0x0000000002DBE000-memory.dmpFilesize
41.7MB
-
memory/1968-118-0x0000000004CB0000-0x0000000004CCF000-memory.dmpFilesize
124KB
-
memory/1968-119-0x00000000074E0000-0x00000000074E1000-memory.dmpFilesize
4KB
-
memory/1968-120-0x00000000074E2000-0x00000000074E3000-memory.dmpFilesize
4KB
-
memory/1968-121-0x00000000074F0000-0x00000000074F1000-memory.dmpFilesize
4KB
-
memory/1968-122-0x0000000004D70000-0x0000000004D8D000-memory.dmpFilesize
116KB
-
memory/1968-123-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/1968-124-0x0000000004F40000-0x0000000004F41000-memory.dmpFilesize
4KB
-
memory/1968-125-0x00000000074E3000-0x00000000074E4000-memory.dmpFilesize
4KB
-
memory/1968-126-0x0000000008000000-0x0000000008001000-memory.dmpFilesize
4KB
-
memory/1968-127-0x0000000007410000-0x0000000007411000-memory.dmpFilesize
4KB
-
memory/1968-128-0x00000000074E4000-0x00000000074E6000-memory.dmpFilesize
8KB
-
memory/1968-129-0x0000000007450000-0x0000000007451000-memory.dmpFilesize
4KB
-
memory/1968-130-0x0000000008C90000-0x0000000008C91000-memory.dmpFilesize
4KB
-
memory/1968-131-0x0000000008E60000-0x0000000008E61000-memory.dmpFilesize
4KB
-
memory/1968-132-0x00000000094A0000-0x00000000094A1000-memory.dmpFilesize
4KB
-
memory/1968-133-0x00000000097F0000-0x00000000097F1000-memory.dmpFilesize
4KB
-
memory/1968-134-0x0000000009900000-0x0000000009901000-memory.dmpFilesize
4KB
-
memory/1968-135-0x00000000099A0000-0x00000000099A1000-memory.dmpFilesize
4KB