Analysis

  • max time kernel
    65s
  • max time network
    136s
  • platform
    windows10_x64
  • resource
    win10-en-20210920
  • submitted
    21-10-2021 02:20

General

  • Target

    a07977248d886600fe0cc9a08e3fdeae8a39c377826ef8e42002664ad8dc13e0.exe

  • Size

    336KB

  • MD5

    5761f9dfe70dd660641c0f0346674f8b

  • SHA1

    e8aacd84a9fa7a660ebbf87bba9cb0552d8e3466

  • SHA256

    a07977248d886600fe0cc9a08e3fdeae8a39c377826ef8e42002664ad8dc13e0

  • SHA512

    1d98239ede1ccbb127c1d2aa032b930a1769932b4e8e7b6b43b6cf14cdd80bb0a0fff722875cbea627ff472efcbc08c81b8062c4a12040d46538f73cd0c8a417

Malware Config

Extracted

Family

redline

Botnet

UTS

C2

45.9.20.182:52236

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a07977248d886600fe0cc9a08e3fdeae8a39c377826ef8e42002664ad8dc13e0.exe
    "C:\Users\Admin\AppData\Local\Temp\a07977248d886600fe0cc9a08e3fdeae8a39c377826ef8e42002664ad8dc13e0.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:2180

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2180-116-0x0000000004B30000-0x0000000004B60000-memory.dmp
    Filesize

    192KB

  • memory/2180-115-0x0000000004B00000-0x0000000004B22000-memory.dmp
    Filesize

    136KB

  • memory/2180-117-0x0000000000400000-0x0000000002F1B000-memory.dmp
    Filesize

    43.1MB

  • memory/2180-118-0x0000000004C50000-0x0000000004C6F000-memory.dmp
    Filesize

    124KB

  • memory/2180-119-0x0000000007690000-0x0000000007691000-memory.dmp
    Filesize

    4KB

  • memory/2180-120-0x0000000004E90000-0x0000000004EAD000-memory.dmp
    Filesize

    116KB

  • memory/2180-121-0x0000000007B90000-0x0000000007B91000-memory.dmp
    Filesize

    4KB

  • memory/2180-122-0x0000000007520000-0x0000000007521000-memory.dmp
    Filesize

    4KB

  • memory/2180-123-0x0000000007680000-0x0000000007681000-memory.dmp
    Filesize

    4KB

  • memory/2180-124-0x0000000007682000-0x0000000007683000-memory.dmp
    Filesize

    4KB

  • memory/2180-125-0x0000000007550000-0x0000000007551000-memory.dmp
    Filesize

    4KB

  • memory/2180-126-0x0000000007683000-0x0000000007684000-memory.dmp
    Filesize

    4KB

  • memory/2180-127-0x00000000081A0000-0x00000000081A1000-memory.dmp
    Filesize

    4KB

  • memory/2180-128-0x0000000007684000-0x0000000007686000-memory.dmp
    Filesize

    8KB

  • memory/2180-129-0x0000000008200000-0x0000000008201000-memory.dmp
    Filesize

    4KB

  • memory/2180-131-0x00000000094B0000-0x00000000094B1000-memory.dmp
    Filesize

    4KB

  • memory/2180-130-0x00000000092E0000-0x00000000092E1000-memory.dmp
    Filesize

    4KB

  • memory/2180-132-0x00000000099E0000-0x00000000099E1000-memory.dmp
    Filesize

    4KB

  • memory/2180-133-0x0000000009D00000-0x0000000009D01000-memory.dmp
    Filesize

    4KB

  • memory/2180-134-0x0000000009DD0000-0x0000000009DD1000-memory.dmp
    Filesize

    4KB

  • memory/2180-135-0x0000000009EB0000-0x0000000009EB1000-memory.dmp
    Filesize

    4KB