Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
21-10-2021 14:17
Static task
static1
Behavioral task
behavioral1
Sample
usfive_20211021-124624.exe
Resource
win7-en-20211014
General
-
Target
usfive_20211021-124624.exe
-
Size
333KB
-
MD5
d925816145cc18afdd4675c4846bc9a7
-
SHA1
9eb8dff855f515f3253eb2987679c462c9cab3e7
-
SHA256
6ccde99f9a922f30985bf697ef122d1bb102993590064544c6d0cda4f53cbdcc
-
SHA512
5caec99f2a47c64193707f5f3ccb74408eea98fd395d1fba4881f7ca39149ec3aa233ef4d85396e6e3be037bc293a138ea4e1d97528c72466e8d8c5a663f5326
Malware Config
Extracted
redline
oct21
94.103.9.181:25690
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/952-58-0x0000000002FD0000-0x0000000002FEB000-memory.dmp family_redline behavioral1/memory/952-61-0x0000000004A40000-0x0000000004A5A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
usfive_20211021-124624.exepid process 952 usfive_20211021-124624.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
usfive_20211021-124624.exedescription pid process Token: SeDebugPrivilege 952 usfive_20211021-124624.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-55-0x00000000001B0000-0x00000000001D1000-memory.dmpFilesize
132KB
-
memory/952-56-0x0000000000270000-0x000000000029F000-memory.dmpFilesize
188KB
-
memory/952-57-0x0000000000400000-0x0000000002F1A000-memory.dmpFilesize
43.1MB
-
memory/952-58-0x0000000002FD0000-0x0000000002FEB000-memory.dmpFilesize
108KB
-
memory/952-60-0x00000000073A2000-0x00000000073A3000-memory.dmpFilesize
4KB
-
memory/952-59-0x00000000073A1000-0x00000000073A2000-memory.dmpFilesize
4KB
-
memory/952-62-0x00000000073A3000-0x00000000073A4000-memory.dmpFilesize
4KB
-
memory/952-61-0x0000000004A40000-0x0000000004A5A000-memory.dmpFilesize
104KB
-
memory/952-63-0x00000000073A4000-0x00000000073A6000-memory.dmpFilesize
8KB