Analysis
- max time kernel
122s - max time network
184s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
22/10/2021, 18:45
General
- Target 7b43d2b53d921c0f5274a4d9fc478073.exe
- Size 452KB
- Sample211022-xd4pmacad4
- SHA256 f8eaf4927a573dd810d0d51d0af5b72dfe12045dd7e84535ff9b636ec8f6dfb1
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b43d2b53d921c0f5274a4d9fc478073.exe"C:\Users\Admin\AppData\Local\Temp\7b43d2b53d921c0f5274a4d9fc478073.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3448-116-0x00000000008A0000-0x000000000094E000-memory.dmp
memory/3448-117-0x0000000000400000-0x00000000008A0000-memory.dmp
memory/3448-118-0x0000000002C40000-0x0000000002C41000-memory.dmp
memory/3448-119-0x0000000002A30000-0x0000000002A5D000-memory.dmp
memory/3448-120-0x0000000004FA0000-0x0000000004FA1000-memory.dmp
memory/3448-122-0x0000000002C43000-0x0000000002C44000-memory.dmp
memory/3448-121-0x0000000002C42000-0x0000000002C43000-memory.dmp
memory/3448-123-0x0000000002BE0000-0x0000000002C0B000-memory.dmp
memory/3448-124-0x00000000054A0000-0x00000000054A1000-memory.dmp
memory/3448-125-0x0000000005B10000-0x0000000005B11000-memory.dmp
memory/3448-126-0x0000000005B40000-0x0000000005B41000-memory.dmp
memory/3448-127-0x0000000005C50000-0x0000000005C51000-memory.dmp
memory/3448-128-0x0000000002C44000-0x0000000002C46000-memory.dmp
memory/3448-129-0x0000000005CD0000-0x0000000005CD1000-memory.dmp
memory/3448-130-0x0000000005E60000-0x0000000005E61000-memory.dmp
memory/3448-131-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3448-132-0x00000000060A0000-0x00000000060A1000-memory.dmp
memory/3448-133-0x0000000006280000-0x0000000006281000-memory.dmp
memory/3448-134-0x0000000007730000-0x0000000007731000-memory.dmp
memory/3448-135-0x0000000007920000-0x0000000007921000-memory.dmp
memory/3448-136-0x0000000007F60000-0x0000000007F61000-memory.dmp