Analysis
-
max time kernel
121s -
max time network
149s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
23-10-2021 06:28
Static task
static1
Behavioral task
behavioral1
Sample
cec8520f145a0dddbf1adbe4262e8b83.exe
Resource
win7-en-20210920
Behavioral task
behavioral2
Sample
cec8520f145a0dddbf1adbe4262e8b83.exe
Resource
win10-en-20210920
General
-
Target
cec8520f145a0dddbf1adbe4262e8b83.exe
-
Size
441KB
-
MD5
cec8520f145a0dddbf1adbe4262e8b83
-
SHA1
c88557afeb6db504b5e94838411d289714e8c193
-
SHA256
75c1729f921ec241025388f991a462400494b804483f0392f0222fe3ed04ceb9
-
SHA512
e5a8fa627bd944dadcee18d6b10cbc55df546083b167b11ffd5fe4d74fdf9fe67d3c630978dafb7fc2389db1ea9af0333f2ce97a886fb79d8747699985791867
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2156-120-0x0000000004EA0000-0x0000000004ECD000-memory.dmp family_redline behavioral2/memory/2156-122-0x0000000004F30000-0x0000000004F5B000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
cec8520f145a0dddbf1adbe4262e8b83.exepid process 2156 cec8520f145a0dddbf1adbe4262e8b83.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cec8520f145a0dddbf1adbe4262e8b83.exedescription pid process Token: SeDebugPrivilege 2156 cec8520f145a0dddbf1adbe4262e8b83.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2156-118-0x0000000000B36000-0x0000000000B62000-memory.dmpFilesize
176KB
-
memory/2156-119-0x0000000000D20000-0x0000000000D64000-memory.dmpFilesize
272KB
-
memory/2156-120-0x0000000004EA0000-0x0000000004ECD000-memory.dmpFilesize
180KB
-
memory/2156-121-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/2156-122-0x0000000004F30000-0x0000000004F5B000-memory.dmpFilesize
172KB
-
memory/2156-123-0x00000000055A0000-0x00000000055A1000-memory.dmpFilesize
4KB
-
memory/2156-124-0x0000000004FF0000-0x0000000004FF1000-memory.dmpFilesize
4KB
-
memory/2156-125-0x0000000000400000-0x000000000089D000-memory.dmpFilesize
4.6MB
-
memory/2156-126-0x0000000005090000-0x0000000005091000-memory.dmpFilesize
4KB
-
memory/2156-128-0x0000000005092000-0x0000000005093000-memory.dmpFilesize
4KB
-
memory/2156-127-0x0000000005BB0000-0x0000000005BB1000-memory.dmpFilesize
4KB
-
memory/2156-129-0x0000000005093000-0x0000000005094000-memory.dmpFilesize
4KB
-
memory/2156-130-0x0000000005020000-0x0000000005021000-memory.dmpFilesize
4KB
-
memory/2156-131-0x0000000005CD0000-0x0000000005CD1000-memory.dmpFilesize
4KB
-
memory/2156-132-0x0000000005094000-0x0000000005096000-memory.dmpFilesize
8KB
-
memory/2156-133-0x0000000005F60000-0x0000000005F61000-memory.dmpFilesize
4KB
-
memory/2156-134-0x0000000006670000-0x0000000006671000-memory.dmpFilesize
4KB
-
memory/2156-135-0x00000000066F0000-0x00000000066F1000-memory.dmpFilesize
4KB
-
memory/2156-136-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB
-
memory/2156-137-0x0000000006BE0000-0x0000000006BE1000-memory.dmpFilesize
4KB
-
memory/2156-138-0x0000000007800000-0x0000000007801000-memory.dmpFilesize
4KB
-
memory/2156-139-0x00000000079E0000-0x00000000079E1000-memory.dmpFilesize
4KB