Analysis
-
max time kernel
72s -
max time network
123s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
23-10-2021 08:55
General
-
Target
609c932add32b9bb41a62c72785ac4fcef3866eb931c4c60130ceada0213cdb8.exe
-
Size
405KB
-
MD5
14c6f9030d5efd442c41f05f8e986eb0
-
SHA1
c4f934cb9f474029df215de029ae7653525c7ecc
-
SHA256
609c932add32b9bb41a62c72785ac4fcef3866eb931c4c60130ceada0213cdb8
-
SHA512
ba0c49552686e012a1cc153bf03173eecb448b2fea55fa7e3cc484bba99032dc4f20bf366043c973829a153c9fcad4266b26538b8da2f3eea2aa145b3260a840
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
BTC-2021
C2
2.56.214.190:59628
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\609c932add32b9bb41a62c72785ac4fcef3866eb931c4c60130ceada0213cdb8.exe"C:\Users\Admin\AppData\Local\Temp\609c932add32b9bb41a62c72785ac4fcef3866eb931c4c60130ceada0213cdb8.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3136-116-0x0000000000910000-0x00000000009BE000-memory.dmpFilesize
696KB
-
memory/3136-117-0x0000000000400000-0x0000000000895000-memory.dmpFilesize
4.6MB
-
memory/3136-118-0x0000000002990000-0x00000000029AB000-memory.dmpFilesize
108KB
-
memory/3136-119-0x0000000005070000-0x0000000005071000-memory.dmpFilesize
4KB
-
memory/3136-120-0x0000000005080000-0x0000000005081000-memory.dmpFilesize
4KB
-
memory/3136-121-0x0000000004F00000-0x0000000004F1A000-memory.dmpFilesize
104KB
-
memory/3136-122-0x0000000005580000-0x0000000005581000-memory.dmpFilesize
4KB
-
memory/3136-123-0x0000000004FB0000-0x0000000004FB1000-memory.dmpFilesize
4KB
-
memory/3136-124-0x0000000005B90000-0x0000000005B91000-memory.dmpFilesize
4KB
-
memory/3136-125-0x0000000005072000-0x0000000005073000-memory.dmpFilesize
4KB
-
memory/3136-126-0x0000000005073000-0x0000000005074000-memory.dmpFilesize
4KB
-
memory/3136-127-0x0000000004FE0000-0x0000000004FE1000-memory.dmpFilesize
4KB
-
memory/3136-128-0x0000000005074000-0x0000000005076000-memory.dmpFilesize
8KB
-
memory/3136-129-0x0000000005CA0000-0x0000000005CA1000-memory.dmpFilesize
4KB
-
memory/3136-130-0x0000000005E20000-0x0000000005E21000-memory.dmpFilesize
4KB
-
memory/3136-131-0x0000000006610000-0x0000000006611000-memory.dmpFilesize
4KB
-
memory/3136-132-0x0000000006710000-0x0000000006711000-memory.dmpFilesize
4KB
-
memory/3136-133-0x00000000066D0000-0x00000000066D1000-memory.dmpFilesize
4KB
-
memory/3136-134-0x0000000006970000-0x0000000006971000-memory.dmpFilesize
4KB
-
memory/3136-135-0x0000000006B40000-0x0000000006B41000-memory.dmpFilesize
4KB