Analysis
-
max time kernel
107s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 23:30
General
-
Target
60d5d621021211e78d6970ec792b181f83e5cb2291b88d0a0e63e17215287c83.exe
-
Size
705KB
-
MD5
0f8ab084532b57e7dba94d75c688250e
-
SHA1
74081221c6374dff6363b120bd5a5bc29c6e9f05
-
SHA256
60d5d621021211e78d6970ec792b181f83e5cb2291b88d0a0e63e17215287c83
-
SHA512
2169b48dd21a9e0188c7f1c3d4152bbd6bf7f4b7c4aab26945a622770151e4286c09f2b66028afb86367a5e0743555fd7b80fb6d6502faefaa266621b12c832c
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Downloads MZ/PE file
-
Executes dropped EXE 1 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\60d5d621021211e78d6970ec792b181f83e5cb2291b88d0a0e63e17215287c83.exe"C:\Users\Admin\AppData\Local\Temp\60d5d621021211e78d6970ec792b181f83e5cb2291b88d0a0e63e17215287c83.exe"1⤵
- Checks processor information in registry
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\wowsfree\ipstersh.exeipstersh.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
a67648a5bb88c3bfb10e76a764efef44
SHA127b7ccf7e4559fcbb3a0e83b600f54f1b602bf7d
SHA256fcbae6e5add0cd76ec5a91761d8f17396dcac7a5ca41f6d9dd7401b4c0b2ce94
SHA512418ca5c8e5f43b94dcd702be7742488f053db1e0d6ee6e34ada4337cedf1832e7a8a4449724f2348abecd8eeee7d6bd5b81378781cf8dfafe6beb4f74a18ddfe
-
MD5
a67648a5bb88c3bfb10e76a764efef44
SHA127b7ccf7e4559fcbb3a0e83b600f54f1b602bf7d
SHA256fcbae6e5add0cd76ec5a91761d8f17396dcac7a5ca41f6d9dd7401b4c0b2ce94
SHA512418ca5c8e5f43b94dcd702be7742488f053db1e0d6ee6e34ada4337cedf1832e7a8a4449724f2348abecd8eeee7d6bd5b81378781cf8dfafe6beb4f74a18ddfe
-
Filesize
828KB
-
Filesize
12.5MB
-
Filesize
432KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
192KB
-
Filesize
12.2MB
-
Filesize
112KB
-
Filesize
4KB
-
Filesize
4KB
-
-
Filesize
4KB
-
Filesize
108KB
-
Filesize
4KB
-
Filesize
140KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
8KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB