Analysis
-
max time kernel
107s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
24-10-2021 06:26
Static task
static1
Behavioral task
behavioral1
Sample
6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
Resource
win7-en-20211014
Behavioral task
behavioral2
Sample
6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
Resource
win10-en-20211014
General
-
Target
6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
-
Size
927KB
-
MD5
950c6b87e1bb3df00a70c46575e55c24
-
SHA1
794737f9d40f2239eff492525b603efed0de0177
-
SHA256
6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a7296f0f250d20d00cbc69
-
SHA512
aba4addbc9b0211afd1f8fd439546a288e8f017419b8998033603a83731a5a56b1ffea726733d614ae59aa03f26ca8380de2c503a39563d2afe47aa0fe999e75
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/4372-115-0x0000000000740000-0x000000000076E000-memory.dmp family_redline behavioral2/memory/4372-119-0x00000000008B0000-0x00000000008C9000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exepid process 4372 6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exedescription pid process Token: SeDebugPrivilege 4372 6c9c308ce5c725fa5bf276517e4b246a46ad6a1e61a72.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4372-115-0x0000000000740000-0x000000000076E000-memory.dmpFilesize
184KB
-
memory/4372-119-0x00000000008B0000-0x00000000008C9000-memory.dmpFilesize
100KB
-
memory/4372-121-0x0000000005390000-0x0000000005391000-memory.dmpFilesize
4KB
-
memory/4372-122-0x0000000005392000-0x0000000005393000-memory.dmpFilesize
4KB
-
memory/4372-123-0x00000000053A0000-0x00000000053A1000-memory.dmpFilesize
4KB
-
memory/4372-124-0x00000000052D0000-0x00000000052D1000-memory.dmpFilesize
4KB
-
memory/4372-125-0x00000000059B0000-0x00000000059B1000-memory.dmpFilesize
4KB
-
memory/4372-126-0x0000000005393000-0x0000000005394000-memory.dmpFilesize
4KB
-
memory/4372-127-0x0000000005300000-0x0000000005301000-memory.dmpFilesize
4KB
-
memory/4372-128-0x0000000005394000-0x0000000005395000-memory.dmpFilesize
4KB
-
memory/4372-129-0x0000000005AC0000-0x0000000005AC1000-memory.dmpFilesize
4KB
-
memory/4372-130-0x0000000005C50000-0x0000000005C51000-memory.dmpFilesize
4KB
-
memory/4372-131-0x0000000006150000-0x0000000006151000-memory.dmpFilesize
4KB
-
memory/4372-132-0x0000000006240000-0x0000000006241000-memory.dmpFilesize
4KB
-
memory/4372-133-0x0000000006370000-0x0000000006371000-memory.dmpFilesize
4KB
-
memory/4372-134-0x0000000006930000-0x0000000006931000-memory.dmpFilesize
4KB
-
memory/4372-135-0x00000000072D0000-0x00000000072D1000-memory.dmpFilesize
4KB
-
memory/4372-136-0x0000000007340000-0x0000000007341000-memory.dmpFilesize
4KB
-
memory/4372-137-0x0000000007510000-0x0000000007511000-memory.dmpFilesize
4KB