Analysis
- max time kernel
120s - max time network
123s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
24/10/2021, 05:39
General
- Target Stumpers.exe
- Size 389KB
- Sample211024-gcagdsdbh6
- SHA256 a059841f9de1c6f01abf02a6f111f871185ff8cfcbfb8a841bb2401164960fe8
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\Stumpers.exe"C:\Users\Admin\AppData\Local\Temp\Stumpers.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Stumpers.exeC:\Users\Admin\AppData\Local\Temp\Stumpers.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/628-131-0x0000000006760000-0x0000000006761000-memory.dmp
memory/628-130-0x0000000005B50000-0x0000000005B51000-memory.dmp
memory/628-139-0x00000000095C0000-0x00000000095C1000-memory.dmp
memory/628-138-0x0000000008EC0000-0x0000000008EC1000-memory.dmp
memory/628-121-0x0000000000400000-0x0000000000420000-memory.dmp
memory/628-137-0x0000000008B60000-0x0000000008B61000-memory.dmp
memory/628-127-0x0000000006840000-0x0000000006841000-memory.dmp
memory/628-136-0x00000000086A0000-0x00000000086A1000-memory.dmp
memory/628-128-0x0000000005930000-0x0000000005931000-memory.dmp
memory/628-129-0x0000000005A10000-0x0000000005A11000-memory.dmp
memory/628-133-0x00000000067A0000-0x00000000067A1000-memory.dmp
memory/628-132-0x0000000005830000-0x0000000005D2E000-memory.dmp
memory/2696-115-0x00000000005F0000-0x00000000005F1000-memory.dmp
memory/2696-118-0x0000000002860000-0x0000000002861000-memory.dmp
memory/2696-117-0x0000000004EA0000-0x0000000004EA1000-memory.dmp
memory/2696-120-0x0000000005620000-0x0000000005621000-memory.dmp
memory/2696-119-0x0000000005110000-0x0000000005111000-memory.dmp