Analysis
-
max time kernel
121s -
max time network
144s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
28-10-2021 16:15
General
-
Target
cheatMINE.exe
-
Size
907KB
-
MD5
2133a0f1fc59fcaf01aeafbeb99a0dce
-
SHA1
356314122398c64d96915c40e6ca357538d8f4a2
-
SHA256
e273b33d875d2227fd607c82cc4313509eebf56e8d9101d3a3e64ca6ddd3028c
-
SHA512
baefab75ebc9650ca8b441ba1e0cf136f34242f6acf2e97924b2f42cc9daea83b8d54c7dc32c8bdbc21ea65ce9d17100bd77421fb41846f816155b3b700fd956
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
5IRJ6JMY
C2
188.34.176.164:80
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\cheatMINE.exe"C:\Users\Admin\AppData\Local\Temp\cheatMINE.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-54-0x0000000000360000-0x000000000038E000-memory.dmpFilesize
184KB
-
memory/320-60-0x0000000000780000-0x0000000000799000-memory.dmpFilesize
100KB
-
memory/320-63-0x0000000004E32000-0x0000000004E33000-memory.dmpFilesize
4KB
-
memory/320-62-0x0000000004E31000-0x0000000004E32000-memory.dmpFilesize
4KB
-
memory/320-64-0x0000000004E34000-0x0000000004E35000-memory.dmpFilesize
4KB