Analysis

  • max time kernel
    120s
  • max time network
    129s
  • platform
    windows7_x64
  • resource
    win7-en-20210920
  • submitted
    02-11-2021 14:02

General

  • Target

    90fed56bb0612c4ee99c0c312856f36c.exe

  • Size

    252KB

  • MD5

    90fed56bb0612c4ee99c0c312856f36c

  • SHA1

    328f530b6541b53bc6b8da728a57993f5c97175a

  • SHA256

    d4e4269b47b81a4a2d0760e76499c97f47d2d40051b3dd3c0f2993b79836bb42

  • SHA512

    f7da1394b02c47d4e00f6f53f1019b938a3e8445c0efd397277ba524ea3c72fbba5b9ca47198249a026321da49972706a658914823e8583525178f681420112e

Malware Config

Extracted

Family

redline

Botnet

SomeBody

C2

185.215.113.29:36224

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\90fed56bb0612c4ee99c0c312856f36c.exe
    "C:\Users\Admin\AppData\Local\Temp\90fed56bb0612c4ee99c0c312856f36c.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    PID:764

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

1
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

1
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/764-55-0x0000000000260000-0x0000000000290000-memory.dmp
    Filesize

    192KB

  • memory/764-54-0x0000000000220000-0x0000000000242000-memory.dmp
    Filesize

    136KB

  • memory/764-57-0x0000000004781000-0x0000000004782000-memory.dmp
    Filesize

    4KB

  • memory/764-56-0x0000000000400000-0x000000000044A000-memory.dmp
    Filesize

    296KB

  • memory/764-58-0x00000000003E0000-0x00000000003FC000-memory.dmp
    Filesize

    112KB

  • memory/764-59-0x0000000000540000-0x000000000055B000-memory.dmp
    Filesize

    108KB