Analysis
- max time kernel
121s - max time network
133s - platform
windows10_x64 - resource
win10-en-20211014 - submitted
03/11/2021, 08:51
General
- Target 936fec4f4692c9198d5e16e5dfb8800e02235cf053a35.exe
- Size 284KB
- Sample211103-kr6d6addg2
- SHA256 936fec4f4692c9198d5e16e5dfb8800e02235cf053a3580fa4dfd5e6907cbae1
Malware Config
Extracted
-
redline
-
support
-
91.211.251.200:52562
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\936fec4f4692c9198d5e16e5dfb8800e02235cf053a35.exe"C:\Users\Admin\AppData\Local\Temp\936fec4f4692c9198d5e16e5dfb8800e02235cf053a35.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4216-115-0x0000000000460000-0x000000000050E000-memory.dmp
memory/4216-116-0x0000000002090000-0x00000000020C9000-memory.dmp
memory/4216-117-0x0000000000400000-0x0000000000452000-memory.dmp
memory/4216-118-0x00000000024D0000-0x00000000024FE000-memory.dmp
memory/4216-119-0x0000000004DB0000-0x0000000004DB1000-memory.dmp
memory/4216-120-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/4216-121-0x0000000004DB2000-0x0000000004DB3000-memory.dmp
memory/4216-122-0x0000000004DB3000-0x0000000004DB4000-memory.dmp
memory/4216-123-0x00000000025B0000-0x00000000025DC000-memory.dmp
memory/4216-124-0x00000000052C0000-0x00000000052C1000-memory.dmp
memory/4216-125-0x00000000027D0000-0x00000000027D1000-memory.dmp
memory/4216-126-0x0000000004C50000-0x0000000004C51000-memory.dmp
memory/4216-127-0x0000000004D60000-0x0000000004D61000-memory.dmp
memory/4216-128-0x0000000004DB4000-0x0000000004DB6000-memory.dmp
memory/4216-129-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/4216-130-0x0000000005B80000-0x0000000005B81000-memory.dmp
memory/4216-131-0x0000000006230000-0x0000000006231000-memory.dmp
memory/4216-132-0x0000000006310000-0x0000000006311000-memory.dmp
memory/4216-133-0x00000000063F0000-0x00000000063F1000-memory.dmp
memory/4216-134-0x0000000006590000-0x0000000006591000-memory.dmp
memory/4216-135-0x0000000006710000-0x0000000006711000-memory.dmp
memory/4216-136-0x00000000068F0000-0x00000000068F1000-memory.dmp