Analysis
-
max time kernel
118s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
04-11-2021 13:00
Static task
static1
General
-
Target
006e87d32bc99015247e89cf74e5ae51f9d3b4ba34d0f59a058683a62852eb47.exe
-
Size
242KB
-
MD5
7c03165e67d851b1e62f74e07f95cf72
-
SHA1
4eddd832579f4476e37fba9351b547ef223ce123
-
SHA256
006e87d32bc99015247e89cf74e5ae51f9d3b4ba34d0f59a058683a62852eb47
-
SHA512
4bccdfbf2ef76ccf322f0ae12b515922b2afdffd64431a13b4e4ec2a508332e298be4fddb9441f84fa5ed06cfb4abea98c33a10cd78b820b3c44b597c6a937a7
Malware Config
Extracted
redline
SomeBody
185.215.113.29:36224
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/860-118-0x00000000025E0000-0x00000000025FC000-memory.dmp family_redline behavioral1/memory/860-122-0x0000000002790000-0x00000000027AB000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
006e87d32bc99015247e89cf74e5ae51f9d3b4ba34d0f59a058683a62852eb47.exedescription pid process Token: SeDebugPrivilege 860 006e87d32bc99015247e89cf74e5ae51f9d3b4ba34d0f59a058683a62852eb47.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/860-115-0x0000000002190000-0x00000000021B2000-memory.dmpFilesize
136KB
-
memory/860-116-0x00000000021E0000-0x0000000002210000-memory.dmpFilesize
192KB
-
memory/860-117-0x0000000000400000-0x0000000000449000-memory.dmpFilesize
292KB
-
memory/860-118-0x00000000025E0000-0x00000000025FC000-memory.dmpFilesize
112KB
-
memory/860-119-0x0000000002830000-0x0000000002831000-memory.dmpFilesize
4KB
-
memory/860-120-0x0000000002832000-0x0000000002833000-memory.dmpFilesize
4KB
-
memory/860-121-0x0000000004B90000-0x0000000004B91000-memory.dmpFilesize
4KB
-
memory/860-122-0x0000000002790000-0x00000000027AB000-memory.dmpFilesize
108KB
-
memory/860-123-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/860-124-0x00000000050A0000-0x00000000050A1000-memory.dmpFilesize
4KB
-
memory/860-125-0x00000000050D0000-0x00000000050D1000-memory.dmpFilesize
4KB
-
memory/860-126-0x0000000002833000-0x0000000002834000-memory.dmpFilesize
4KB
-
memory/860-127-0x00000000051E0000-0x00000000051E1000-memory.dmpFilesize
4KB
-
memory/860-128-0x0000000002834000-0x0000000002836000-memory.dmpFilesize
8KB
-
memory/860-129-0x0000000005260000-0x0000000005261000-memory.dmpFilesize
4KB
-
memory/860-130-0x00000000053F0000-0x00000000053F1000-memory.dmpFilesize
4KB
-
memory/860-131-0x0000000005570000-0x0000000005571000-memory.dmpFilesize
4KB
-
memory/860-132-0x0000000005620000-0x0000000005621000-memory.dmpFilesize
4KB
-
memory/860-133-0x0000000005E00000-0x0000000005E01000-memory.dmpFilesize
4KB
-
memory/860-134-0x0000000006560000-0x0000000006561000-memory.dmpFilesize
4KB
-
memory/860-135-0x0000000006730000-0x0000000006731000-memory.dmpFilesize
4KB