Analysis
-
max time kernel
121s -
max time network
156s -
platform
windows7_x64 -
resource
win7-en-20210920 -
submitted
04-11-2021 12:36
Static task
static1
Behavioral task
behavioral1
Sample
738f696f228f13c18454c013926b38b2.exe
Resource
win7-en-20210920
General
-
Target
738f696f228f13c18454c013926b38b2.exe
-
Size
444KB
-
MD5
738f696f228f13c18454c013926b38b2
-
SHA1
04c1ea711ed7077cee2b67c33577caadc24b97e8
-
SHA256
0fc853cdddb7195dbf6052a7970add6d5cb57f6b7f2478f6e3de20ff87fc890f
-
SHA512
dc4f05debf4e41b52412b6681efd3ad2622cd9d2f401df317bfbb525797e3fb6000536e78d9dbff67f7149ee5b2db94ba723cff7315816c92095e551974a0038
Malware Config
Extracted
redline
LOVE
91.242.229.222:21475
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/852-57-0x00000000025D0000-0x000000000260E000-memory.dmp family_redline behavioral1/memory/852-58-0x0000000004BC0000-0x0000000004BFD000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
738f696f228f13c18454c013926b38b2.exepid process 852 738f696f228f13c18454c013926b38b2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
738f696f228f13c18454c013926b38b2.exedescription pid process Token: SeDebugPrivilege 852 738f696f228f13c18454c013926b38b2.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/852-54-0x000000000024D000-0x0000000000285000-memory.dmpFilesize
224KB
-
memory/852-55-0x00000000003A0000-0x00000000003EF000-memory.dmpFilesize
316KB
-
memory/852-56-0x0000000000400000-0x0000000000913000-memory.dmpFilesize
5.1MB
-
memory/852-57-0x00000000025D0000-0x000000000260E000-memory.dmpFilesize
248KB
-
memory/852-58-0x0000000004BC0000-0x0000000004BFD000-memory.dmpFilesize
244KB
-
memory/852-60-0x0000000004CA2000-0x0000000004CA3000-memory.dmpFilesize
4KB
-
memory/852-59-0x0000000004CA1000-0x0000000004CA2000-memory.dmpFilesize
4KB
-
memory/852-62-0x0000000004CA4000-0x0000000004CA6000-memory.dmpFilesize
8KB
-
memory/852-61-0x0000000004CA3000-0x0000000004CA4000-memory.dmpFilesize
4KB