Analysis
- max time kernel
84s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
18/11/2021, 02:05
General
- Target 1979650898.exe
- Size 996KB
- Sample211118-cjb7caeed2
- SHA256 023e7c9e73b997a33476a2d958fb237395b098872854ce2e92af2b89cd87ca7d
Malware Config
Extracted
-
redline
-
first build
-
79.110.52.59:1801
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1979650898.exe"C:\Users\Admin\AppData\Local\Temp\1979650898.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1979650898.exeC:\Users\Admin\AppData\Local\Temp\1979650898.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2580-121-0x0000000002A70000-0x0000000002A71000-memory.dmp
memory/2580-120-0x0000000004FF0000-0x0000000004FF1000-memory.dmp
memory/2580-122-0x0000000005000000-0x0000000005001000-memory.dmp
memory/2580-123-0x0000000005880000-0x0000000005881000-memory.dmp
memory/2580-124-0x0000000005510000-0x0000000005511000-memory.dmp
memory/2580-125-0x0000000005DB0000-0x0000000005DB1000-memory.dmp
memory/2580-118-0x0000000000670000-0x0000000000671000-memory.dmp
memory/4024-131-0x0000000005590000-0x0000000005591000-memory.dmp
memory/4024-136-0x0000000004F80000-0x0000000005586000-memory.dmp
memory/4024-126-0x0000000000400000-0x0000000000420000-memory.dmp
memory/4024-132-0x0000000005030000-0x0000000005031000-memory.dmp
memory/4024-133-0x0000000005160000-0x0000000005161000-memory.dmp
memory/4024-134-0x00000000050C0000-0x00000000050C1000-memory.dmp
memory/4024-135-0x0000000005100000-0x0000000005101000-memory.dmp
memory/4024-137-0x00000000053F0000-0x00000000053F1000-memory.dmp
memory/4024-139-0x0000000006140000-0x0000000006141000-memory.dmp
memory/4024-140-0x0000000005510000-0x0000000005511000-memory.dmp
memory/4024-141-0x0000000005FF0000-0x0000000005FF1000-memory.dmp
memory/4024-142-0x0000000006940000-0x0000000006941000-memory.dmp
memory/4024-143-0x0000000006B60000-0x0000000006B61000-memory.dmp