Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-11-2021 23:06
Static task
static1
General
-
Target
c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exe
-
Size
692KB
-
MD5
ec8458f0550a2989e1dbbd7f068984f3
-
SHA1
4880b92f184ab7ab2a1697e69bd00c173108a0b8
-
SHA256
c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722
-
SHA512
03e6acd4a725c764ac1e4d637ceb8e3f67c6c33ca71d25ed4c8050c5bed8e16d78021e6812d4f4f3565f66fa88f1b157ca0c462b5aaced15a84712099bf8b512
Malware Config
Extracted
redline
test1
65.108.4.86:21391
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3208-116-0x0000000003600000-0x000000000362F000-memory.dmp family_redline behavioral1/memory/3208-155-0x0000000003740000-0x0000000003759000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exepid process 3208 c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exedescription pid process Token: SeDebugPrivilege 3208 c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exe"C:\Users\Admin\AppData\Local\Temp\c803a9d0546cf02bfcdb3cecd14c168f0a483df8f6dc3d52e2769f81f104c722.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3208-115-0x00000000007A0000-0x00000000007FF000-memory.dmpFilesize
380KB
-
memory/3208-116-0x0000000003600000-0x000000000362F000-memory.dmpFilesize
188KB
-
memory/3208-123-0x0000000002860000-0x0000000002861000-memory.dmpFilesize
4KB
-
memory/3208-122-0x00000000028A0000-0x00000000028A1000-memory.dmpFilesize
4KB
-
memory/3208-124-0x0000000002850000-0x0000000002851000-memory.dmpFilesize
4KB
-
memory/3208-126-0x0000000002880000-0x0000000002881000-memory.dmpFilesize
4KB
-
memory/3208-125-0x0000000002870000-0x0000000002871000-memory.dmpFilesize
4KB
-
memory/3208-128-0x00000000028C0000-0x00000000028C1000-memory.dmpFilesize
4KB
-
memory/3208-127-0x0000000002890000-0x0000000002891000-memory.dmpFilesize
4KB
-
memory/3208-129-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/3208-131-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-130-0x0000000003570000-0x0000000003571000-memory.dmpFilesize
4KB
-
memory/3208-132-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-134-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-133-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-136-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-135-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-137-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-138-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-139-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-140-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-141-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-142-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-143-0x00000000027E0000-0x00000000027E1000-memory.dmpFilesize
4KB
-
memory/3208-144-0x00000000027A0000-0x00000000027A1000-memory.dmpFilesize
4KB
-
memory/3208-145-0x0000000002790000-0x0000000002791000-memory.dmpFilesize
4KB
-
memory/3208-146-0x00000000027B0000-0x00000000027B1000-memory.dmpFilesize
4KB
-
memory/3208-147-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/3208-148-0x00000000027D0000-0x00000000027D1000-memory.dmpFilesize
4KB
-
memory/3208-150-0x0000000003560000-0x0000000003561000-memory.dmpFilesize
4KB
-
memory/3208-149-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/3208-151-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3208-152-0x0000000006550000-0x0000000006551000-memory.dmpFilesize
4KB
-
memory/3208-153-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3208-154-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3208-155-0x0000000003740000-0x0000000003759000-memory.dmpFilesize
100KB
-
memory/3208-156-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3208-158-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3208-159-0x0000000006552000-0x0000000006553000-memory.dmpFilesize
4KB
-
memory/3208-160-0x0000000006553000-0x0000000006554000-memory.dmpFilesize
4KB
-
memory/3208-161-0x00000000035D0000-0x00000000035D1000-memory.dmpFilesize
4KB
-
memory/3208-162-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-163-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-164-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-165-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-166-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-167-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-168-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-169-0x0000000006560000-0x0000000006561000-memory.dmpFilesize
4KB
-
memory/3208-170-0x0000000002950000-0x0000000002951000-memory.dmpFilesize
4KB
-
memory/3208-171-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/3208-172-0x0000000002900000-0x0000000002901000-memory.dmpFilesize
4KB
-
memory/3208-173-0x0000000002920000-0x0000000002921000-memory.dmpFilesize
4KB
-
memory/3208-174-0x0000000002930000-0x0000000002931000-memory.dmpFilesize
4KB
-
memory/3208-175-0x0000000002940000-0x0000000002941000-memory.dmpFilesize
4KB
-
memory/3208-177-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-176-0x0000000002970000-0x0000000002971000-memory.dmpFilesize
4KB
-
memory/3208-179-0x0000000006470000-0x0000000006471000-memory.dmpFilesize
4KB
-
memory/3208-180-0x00000000028F0000-0x00000000028F1000-memory.dmpFilesize
4KB
-
memory/3208-178-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-181-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-182-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-183-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-184-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-185-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-187-0x0000000006B70000-0x0000000006B71000-memory.dmpFilesize
4KB
-
memory/3208-189-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-188-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-186-0x0000000000850000-0x000000000099A000-memory.dmpFilesize
1.3MB
-
memory/3208-194-0x00000000064A0000-0x00000000064A1000-memory.dmpFilesize
4KB
-
memory/3208-195-0x0000000006C80000-0x0000000006C81000-memory.dmpFilesize
4KB
-
memory/3208-196-0x0000000006DE0000-0x0000000006DE1000-memory.dmpFilesize
4KB
-
memory/3208-197-0x0000000006E60000-0x0000000006E61000-memory.dmpFilesize
4KB
-
memory/3208-198-0x0000000006F00000-0x0000000006F01000-memory.dmpFilesize
4KB
-
memory/3208-199-0x0000000007A10000-0x0000000007A11000-memory.dmpFilesize
4KB
-
memory/3208-200-0x0000000007A70000-0x0000000007A71000-memory.dmpFilesize
4KB
-
memory/3208-201-0x0000000008590000-0x0000000008591000-memory.dmpFilesize
4KB
-
memory/3208-202-0x0000000008760000-0x0000000008761000-memory.dmpFilesize
4KB
-
memory/3208-203-0x0000000008D90000-0x0000000008D91000-memory.dmpFilesize
4KB