Analysis
- max time kernel
84s - max time network
125s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
23/11/2021, 00:36
General
- Target 1b5ddb897f056e6de66713ca2bf3a5c3.exe
- Size 401KB
- Sample211123-axyw6acca7
- SHA256 2f6bd3f9f5c4eed1c281d95c8cf3c8a77a76a569bcd05ba4e7305d7c1361190b
Malware Config
Extracted
-
redline
-
NoName
-
185.215.113.29:26828
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1b5ddb897f056e6de66713ca2bf3a5c3.exe"C:\Users\Admin\AppData\Local\Temp\1b5ddb897f056e6de66713ca2bf3a5c3.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4072-118-0x0000000002DA9000-0x0000000002DD4000-memory.dmp
memory/4072-119-0x0000000002CD0000-0x0000000002D09000-memory.dmp
memory/4072-120-0x0000000000400000-0x0000000002B5C000-memory.dmp
memory/4072-121-0x0000000004A80000-0x0000000004AAE000-memory.dmp
memory/4072-122-0x00000000075A0000-0x00000000075A1000-memory.dmp
memory/4072-123-0x0000000004C70000-0x0000000004C9C000-memory.dmp
memory/4072-124-0x0000000007590000-0x0000000007591000-memory.dmp
memory/4072-125-0x0000000007592000-0x0000000007593000-memory.dmp
memory/4072-126-0x0000000007593000-0x0000000007594000-memory.dmp
memory/4072-127-0x0000000007AA0000-0x0000000007AA1000-memory.dmp
memory/4072-128-0x0000000004F80000-0x0000000004F81000-memory.dmp
memory/4072-129-0x00000000073B0000-0x00000000073B1000-memory.dmp
memory/4072-130-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/4072-131-0x00000000074C0000-0x00000000074C1000-memory.dmp
memory/4072-132-0x0000000007594000-0x0000000007596000-memory.dmp
memory/4072-133-0x0000000008260000-0x0000000008261000-memory.dmp
memory/4072-134-0x00000000082E0000-0x00000000082E1000-memory.dmp
memory/4072-135-0x00000000084E0000-0x00000000084E1000-memory.dmp
memory/4072-136-0x0000000008540000-0x0000000008541000-memory.dmp
memory/4072-137-0x0000000008C90000-0x0000000008C91000-memory.dmp
memory/4072-138-0x0000000008E60000-0x0000000008E61000-memory.dmp