Analysis
- max time kernel
119s - max time network
119s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
24/11/2021, 17:17
General
- Target 7bd0607e809bbed2f1294a4bf3e91fe4.exe
- Size 404KB
- Sample211124-vtpjjadccr
- SHA256 faef6881477bcddcdc4ef70525e388445bb385c558ee5ed08447488527be0de8
Malware Config
Extracted
-
redline
-
udptest
-
193.56.146.64:65441
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bd0607e809bbed2f1294a4bf3e91fe4.exe"C:\Users\Admin\AppData\Local\Temp\7bd0607e809bbed2f1294a4bf3e91fe4.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2500-120-0x0000000000400000-0x0000000001FEA000-memory.dmp
memory/2500-119-0x0000000003D20000-0x0000000003D59000-memory.dmp
memory/2500-122-0x0000000006690000-0x0000000006691000-memory.dmp
memory/2500-121-0x0000000003FA0000-0x0000000003FCE000-memory.dmp
memory/2500-123-0x00000000066A0000-0x00000000066A1000-memory.dmp
memory/2500-124-0x0000000006BA0000-0x0000000006BCC000-memory.dmp
memory/2500-125-0x0000000006BE0000-0x0000000006BE1000-memory.dmp
memory/2500-126-0x0000000007280000-0x0000000007281000-memory.dmp
memory/2500-127-0x00000000072B0000-0x00000000072B1000-memory.dmp
memory/2500-128-0x0000000007400000-0x0000000007401000-memory.dmp
memory/2500-130-0x0000000006693000-0x0000000006694000-memory.dmp
memory/2500-129-0x0000000006692000-0x0000000006693000-memory.dmp
memory/2500-131-0x0000000006694000-0x0000000006696000-memory.dmp
memory/2500-132-0x0000000007450000-0x0000000007451000-memory.dmp
memory/2500-133-0x00000000076E0000-0x00000000076E1000-memory.dmp
memory/2500-134-0x0000000007D70000-0x0000000007D71000-memory.dmp
memory/2500-135-0x0000000007E30000-0x0000000007E31000-memory.dmp
memory/2500-136-0x0000000008040000-0x0000000008041000-memory.dmp
memory/2500-137-0x0000000008170000-0x0000000008171000-memory.dmp
memory/2500-138-0x0000000008340000-0x0000000008341000-memory.dmp