Analysis
- max time kernel
122s - max time network
122s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
25/11/2021, 09:42
General
- Target 0e0d466f63d4be35005e91ba9df0dc5e42ef15cf3db68.exe
- Size 1.2MB
- Sample211125-lpcvhaaba9
- SHA256 0e0d466f63d4be35005e91ba9df0dc5e42ef15cf3db68cbfe461f354834709e4
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e0d466f63d4be35005e91ba9df0dc5e42ef15cf3db68.exe"C:\Users\Admin\AppData\Local\Temp\0e0d466f63d4be35005e91ba9df0dc5e42ef15cf3db68.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1668-55-0x0000000075901000-0x0000000075903000-memory.dmp
memory/1668-56-0x0000000074A20000-0x0000000074A6A000-memory.dmp
memory/1668-57-0x00000000010F0000-0x000000000126B000-memory.dmp
memory/1668-58-0x00000000002B0000-0x00000000002B1000-memory.dmp
memory/1668-59-0x0000000000340000-0x0000000000380000-memory.dmp
memory/1668-60-0x00000000010F0000-0x000000000126B000-memory.dmp
memory/1668-62-0x0000000076C00000-0x0000000076CAC000-memory.dmp
memory/1668-63-0x00000000768E0000-0x0000000076927000-memory.dmp
memory/1668-64-0x00000000767B0000-0x0000000076807000-memory.dmp
memory/1668-65-0x0000000000380000-0x0000000000381000-memory.dmp
memory/1668-67-0x0000000076CC0000-0x0000000076E1C000-memory.dmp
memory/1668-68-0x00000000010F0000-0x00000000010F1000-memory.dmp
memory/1668-70-0x0000000076B70000-0x0000000076BFF000-memory.dmp
memory/1668-72-0x0000000001060000-0x0000000001061000-memory.dmp
memory/1668-73-0x0000000075900000-0x000000007654A000-memory.dmp
memory/1668-74-0x00000000738C0000-0x00000000738D7000-memory.dmp
memory/1668-75-0x0000000074D10000-0x0000000074D45000-memory.dmp
memory/1668-76-0x000000006D0F0000-0x000000006D280000-memory.dmp
memory/1668-77-0x000000006CD50000-0x000000006CD67000-memory.dmp