f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749

General
Target

f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749.exe

Filesize

405KB

Completed

25-11-2021 16:44

Score
10/10
MD5

7c357e9c547247438791b26e75d615fd

SHA1

bac795f6f99e01b90cc3d58e6f2d57a958fbb0df

SHA256

f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749

Malware Config

Extracted

Family redline
Botnet Pubdate
C2

193.56.146.64:65441

Signatures 6

Filter: none

Collection
Credential Access
Discovery
  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2436-118-0x0000000003980000-0x00000000039AE000-memory.dmpfamily_redline
    behavioral1/memory/2436-123-0x00000000062C0000-0x00000000062EC000-memory.dmpfamily_redline
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Accesses cryptocurrency files/wallets, possible credential harvesting

    Tags

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Suspicious use of AdjustPrivilegeToken
    f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege2436f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749.exe
    "C:\Users\Admin\AppData\Local\Temp\f1b59fa3cdf98bbe1008b0cd7bbff7be4d374e89ab484f81e4345e4f091e5749.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:2436
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • memory/2436-115-0x0000000001DD9000-0x0000000001E04000-memory.dmp

                    • memory/2436-116-0x0000000001CB0000-0x0000000001DFA000-memory.dmp

                    • memory/2436-117-0x0000000000400000-0x0000000001C1B000-memory.dmp

                    • memory/2436-118-0x0000000003980000-0x00000000039AE000-memory.dmp

                    • memory/2436-119-0x00000000063A0000-0x00000000063A1000-memory.dmp

                    • memory/2436-120-0x0000000006390000-0x0000000006391000-memory.dmp

                    • memory/2436-121-0x0000000006392000-0x0000000006393000-memory.dmp

                    • memory/2436-122-0x0000000006393000-0x0000000006394000-memory.dmp

                    • memory/2436-123-0x00000000062C0000-0x00000000062EC000-memory.dmp

                    • memory/2436-124-0x00000000068A0000-0x00000000068A1000-memory.dmp

                    • memory/2436-125-0x0000000006EB0000-0x0000000006EB1000-memory.dmp

                    • memory/2436-126-0x0000000006EE0000-0x0000000006EE1000-memory.dmp

                    • memory/2436-127-0x0000000006FF0000-0x0000000006FF1000-memory.dmp

                    • memory/2436-128-0x0000000006394000-0x0000000006396000-memory.dmp

                    • memory/2436-129-0x0000000007080000-0x0000000007081000-memory.dmp

                    • memory/2436-130-0x0000000007310000-0x0000000007311000-memory.dmp

                    • memory/2436-131-0x0000000007410000-0x0000000007411000-memory.dmp

                    • memory/2436-132-0x00000000073D0000-0x00000000073D1000-memory.dmp

                    • memory/2436-133-0x0000000007600000-0x0000000007601000-memory.dmp

                    • memory/2436-134-0x0000000009060000-0x0000000009061000-memory.dmp

                    • memory/2436-135-0x0000000009230000-0x0000000009231000-memory.dmp