Analysis
-
max time kernel
111s -
max time network
126s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
26-11-2021 10:29
Static task
static1
General
-
Target
20d1fe60fd18dbde9567c94ce45181ed3f920fb7590d74b11dddbff229a6be4f.exe
-
Size
285KB
-
MD5
d42036536c243cb424e698c40fa317de
-
SHA1
80cef345557b8bef912e878e4d47592699395096
-
SHA256
20d1fe60fd18dbde9567c94ce45181ed3f920fb7590d74b11dddbff229a6be4f
-
SHA512
91b4581b9ae9fe63b1ee1070bf461ea41d9612ca62df77e3c00de9f215c6592cea977040a914c5ae63c0e0d7023b14dd89688cd2ec3387a50e539a76f6ecbff4
Malware Config
Extracted
redline
Updbdate
193.56.146.64:65441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3444-118-0x0000000002510000-0x000000000253E000-memory.dmp family_redline behavioral1/memory/3444-122-0x0000000002590000-0x00000000025BC000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
20d1fe60fd18dbde9567c94ce45181ed3f920fb7590d74b11dddbff229a6be4f.exedescription pid process Token: SeDebugPrivilege 3444 20d1fe60fd18dbde9567c94ce45181ed3f920fb7590d74b11dddbff229a6be4f.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3444-116-0x0000000002190000-0x00000000021C9000-memory.dmpFilesize
228KB
-
memory/3444-115-0x0000000000450000-0x00000000004FE000-memory.dmpFilesize
696KB
-
memory/3444-117-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/3444-118-0x0000000002510000-0x000000000253E000-memory.dmpFilesize
184KB
-
memory/3444-120-0x00000000025C2000-0x00000000025C3000-memory.dmpFilesize
4KB
-
memory/3444-119-0x00000000025C0000-0x00000000025C1000-memory.dmpFilesize
4KB
-
memory/3444-121-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/3444-122-0x0000000002590000-0x00000000025BC000-memory.dmpFilesize
176KB
-
memory/3444-123-0x00000000025C3000-0x00000000025C4000-memory.dmpFilesize
4KB
-
memory/3444-124-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/3444-125-0x0000000002690000-0x0000000002691000-memory.dmpFilesize
4KB
-
memory/3444-126-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/3444-127-0x00000000026F0000-0x00000000026F1000-memory.dmpFilesize
4KB
-
memory/3444-128-0x00000000025C4000-0x00000000025C6000-memory.dmpFilesize
8KB
-
memory/3444-129-0x0000000002760000-0x0000000002761000-memory.dmpFilesize
4KB
-
memory/3444-130-0x0000000005B60000-0x0000000005B61000-memory.dmpFilesize
4KB
-
memory/3444-131-0x0000000005C60000-0x0000000005C61000-memory.dmpFilesize
4KB
-
memory/3444-132-0x0000000005C20000-0x0000000005C21000-memory.dmpFilesize
4KB
-
memory/3444-133-0x0000000005D40000-0x0000000005D41000-memory.dmpFilesize
4KB
-
memory/3444-134-0x0000000006580000-0x0000000006581000-memory.dmpFilesize
4KB
-
memory/3444-135-0x0000000006760000-0x0000000006761000-memory.dmpFilesize
4KB