Analysis
-
max time kernel
119s -
max time network
129s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
26-11-2021 15:26
Static task
static1
General
-
Target
7d116daf556c42d6740c9c0875715942b5cd5009cc19e4c82e3f304ed6c438cd.exe
-
Size
295KB
-
MD5
c88ddbc72b07152b9fcaa61434fcbfa5
-
SHA1
b8b577c2b733935ea747763b2d8f91fadd663520
-
SHA256
7d116daf556c42d6740c9c0875715942b5cd5009cc19e4c82e3f304ed6c438cd
-
SHA512
d445f3e7050bd7f3b7eacc7b2c0490ae0d2ce9509d8ab624958f5856c6f48f8cc46c152a37a097b943b49fdc0ea1614e07d2158bec3c2adcc35e4b5b145b8147
Malware Config
Extracted
redline
Updbdate
193.56.146.64:65441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/912-118-0x0000000002550000-0x000000000257E000-memory.dmp family_redline behavioral1/memory/912-121-0x0000000002610000-0x000000000263C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7d116daf556c42d6740c9c0875715942b5cd5009cc19e4c82e3f304ed6c438cd.exedescription pid process Token: SeDebugPrivilege 912 7d116daf556c42d6740c9c0875715942b5cd5009cc19e4c82e3f304ed6c438cd.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/912-116-0x0000000000500000-0x00000000005AE000-memory.dmpFilesize
696KB
-
memory/912-115-0x0000000000500000-0x00000000005AE000-memory.dmpFilesize
696KB
-
memory/912-117-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/912-118-0x0000000002550000-0x000000000257E000-memory.dmpFilesize
184KB
-
memory/912-119-0x0000000002430000-0x0000000002431000-memory.dmpFilesize
4KB
-
memory/912-120-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/912-121-0x0000000002610000-0x000000000263C000-memory.dmpFilesize
176KB
-
memory/912-122-0x0000000002432000-0x0000000002433000-memory.dmpFilesize
4KB
-
memory/912-123-0x0000000002433000-0x0000000002434000-memory.dmpFilesize
4KB
-
memory/912-124-0x0000000005230000-0x0000000005231000-memory.dmpFilesize
4KB
-
memory/912-125-0x00000000028B0000-0x00000000028B1000-memory.dmpFilesize
4KB
-
memory/912-126-0x0000000005840000-0x0000000005841000-memory.dmpFilesize
4KB
-
memory/912-127-0x00000000028E0000-0x00000000028E1000-memory.dmpFilesize
4KB
-
memory/912-128-0x0000000002434000-0x0000000002436000-memory.dmpFilesize
8KB
-
memory/912-129-0x0000000002970000-0x0000000002971000-memory.dmpFilesize
4KB
-
memory/912-130-0x0000000005B70000-0x0000000005B71000-memory.dmpFilesize
4KB
-
memory/912-131-0x0000000006220000-0x0000000006221000-memory.dmpFilesize
4KB
-
memory/912-132-0x0000000006300000-0x0000000006301000-memory.dmpFilesize
4KB
-
memory/912-133-0x00000000063E0000-0x00000000063E1000-memory.dmpFilesize
4KB
-
memory/912-134-0x0000000006600000-0x0000000006601000-memory.dmpFilesize
4KB
-
memory/912-135-0x00000000067D0000-0x00000000067D1000-memory.dmpFilesize
4KB