Analysis
-
max time kernel
85s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
26-11-2021 17:11
Static task
static1
General
-
Target
0071e6896ec83eb1b3230938d0bba1cf10db255b8aa5961b9f8882b795ac8df6.exe
-
Size
296KB
-
MD5
c384c3ee388f0ad146cdf40372e6668e
-
SHA1
02b1f8e200f1a7f64ff88099625ad70d4c17eac8
-
SHA256
0071e6896ec83eb1b3230938d0bba1cf10db255b8aa5961b9f8882b795ac8df6
-
SHA512
951e4f8b3293a77136d0e8aedc518deb3ec97b768138e05b9d862e743ef8a3f910e6d4a04800d11010bcc2db7412679c707491ebca61494dc7a3fb8d1870a473
Malware Config
Extracted
redline
Pubdate
193.56.146.64:65441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3708-120-0x0000000002750000-0x000000000277E000-memory.dmp family_redline behavioral1/memory/3708-122-0x0000000002780000-0x00000000027AC000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0071e6896ec83eb1b3230938d0bba1cf10db255b8aa5961b9f8882b795ac8df6.exedescription pid process Token: SeDebugPrivilege 3708 0071e6896ec83eb1b3230938d0bba1cf10db255b8aa5961b9f8882b795ac8df6.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3708-118-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/3708-119-0x0000000002200000-0x0000000002239000-memory.dmpFilesize
228KB
-
memory/3708-120-0x0000000002750000-0x000000000277E000-memory.dmpFilesize
184KB
-
memory/3708-121-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/3708-122-0x0000000002780000-0x00000000027AC000-memory.dmpFilesize
176KB
-
memory/3708-123-0x00000000051D0000-0x00000000051D1000-memory.dmpFilesize
4KB
-
memory/3708-124-0x0000000004C00000-0x0000000004C01000-memory.dmpFilesize
4KB
-
memory/3708-125-0x00000000057E0000-0x00000000057E1000-memory.dmpFilesize
4KB
-
memory/3708-126-0x0000000000400000-0x0000000000453000-memory.dmpFilesize
332KB
-
memory/3708-127-0x0000000004CC0000-0x0000000004CC1000-memory.dmpFilesize
4KB
-
memory/3708-128-0x0000000004CC2000-0x0000000004CC3000-memory.dmpFilesize
4KB
-
memory/3708-129-0x0000000004CC3000-0x0000000004CC4000-memory.dmpFilesize
4KB
-
memory/3708-130-0x0000000004CC4000-0x0000000004CC6000-memory.dmpFilesize
8KB
-
memory/3708-131-0x0000000004C30000-0x0000000004C31000-memory.dmpFilesize
4KB
-
memory/3708-132-0x00000000058F0000-0x00000000058F1000-memory.dmpFilesize
4KB
-
memory/3708-133-0x0000000005B80000-0x0000000005B81000-memory.dmpFilesize
4KB
-
memory/3708-134-0x0000000005C80000-0x0000000005C81000-memory.dmpFilesize
4KB
-
memory/3708-135-0x0000000005C40000-0x0000000005C41000-memory.dmpFilesize
4KB
-
memory/3708-136-0x0000000005E60000-0x0000000005E61000-memory.dmpFilesize
4KB
-
memory/3708-137-0x00000000065B0000-0x00000000065B1000-memory.dmpFilesize
4KB
-
memory/3708-138-0x0000000006780000-0x0000000006781000-memory.dmpFilesize
4KB