Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
27-11-2021 08:10
Static task
static1
General
-
Target
f1cd238b816dd1a70b05129efead58f2aef2b349fa1cf6d1c743ffc4ecb96c14.exe
-
Size
393KB
-
MD5
c4c04dcd8f57a93c252e334fbfaff3e5
-
SHA1
9e81e0fb9f7f9213d73264cba7131758a5ca42f9
-
SHA256
f1cd238b816dd1a70b05129efead58f2aef2b349fa1cf6d1c743ffc4ecb96c14
-
SHA512
1bb1cd63b7b1cd67dbe46c0abae61873216c7cb442c180c5af2639d42c1b67bcfc6e452c6db4f1bee5c15b7d26de1404bf12af121cd9a9dd5b932b9d342545fe
Malware Config
Extracted
redline
udptest
193.56.146.64:65441
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2872-121-0x0000000003940000-0x000000000396E000-memory.dmp family_redline behavioral1/memory/2872-123-0x0000000006170000-0x000000000619C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f1cd238b816dd1a70b05129efead58f2aef2b349fa1cf6d1c743ffc4ecb96c14.exedescription pid process Token: SeDebugPrivilege 2872 f1cd238b816dd1a70b05129efead58f2aef2b349fa1cf6d1c743ffc4ecb96c14.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2872-118-0x0000000001E96000-0x0000000001EC2000-memory.dmpFilesize
176KB
-
memory/2872-119-0x0000000003820000-0x0000000003859000-memory.dmpFilesize
228KB
-
memory/2872-120-0x0000000000400000-0x0000000001C18000-memory.dmpFilesize
24.1MB
-
memory/2872-121-0x0000000003940000-0x000000000396E000-memory.dmpFilesize
184KB
-
memory/2872-122-0x00000000061E0000-0x00000000061E1000-memory.dmpFilesize
4KB
-
memory/2872-123-0x0000000006170000-0x000000000619C000-memory.dmpFilesize
176KB
-
memory/2872-124-0x00000000066E0000-0x00000000066E1000-memory.dmpFilesize
4KB
-
memory/2872-125-0x0000000006D70000-0x0000000006D71000-memory.dmpFilesize
4KB
-
memory/2872-126-0x0000000006DA0000-0x0000000006DA1000-memory.dmpFilesize
4KB
-
memory/2872-127-0x00000000061D0000-0x00000000061D1000-memory.dmpFilesize
4KB
-
memory/2872-128-0x00000000061D2000-0x00000000061D3000-memory.dmpFilesize
4KB
-
memory/2872-129-0x00000000061D3000-0x00000000061D4000-memory.dmpFilesize
4KB
-
memory/2872-130-0x0000000006EB0000-0x0000000006EB1000-memory.dmpFilesize
4KB
-
memory/2872-131-0x0000000007040000-0x0000000007041000-memory.dmpFilesize
4KB
-
memory/2872-132-0x00000000061D4000-0x00000000061D6000-memory.dmpFilesize
8KB
-
memory/2872-133-0x00000000071D0000-0x00000000071D1000-memory.dmpFilesize
4KB
-
memory/2872-134-0x00000000072D0000-0x00000000072D1000-memory.dmpFilesize
4KB
-
memory/2872-135-0x0000000007290000-0x0000000007291000-memory.dmpFilesize
4KB
-
memory/2872-136-0x00000000074C0000-0x00000000074C1000-memory.dmpFilesize
4KB
-
memory/2872-137-0x0000000007D30000-0x0000000007D31000-memory.dmpFilesize
4KB
-
memory/2872-138-0x0000000007F10000-0x0000000007F11000-memory.dmpFilesize
4KB