Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-en-20211104 -
submitted
28-11-2021 20:37
Static task
static1
Behavioral task
behavioral1
Sample
cd217b0e6e936f9ae9492ec1a089cdcf.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
cd217b0e6e936f9ae9492ec1a089cdcf.exe
Resource
win10-en-20211104
General
-
Target
cd217b0e6e936f9ae9492ec1a089cdcf.exe
-
Size
400KB
-
MD5
cd217b0e6e936f9ae9492ec1a089cdcf
-
SHA1
14ac87815ea815f8997f0a4c751cc352822a7975
-
SHA256
5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8
-
SHA512
fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73
Malware Config
Extracted
redline
BADMAN2020
147.124.208.247:34932
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/320-57-0x00000000003D0000-0x00000000003FE000-memory.dmp family_redline behavioral1/memory/320-58-0x0000000004580000-0x00000000045AC000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
cd217b0e6e936f9ae9492ec1a089cdcf.exepid process 320 cd217b0e6e936f9ae9492ec1a089cdcf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cd217b0e6e936f9ae9492ec1a089cdcf.exedescription pid process Token: SeDebugPrivilege 320 cd217b0e6e936f9ae9492ec1a089cdcf.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/320-55-0x0000000002C7B000-0x0000000002CA7000-memory.dmpFilesize
176KB
-
memory/320-56-0x0000000000220000-0x0000000000259000-memory.dmpFilesize
228KB
-
memory/320-57-0x00000000003D0000-0x00000000003FE000-memory.dmpFilesize
184KB
-
memory/320-58-0x0000000004580000-0x00000000045AC000-memory.dmpFilesize
176KB
-
memory/320-61-0x0000000006FF2000-0x0000000006FF3000-memory.dmpFilesize
4KB
-
memory/320-62-0x0000000006FF3000-0x0000000006FF4000-memory.dmpFilesize
4KB
-
memory/320-60-0x0000000006FF1000-0x0000000006FF2000-memory.dmpFilesize
4KB
-
memory/320-59-0x0000000000400000-0x0000000002B5C000-memory.dmpFilesize
39.4MB
-
memory/320-63-0x0000000006FF4000-0x0000000006FF6000-memory.dmpFilesize
8KB