Analysis
-
max time kernel
119s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211104 -
submitted
28-11-2021 20:37
Static task
static1
Behavioral task
behavioral1
Sample
cd217b0e6e936f9ae9492ec1a089cdcf.exe
Resource
win7-en-20211104
Behavioral task
behavioral2
Sample
cd217b0e6e936f9ae9492ec1a089cdcf.exe
Resource
win10-en-20211104
General
-
Target
cd217b0e6e936f9ae9492ec1a089cdcf.exe
-
Size
400KB
-
MD5
cd217b0e6e936f9ae9492ec1a089cdcf
-
SHA1
14ac87815ea815f8997f0a4c751cc352822a7975
-
SHA256
5f5eacd77526de995a9caaaa7a963d18c5f7732b22fad8a0151ac8c25c9baad8
-
SHA512
fbf065be9b4cc648493e4829473902c7c68971a3b59be7908ad5699de69bd9283deab1487d1af05bf2110f4d2468992db6e5af02f26517b8ab376040702e0c73
Malware Config
Extracted
redline
BADMAN2020
147.124.208.247:34932
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2592-119-0x0000000004A00000-0x0000000004A2E000-memory.dmp family_redline behavioral2/memory/2592-121-0x0000000004BD0000-0x0000000004BFC000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
cd217b0e6e936f9ae9492ec1a089cdcf.exepid process 2592 cd217b0e6e936f9ae9492ec1a089cdcf.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cd217b0e6e936f9ae9492ec1a089cdcf.exedescription pid process Token: SeDebugPrivilege 2592 cd217b0e6e936f9ae9492ec1a089cdcf.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2592-118-0x0000000002D89000-0x0000000002DB5000-memory.dmpFilesize
176KB
-
memory/2592-119-0x0000000004A00000-0x0000000004A2E000-memory.dmpFilesize
184KB
-
memory/2592-120-0x0000000007260000-0x0000000007261000-memory.dmpFilesize
4KB
-
memory/2592-121-0x0000000004BD0000-0x0000000004BFC000-memory.dmpFilesize
176KB
-
memory/2592-122-0x0000000002C20000-0x0000000002D6A000-memory.dmpFilesize
1.3MB
-
memory/2592-123-0x0000000000400000-0x0000000002B5C000-memory.dmpFilesize
39.4MB
-
memory/2592-124-0x0000000004A30000-0x0000000004A31000-memory.dmpFilesize
4KB
-
memory/2592-125-0x0000000004A32000-0x0000000004A33000-memory.dmpFilesize
4KB
-
memory/2592-126-0x0000000004A33000-0x0000000004A34000-memory.dmpFilesize
4KB
-
memory/2592-127-0x00000000078B0000-0x00000000078B1000-memory.dmpFilesize
4KB
-
memory/2592-128-0x0000000007F40000-0x0000000007F41000-memory.dmpFilesize
4KB
-
memory/2592-129-0x0000000007F70000-0x0000000007F71000-memory.dmpFilesize
4KB
-
memory/2592-130-0x00000000097C0000-0x00000000097C1000-memory.dmpFilesize
4KB
-
memory/2592-131-0x0000000004A34000-0x0000000004A36000-memory.dmpFilesize
8KB
-
memory/2592-132-0x0000000009890000-0x0000000009891000-memory.dmpFilesize
4KB
-
memory/2592-133-0x0000000009B00000-0x0000000009B01000-memory.dmpFilesize
4KB
-
memory/2592-134-0x0000000009C00000-0x0000000009C01000-memory.dmpFilesize
4KB
-
memory/2592-135-0x0000000009B80000-0x0000000009B81000-memory.dmpFilesize
4KB
-
memory/2592-136-0x0000000009DF0000-0x0000000009DF1000-memory.dmpFilesize
4KB
-
memory/2592-137-0x000000000B820000-0x000000000B821000-memory.dmpFilesize
4KB
-
memory/2592-138-0x000000000BFC0000-0x000000000BFC1000-memory.dmpFilesize
4KB
-
memory/2592-139-0x000000000C190000-0x000000000C191000-memory.dmpFilesize
4KB