Analysis
- max time kernel
111s - max time network
135s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
02/12/2021, 02:03
General
- Target 8f26f65270a53c011e3908d7ae34ce0e.exe
- Size 2.2MB
- Sample211202-cgp1esdbf7
- SHA256 a8c670e05a3134defec2bb6565c6aad83ffebd9465dcf0fc6727f2f550802062
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\8f26f65270a53c011e3908d7ae34ce0e.exe"C:\Users\Admin\AppData\Local\Temp\8f26f65270a53c011e3908d7ae34ce0e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3796-118-0x0000000000A10000-0x0000000000C36000-memory.dmp
memory/3796-119-0x0000000000DF0000-0x0000000000DF1000-memory.dmp
memory/3796-120-0x0000000074990000-0x0000000074B52000-memory.dmp
memory/3796-121-0x0000000001370000-0x00000000013B0000-memory.dmp
memory/3796-122-0x00000000011D0000-0x00000000011D1000-memory.dmp
memory/3796-123-0x0000000074E80000-0x0000000074F71000-memory.dmp
memory/3796-124-0x0000000000A10000-0x0000000000A11000-memory.dmp
memory/3796-126-0x0000000072390000-0x0000000072410000-memory.dmp
memory/3796-127-0x0000000005F00000-0x0000000005F01000-memory.dmp
memory/3796-128-0x0000000003670000-0x0000000003671000-memory.dmp
memory/3796-129-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/3796-130-0x00000000058E0000-0x00000000058E1000-memory.dmp
memory/3796-131-0x00000000036D0000-0x00000000036D1000-memory.dmp
memory/3796-132-0x0000000074400000-0x0000000074984000-memory.dmp
memory/3796-133-0x00000000753F0000-0x0000000076738000-memory.dmp
memory/3796-134-0x0000000005730000-0x0000000005731000-memory.dmp
memory/3796-135-0x00000000705E0000-0x000000007062B000-memory.dmp
memory/3796-136-0x0000000005A70000-0x0000000005A71000-memory.dmp
memory/3796-137-0x0000000006A10000-0x0000000006A11000-memory.dmp
memory/3796-138-0x0000000006510000-0x0000000006511000-memory.dmp
memory/3796-139-0x0000000006630000-0x0000000006631000-memory.dmp
memory/3796-140-0x00000000065D0000-0x00000000065D1000-memory.dmp
memory/3796-141-0x00000000072E0000-0x00000000072E1000-memory.dmp
memory/3796-142-0x00000000079E0000-0x00000000079E1000-memory.dmp
memory/3796-143-0x00000000071B0000-0x00000000071B1000-memory.dmp