Analysis
- max time kernel
118s - max time network
118s - platform
windows7_x64 - resource
win7-en-20211014 - submitted
06/12/2021, 04:12
General
- Target c62d71d8d8394949fe7d834f4026833b06dfb6b3c06c5.exe
- Size 1.0MB
- Sample211206-esh3csdcfk
- SHA256 c62d71d8d8394949fe7d834f4026833b06dfb6b3c06c54fd1014e1fc13428726
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c62d71d8d8394949fe7d834f4026833b06dfb6b3c06c5.exe"C:\Users\Admin\AppData\Local\Temp\c62d71d8d8394949fe7d834f4026833b06dfb6b3c06c5.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1992-55-0x0000000075F41000-0x0000000075F43000-memory.dmp
memory/1992-56-0x0000000074820000-0x000000007486A000-memory.dmp
memory/1992-57-0x0000000001240000-0x00000000013D7000-memory.dmp
memory/1992-58-0x0000000000130000-0x0000000000131000-memory.dmp
memory/1992-60-0x0000000075710000-0x00000000757BC000-memory.dmp
memory/1992-61-0x00000000752E0000-0x0000000075327000-memory.dmp
memory/1992-62-0x00000000759A0000-0x00000000759F7000-memory.dmp
memory/1992-63-0x0000000000300000-0x0000000000345000-memory.dmp
memory/1992-65-0x0000000075500000-0x000000007565C000-memory.dmp
memory/1992-66-0x0000000001240000-0x0000000001241000-memory.dmp
memory/1992-68-0x0000000075910000-0x000000007599F000-memory.dmp
memory/1992-70-0x0000000004DC0000-0x0000000004DC1000-memory.dmp
memory/1992-71-0x0000000075F40000-0x0000000076B8A000-memory.dmp
memory/1992-72-0x0000000073480000-0x0000000073497000-memory.dmp
memory/1992-73-0x0000000075A00000-0x0000000075A35000-memory.dmp
memory/1992-74-0x000000006DDC0000-0x000000006DF50000-memory.dmp
memory/1992-75-0x000000006CC00000-0x000000006CC17000-memory.dmp