Analysis
- max time kernel
122s - max time network
128s - platform
windows10_x64 - resource
win10-en-20211104 - submitted
06/12/2021, 17:35
General
- Target 3ae5ee52d63356bf83b209c8510dcb48.exe
- Size 562KB
- Sample211206-v55d5aeffl
- SHA256 e9c41e16794c4977e98bc2fdd4c652f7159e6e809d39d05b348f9f21db7758af
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ae5ee52d63356bf83b209c8510dcb48.exe"C:\Users\Admin\AppData\Local\Temp\3ae5ee52d63356bf83b209c8510dcb48.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2744-118-0x0000000002D60000-0x0000000002DA5000-memory.dmp
memory/2744-119-0x0000000000E50000-0x0000000000ED5000-memory.dmp
memory/2744-120-0x0000000002CF0000-0x0000000002CF1000-memory.dmp
memory/2744-121-0x00000000765D0000-0x0000000076792000-memory.dmp
memory/2744-122-0x0000000075180000-0x0000000075271000-memory.dmp
memory/2744-123-0x0000000000E50000-0x0000000000E51000-memory.dmp
memory/2744-125-0x0000000071E40000-0x0000000071EC0000-memory.dmp
memory/2744-126-0x0000000006000000-0x0000000006001000-memory.dmp
memory/2744-127-0x00000000037B0000-0x00000000037B1000-memory.dmp
memory/2744-128-0x00000000059F0000-0x00000000059F1000-memory.dmp
memory/2744-129-0x0000000005840000-0x0000000005841000-memory.dmp
memory/2744-130-0x0000000076B10000-0x0000000077094000-memory.dmp
memory/2744-132-0x00000000059E0000-0x00000000059E1000-memory.dmp
memory/2744-131-0x0000000073DE0000-0x0000000075128000-memory.dmp
memory/2744-133-0x0000000005880000-0x0000000005881000-memory.dmp
memory/2744-134-0x0000000070090000-0x00000000700DB000-memory.dmp
memory/2744-135-0x0000000005B70000-0x0000000005B71000-memory.dmp
memory/2744-136-0x0000000006B10000-0x0000000006B11000-memory.dmp
memory/2744-137-0x0000000006610000-0x0000000006611000-memory.dmp
memory/2744-138-0x0000000006730000-0x0000000006731000-memory.dmp
memory/2744-139-0x0000000006710000-0x0000000006711000-memory.dmp
memory/2744-140-0x0000000007230000-0x0000000007231000-memory.dmp
memory/2744-141-0x0000000007930000-0x0000000007931000-memory.dmp