Analysis
- max time kernel
122s - max time network
125s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
14/12/2021, 16:24
General
- Target 1ba5ba04d0f9fafe6e8502223dcc7f0e.exe
- Size 431KB
- Sample211214-twdpdahahk
- SHA256 aed58975d52cdc147a6a09c6fbc17cb7be100e6ecd066c6c49ec75e6e1ed9011
Malware Config
Extracted
-
redline
-
noname
-
185.215.113.29:34865
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ba5ba04d0f9fafe6e8502223dcc7f0e.exe"C:\Users\Admin\AppData\Local\Temp\1ba5ba04d0f9fafe6e8502223dcc7f0e.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/732-55-0x000000000024B000-0x0000000000277000-memory.dmp
memory/732-56-0x00000000003A0000-0x00000000003D9000-memory.dmp
memory/732-58-0x0000000004861000-0x0000000004862000-memory.dmp
memory/732-57-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/732-59-0x0000000001F10000-0x0000000001F3E000-memory.dmp
memory/732-60-0x0000000004750000-0x000000000477D000-memory.dmp
memory/732-62-0x0000000004863000-0x0000000004864000-memory.dmp
memory/732-61-0x0000000004862000-0x0000000004863000-memory.dmp
memory/732-63-0x0000000004864000-0x0000000004866000-memory.dmp