Analysis
- max time kernel
118s - max time network
137s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
15/12/2021, 02:23
General
- Target 388efd771b06aedc15dc09667abf00cc80f15626e4df1.exe
- Size 431KB
- Sample211215-ct5xeagfd7
- SHA256 388efd771b06aedc15dc09667abf00cc80f15626e4df129708ed35939916e229
Malware Config
Extracted
-
redline
-
11
-
45.9.20.157:46257
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\388efd771b06aedc15dc09667abf00cc80f15626e4df1.exe"C:\Users\Admin\AppData\Local\Temp\388efd771b06aedc15dc09667abf00cc80f15626e4df1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3696-118-0x0000000000726000-0x0000000000752000-memory.dmp
memory/3696-119-0x0000000002240000-0x000000000226E000-memory.dmp
memory/3696-120-0x0000000004E40000-0x0000000004E41000-memory.dmp
memory/3696-121-0x00000000024E0000-0x000000000250D000-memory.dmp
memory/3696-122-0x0000000005340000-0x0000000005341000-memory.dmp
memory/3696-123-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/3696-124-0x0000000004C80000-0x0000000004C81000-memory.dmp
memory/3696-125-0x0000000000580000-0x00000000006CA000-memory.dmp
memory/3696-127-0x0000000004E30000-0x0000000004E31000-memory.dmp
memory/3696-126-0x0000000000400000-0x00000000004ED000-memory.dmp
memory/3696-128-0x0000000004E32000-0x0000000004E33000-memory.dmp
memory/3696-129-0x0000000004E33000-0x0000000004E34000-memory.dmp
memory/3696-130-0x0000000004E34000-0x0000000004E36000-memory.dmp
memory/3696-131-0x0000000002600000-0x0000000002601000-memory.dmp
memory/3696-132-0x00000000027B0000-0x00000000027B1000-memory.dmp
memory/3696-133-0x0000000005AB0000-0x0000000005AB1000-memory.dmp
memory/3696-134-0x0000000006150000-0x0000000006151000-memory.dmp
memory/3696-135-0x0000000006210000-0x0000000006211000-memory.dmp
memory/3696-136-0x0000000006300000-0x0000000006301000-memory.dmp
memory/3696-137-0x0000000006630000-0x0000000006631000-memory.dmp
memory/3696-138-0x0000000006800000-0x0000000006801000-memory.dmp