Analysis
- max time kernel
121s - max time network
122s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
16/12/2021, 09:47
General
- Target 57afb0dc0fb62e9b2ef5b4c7d2bba6d3.exe
- Size 445KB
- Sample211216-lr7snaceck
- SHA256 8d897b7cdbabac07b9bd47d3e84e6b8bc627321acaabed7aa3c86482a69c5a2d
Malware Config
Extracted
-
redline
-
ww
-
45.9.20.168:46257
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 1 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\57afb0dc0fb62e9b2ef5b4c7d2bba6d3.exe"C:\Users\Admin\AppData\Local\Temp\57afb0dc0fb62e9b2ef5b4c7d2bba6d3.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2460-115-0x00000000006E6000-0x0000000000712000-memory.dmp
memory/2460-116-0x0000000000690000-0x00000000006C9000-memory.dmp
memory/2460-117-0x0000000000400000-0x00000000004F1000-memory.dmp
memory/2460-118-0x00000000024A0000-0x00000000024CE000-memory.dmp
memory/2460-119-0x0000000004C70000-0x0000000004C71000-memory.dmp
memory/2460-120-0x0000000004B90000-0x0000000004BBD000-memory.dmp
memory/2460-122-0x0000000004C62000-0x0000000004C63000-memory.dmp
memory/2460-121-0x0000000004C60000-0x0000000004C61000-memory.dmp
memory/2460-123-0x0000000004C63000-0x0000000004C64000-memory.dmp
memory/2460-124-0x0000000005170000-0x0000000005171000-memory.dmp
memory/2460-125-0x0000000005790000-0x0000000005791000-memory.dmp
memory/2460-126-0x00000000057C0000-0x00000000057C1000-memory.dmp
memory/2460-127-0x00000000058F0000-0x00000000058F1000-memory.dmp
memory/2460-128-0x0000000005960000-0x0000000005961000-memory.dmp
memory/2460-129-0x0000000004C64000-0x0000000004C66000-memory.dmp
memory/2460-130-0x0000000005C00000-0x0000000005C01000-memory.dmp
memory/2460-131-0x0000000005C80000-0x0000000005C81000-memory.dmp
memory/2460-132-0x0000000005D60000-0x0000000005D61000-memory.dmp
memory/2460-133-0x0000000005DD0000-0x0000000005DD1000-memory.dmp
memory/2460-134-0x0000000006610000-0x0000000006611000-memory.dmp
memory/2460-135-0x00000000067E0000-0x00000000067E1000-memory.dmp