Analysis
-
max time kernel
92s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 05:11
Static task
static1
General
-
Target
cfbc3f416f2ea37d706e2b317dddcf958d96baedd12fe6b0640af597abea5533.exe
-
Size
433KB
-
MD5
46ae066d378f8380699e8be27b2be8ea
-
SHA1
b5357ade0760a123580a2958b25f38cfa8d2fa80
-
SHA256
cfbc3f416f2ea37d706e2b317dddcf958d96baedd12fe6b0640af597abea5533
-
SHA512
5af52c4ec09c88bc94dd64c3910907feee6c5871fbbc6a4248a5c90b943224d5d9cf54d19480f9b062fecf8bff20ca26498438e26d3764ae245a15c86c0eb52f
Malware Config
Extracted
redline
noname
185.215.113.29:34865
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4028-118-0x0000000002550000-0x0000000002584000-memory.dmp family_redline behavioral1/memory/4028-120-0x00000000025F0000-0x0000000002622000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cfbc3f416f2ea37d706e2b317dddcf958d96baedd12fe6b0640af597abea5533.exedescription pid process Token: SeDebugPrivilege 4028 cfbc3f416f2ea37d706e2b317dddcf958d96baedd12fe6b0640af597abea5533.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4028-115-0x00000000001C0000-0x00000000001EB000-memory.dmpFilesize
172KB
-
memory/4028-116-0x0000000000560000-0x00000000006AA000-memory.dmpFilesize
1.3MB
-
memory/4028-117-0x0000000000400000-0x0000000000475000-memory.dmpFilesize
468KB
-
memory/4028-118-0x0000000002550000-0x0000000002584000-memory.dmpFilesize
208KB
-
memory/4028-119-0x0000000004C50000-0x000000000514E000-memory.dmpFilesize
5.0MB
-
memory/4028-120-0x00000000025F0000-0x0000000002622000-memory.dmpFilesize
200KB
-
memory/4028-121-0x00000000025E0000-0x00000000025E1000-memory.dmpFilesize
4KB
-
memory/4028-122-0x00000000025E2000-0x00000000025E3000-memory.dmpFilesize
4KB
-
memory/4028-123-0x00000000025E3000-0x00000000025E4000-memory.dmpFilesize
4KB
-
memory/4028-124-0x0000000005150000-0x0000000005756000-memory.dmpFilesize
6.0MB
-
memory/4028-125-0x00000000026E0000-0x00000000026F2000-memory.dmpFilesize
72KB
-
memory/4028-126-0x0000000005770000-0x000000000587A000-memory.dmpFilesize
1.0MB
-
memory/4028-127-0x00000000058C0000-0x00000000058FE000-memory.dmpFilesize
248KB
-
memory/4028-128-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/4028-129-0x0000000002580000-0x00000000025E6000-memory.dmpFilesize
408KB
-
memory/4028-130-0x0000000005AB0000-0x0000000005B26000-memory.dmpFilesize
472KB
-
memory/4028-131-0x0000000005B30000-0x0000000005BC2000-memory.dmpFilesize
584KB
-
memory/4028-132-0x0000000005E10000-0x0000000005E2E000-memory.dmpFilesize
120KB
-
memory/4028-133-0x0000000005E90000-0x0000000005EF6000-memory.dmpFilesize
408KB
-
memory/4028-134-0x00000000065C0000-0x0000000006782000-memory.dmpFilesize
1.8MB
-
memory/4028-135-0x00000000067A0000-0x0000000006CCC000-memory.dmpFilesize
5.2MB