Analysis
-
max time kernel
123s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
18-01-2022 14:20
Static task
static1
General
-
Target
3895d04637f009f8af216d10b5366b7ca8282f4b6c4c271e6c24ddbe030ab578.exe
-
Size
413KB
-
MD5
77ad1b1c04cc1af4fbe89255fbb62e5e
-
SHA1
f59fff49294a9957a877eddcccc27e9aa68345c6
-
SHA256
3895d04637f009f8af216d10b5366b7ca8282f4b6c4c271e6c24ddbe030ab578
-
SHA512
01c62402f6d6ad3b494ed6439aaab6f52661b060017b9c2ab26742de19035ab4dd12b323a853a4c9d798cb4fb02892683cec82aa9e5aa66ef0b3ce36fc8b56fc
Malware Config
Extracted
redline
noname
185.215.113.29:34865
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2784-121-0x00000000023F0000-0x0000000002424000-memory.dmp family_redline behavioral1/memory/2784-123-0x0000000002450000-0x0000000002482000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3895d04637f009f8af216d10b5366b7ca8282f4b6c4c271e6c24ddbe030ab578.exedescription pid process Token: SeDebugPrivilege 2784 3895d04637f009f8af216d10b5366b7ca8282f4b6c4c271e6c24ddbe030ab578.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2784-118-0x00000000001C0000-0x00000000001EB000-memory.dmpFilesize
172KB
-
memory/2784-119-0x00000000008F0000-0x0000000000929000-memory.dmpFilesize
228KB
-
memory/2784-120-0x0000000000400000-0x0000000000471000-memory.dmpFilesize
452KB
-
memory/2784-121-0x00000000023F0000-0x0000000002424000-memory.dmpFilesize
208KB
-
memory/2784-122-0x0000000004B30000-0x000000000502E000-memory.dmpFilesize
5.0MB
-
memory/2784-123-0x0000000002450000-0x0000000002482000-memory.dmpFilesize
200KB
-
memory/2784-125-0x0000000004B22000-0x0000000004B23000-memory.dmpFilesize
4KB
-
memory/2784-124-0x0000000004B20000-0x0000000004B21000-memory.dmpFilesize
4KB
-
memory/2784-126-0x0000000004B23000-0x0000000004B24000-memory.dmpFilesize
4KB
-
memory/2784-127-0x0000000005030000-0x0000000005636000-memory.dmpFilesize
6.0MB
-
memory/2784-128-0x0000000004AE0000-0x0000000004AF2000-memory.dmpFilesize
72KB
-
memory/2784-129-0x0000000005640000-0x000000000574A000-memory.dmpFilesize
1.0MB
-
memory/2784-130-0x00000000057C0000-0x00000000057FE000-memory.dmpFilesize
248KB
-
memory/2784-131-0x00000000049F0000-0x0000000004B26000-memory.dmpFilesize
1.2MB
-
memory/2784-132-0x0000000005800000-0x000000000584B000-memory.dmpFilesize
300KB
-
memory/2784-133-0x0000000005A70000-0x0000000005AE6000-memory.dmpFilesize
472KB
-
memory/2784-134-0x0000000005B60000-0x0000000005BF2000-memory.dmpFilesize
584KB
-
memory/2784-135-0x0000000005B30000-0x0000000005B4E000-memory.dmpFilesize
120KB
-
memory/2784-136-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/2784-137-0x0000000006480000-0x0000000006642000-memory.dmpFilesize
1.8MB
-
memory/2784-138-0x0000000006670000-0x0000000006B9C000-memory.dmpFilesize
5.2MB