Analysis
-
max time kernel
125s -
max time network
128s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-01-2022 23:24
Static task
static1
General
-
Target
27936862aa1e8ac5c629e986cc8f9dd2e0ebff5d1111f5cdb83b2a770413b0ce.exe
-
Size
376KB
-
MD5
dd538ae9b12222f1af8fb10b6146d202
-
SHA1
faa1011596ba371601ba00bb2c57da278ffaf6c6
-
SHA256
27936862aa1e8ac5c629e986cc8f9dd2e0ebff5d1111f5cdb83b2a770413b0ce
-
SHA512
89e1b716c02b0a0cbf52ae2756ae2632effa3d3777bd15a8853bad24699b2f316eb63f90dd615ff2028a61a2cd0b3695dea822e7b68fac3181ad3932eef91510
Malware Config
Extracted
redline
NONAME
45.9.20.111:1355
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3520-117-0x00000000023E0000-0x0000000002414000-memory.dmp family_redline behavioral1/memory/3520-119-0x0000000002490000-0x00000000024C2000-memory.dmp family_redline behavioral1/memory/3520-121-0x00000000022E0000-0x0000000002443000-memory.dmp family_redline behavioral1/memory/3520-122-0x00000000022E0000-0x0000000002443000-memory.dmp family_redline behavioral1/memory/3520-123-0x00000000022E0000-0x0000000002443000-memory.dmp family_redline behavioral1/memory/3520-129-0x00000000022E0000-0x0000000002443000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
27936862aa1e8ac5c629e986cc8f9dd2e0ebff5d1111f5cdb83b2a770413b0ce.exedescription pid process Token: SeDebugPrivilege 3520 27936862aa1e8ac5c629e986cc8f9dd2e0ebff5d1111f5cdb83b2a770413b0ce.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3520-115-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3520-116-0x00000000006F0000-0x0000000000729000-memory.dmpFilesize
228KB
-
memory/3520-117-0x00000000023E0000-0x0000000002414000-memory.dmpFilesize
208KB
-
memory/3520-118-0x0000000004B80000-0x000000000507E000-memory.dmpFilesize
5.0MB
-
memory/3520-119-0x0000000002490000-0x00000000024C2000-memory.dmpFilesize
200KB
-
memory/3520-120-0x0000000000400000-0x0000000000464000-memory.dmpFilesize
400KB
-
memory/3520-121-0x00000000022E0000-0x0000000002443000-memory.dmpFilesize
1.4MB
-
memory/3520-122-0x00000000022E0000-0x0000000002443000-memory.dmpFilesize
1.4MB
-
memory/3520-123-0x00000000022E0000-0x0000000002443000-memory.dmpFilesize
1.4MB
-
memory/3520-124-0x0000000005080000-0x0000000005686000-memory.dmpFilesize
6.0MB
-
memory/3520-125-0x0000000002590000-0x00000000025A2000-memory.dmpFilesize
72KB
-
memory/3520-126-0x0000000005690000-0x000000000579A000-memory.dmpFilesize
1.0MB
-
memory/3520-127-0x00000000057A0000-0x00000000057DE000-memory.dmpFilesize
248KB
-
memory/3520-128-0x00000000057E0000-0x000000000582B000-memory.dmpFilesize
300KB
-
memory/3520-129-0x00000000022E0000-0x0000000002443000-memory.dmpFilesize
1.4MB
-
memory/3520-130-0x0000000005960000-0x00000000059D6000-memory.dmpFilesize
472KB
-
memory/3520-131-0x00000000059E0000-0x0000000005A72000-memory.dmpFilesize
584KB
-
memory/3520-132-0x0000000005CD0000-0x0000000005CEE000-memory.dmpFilesize
120KB
-
memory/3520-133-0x0000000005D40000-0x0000000005DA6000-memory.dmpFilesize
408KB
-
memory/3520-134-0x0000000006470000-0x0000000006632000-memory.dmpFilesize
1.8MB
-
memory/3520-135-0x0000000006640000-0x0000000006B6C000-memory.dmpFilesize
5.2MB