Analysis
-
max time kernel
119s -
max time network
142s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
22-01-2022 11:06
Static task
static1
General
-
Target
1836a704f8ebfe2054c35cc80d9efaf90419fd9aefb445ff8431ce51aca39d73.exe
-
Size
386KB
-
MD5
1ddb9d15bb63ad6afe1af3707ccaeefb
-
SHA1
06d5ec8987f802322f122358993f2c0b68b200e3
-
SHA256
1836a704f8ebfe2054c35cc80d9efaf90419fd9aefb445ff8431ce51aca39d73
-
SHA512
45ec1c0655807bda54acab257fd77d9a3b021f2c4cc22c899e720d6fa66a287a9d81d63c9d16f99c8a3f31d30aad28e15d1f1e32e7bdce9f64b4762afcbde9b0
Malware Config
Extracted
redline
NONAME
45.9.20.111:1355
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 6 IoCs
Processes:
resource yara_rule behavioral1/memory/3828-118-0x0000000002430000-0x0000000002464000-memory.dmp family_redline behavioral1/memory/3828-120-0x00000000025D0000-0x0000000002602000-memory.dmp family_redline behavioral1/memory/3828-121-0x0000000002470000-0x00000000025D0000-memory.dmp family_redline behavioral1/memory/3828-122-0x0000000002470000-0x00000000025D0000-memory.dmp family_redline behavioral1/memory/3828-123-0x0000000002470000-0x00000000025D0000-memory.dmp family_redline behavioral1/memory/3828-128-0x0000000002470000-0x00000000025D0000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1836a704f8ebfe2054c35cc80d9efaf90419fd9aefb445ff8431ce51aca39d73.exedescription pid process Token: SeDebugPrivilege 3828 1836a704f8ebfe2054c35cc80d9efaf90419fd9aefb445ff8431ce51aca39d73.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3828-115-0x0000000000600000-0x000000000062B000-memory.dmpFilesize
172KB
-
memory/3828-116-0x0000000000A10000-0x0000000000A49000-memory.dmpFilesize
228KB
-
memory/3828-117-0x0000000000400000-0x0000000000467000-memory.dmpFilesize
412KB
-
memory/3828-118-0x0000000002430000-0x0000000002464000-memory.dmpFilesize
208KB
-
memory/3828-119-0x0000000004D80000-0x000000000527E000-memory.dmpFilesize
5.0MB
-
memory/3828-120-0x00000000025D0000-0x0000000002602000-memory.dmpFilesize
200KB
-
memory/3828-121-0x0000000002470000-0x00000000025D0000-memory.dmpFilesize
1.4MB
-
memory/3828-122-0x0000000002470000-0x00000000025D0000-memory.dmpFilesize
1.4MB
-
memory/3828-123-0x0000000002470000-0x00000000025D0000-memory.dmpFilesize
1.4MB
-
memory/3828-124-0x0000000005890000-0x0000000005E96000-memory.dmpFilesize
6.0MB
-
memory/3828-125-0x00000000026C0000-0x00000000026D2000-memory.dmpFilesize
72KB
-
memory/3828-126-0x0000000005280000-0x000000000538A000-memory.dmpFilesize
1.0MB
-
memory/3828-127-0x0000000002740000-0x000000000277E000-memory.dmpFilesize
248KB
-
memory/3828-128-0x0000000002470000-0x00000000025D0000-memory.dmpFilesize
1.4MB
-
memory/3828-129-0x0000000002790000-0x00000000027DB000-memory.dmpFilesize
300KB
-
memory/3828-130-0x0000000005590000-0x0000000005606000-memory.dmpFilesize
472KB
-
memory/3828-131-0x0000000005610000-0x00000000056A2000-memory.dmpFilesize
584KB
-
memory/3828-132-0x00000000056F0000-0x000000000570E000-memory.dmpFilesize
120KB
-
memory/3828-133-0x0000000005EA0000-0x0000000005F06000-memory.dmpFilesize
408KB
-
memory/3828-134-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/3828-135-0x00000000068C0000-0x0000000006DEC000-memory.dmpFilesize
5.2MB