Analysis
-
max time kernel
122s -
max time network
125s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
23-01-2022 22:24
Static task
static1
General
-
Target
d65b11abb4ee3da872e2e807169ba1a928fb2c920c5c3a5823f3317b55184f80.exe
-
Size
390KB
-
MD5
38863ccb69ff3c0ba428586f27868586
-
SHA1
644ac56d1c8885517cc2726a9be3dcac9e2962d6
-
SHA256
d65b11abb4ee3da872e2e807169ba1a928fb2c920c5c3a5823f3317b55184f80
-
SHA512
05631836dfdeba7e138e9b38b7c560c746fc7d4a13610741f7a963c65c1ba0e8fb3c1cffbe7c58361e5ce872fe9b164c110de14b0f8a169cae4f79dce0e67f6c
Malware Config
Extracted
redline
NONAME
45.9.20.111:1355
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3436-117-0x00000000023C0000-0x00000000023F4000-memory.dmp family_redline behavioral1/memory/3436-123-0x0000000002670000-0x00000000026A2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d65b11abb4ee3da872e2e807169ba1a928fb2c920c5c3a5823f3317b55184f80.exedescription pid process Token: SeDebugPrivilege 3436 d65b11abb4ee3da872e2e807169ba1a928fb2c920c5c3a5823f3317b55184f80.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3436-115-0x0000000000590000-0x00000000006DA000-memory.dmpFilesize
1.3MB
-
memory/3436-116-0x0000000000590000-0x00000000006DA000-memory.dmpFilesize
1.3MB
-
memory/3436-117-0x00000000023C0000-0x00000000023F4000-memory.dmpFilesize
208KB
-
memory/3436-118-0x0000000004F00000-0x00000000053FE000-memory.dmpFilesize
5.0MB
-
memory/3436-119-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/3436-120-0x0000000004EF0000-0x0000000004EF1000-memory.dmpFilesize
4KB
-
memory/3436-121-0x0000000004EF2000-0x0000000004EF3000-memory.dmpFilesize
4KB
-
memory/3436-122-0x0000000004EF3000-0x0000000004EF4000-memory.dmpFilesize
4KB
-
memory/3436-123-0x0000000002670000-0x00000000026A2000-memory.dmpFilesize
200KB
-
memory/3436-124-0x0000000005400000-0x0000000005A06000-memory.dmpFilesize
6.0MB
-
memory/3436-125-0x0000000002770000-0x0000000002782000-memory.dmpFilesize
72KB
-
memory/3436-126-0x0000000002860000-0x000000000296A000-memory.dmpFilesize
1.0MB
-
memory/3436-127-0x00000000027E0000-0x000000000281E000-memory.dmpFilesize
248KB
-
memory/3436-128-0x0000000004EF4000-0x0000000004EF6000-memory.dmpFilesize
8KB
-
memory/3436-129-0x0000000002970000-0x00000000029BB000-memory.dmpFilesize
300KB
-
memory/3436-130-0x0000000004E40000-0x0000000004EA6000-memory.dmpFilesize
408KB
-
memory/3436-131-0x0000000006120000-0x0000000006196000-memory.dmpFilesize
472KB
-
memory/3436-132-0x00000000061B0000-0x0000000006242000-memory.dmpFilesize
584KB
-
memory/3436-133-0x00000000062B0000-0x00000000062CE000-memory.dmpFilesize
120KB
-
memory/3436-134-0x00000000064E0000-0x00000000066A2000-memory.dmpFilesize
1.8MB
-
memory/3436-135-0x00000000066B0000-0x0000000006BDC000-memory.dmpFilesize
5.2MB