Analysis
-
max time kernel
118s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
24-01-2022 22:11
Static task
static1
Behavioral task
behavioral1
Sample
fd5c2b26527e050096c07dcc99552100.exe
Resource
win7-en-20211208
General
-
Target
fd5c2b26527e050096c07dcc99552100.exe
-
Size
403KB
-
MD5
fd5c2b26527e050096c07dcc99552100
-
SHA1
b299699b9f1e30f7ee2c4782112679896ab36805
-
SHA256
b011321c3f977caff0665bb91f5a78ef2486486864c18951ec2dfb19b79f0e47
-
SHA512
2370c1d25df139439699bb43489711b46e728fa81f082e4ee5126ba5ed46dfc42269daae8dcbc86ced936ab338695e7d555fb41be854e1ee56ece334e3682819
Malware Config
Extracted
redline
noname
45.9.20.112:57175
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/1568-57-0x00000000004B0000-0x00000000004E4000-memory.dmp family_redline behavioral1/memory/1568-58-0x0000000001F80000-0x0000000002130000-memory.dmp family_redline behavioral1/memory/1568-59-0x0000000000590000-0x00000000005C2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fd5c2b26527e050096c07dcc99552100.exedescription pid process Token: SeDebugPrivilege 1568 fd5c2b26527e050096c07dcc99552100.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1568-54-0x0000000000220000-0x000000000024B000-memory.dmpFilesize
172KB
-
memory/1568-55-0x0000000000270000-0x00000000002A9000-memory.dmpFilesize
228KB
-
memory/1568-56-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/1568-57-0x00000000004B0000-0x00000000004E4000-memory.dmpFilesize
208KB
-
memory/1568-58-0x0000000001F80000-0x0000000002130000-memory.dmpFilesize
1.7MB
-
memory/1568-59-0x0000000000590000-0x00000000005C2000-memory.dmpFilesize
200KB
-
memory/1568-60-0x0000000075D11000-0x0000000075D13000-memory.dmpFilesize
8KB