Analysis
-
max time kernel
118s -
max time network
130s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 00:25
Static task
static1
Behavioral task
behavioral1
Sample
195e55a5c3026674653c1273d17c483bdb3d5f808ca9ac38f3fb887e4ed004bd.exe
Resource
win10-en-20211208
General
-
Target
195e55a5c3026674653c1273d17c483bdb3d5f808ca9ac38f3fb887e4ed004bd.exe
-
Size
381KB
-
MD5
11517ba767a6c9711cf7e5ea984d3e90
-
SHA1
3bbac633bcf5372901d20d225e6fa3472d40e389
-
SHA256
195e55a5c3026674653c1273d17c483bdb3d5f808ca9ac38f3fb887e4ed004bd
-
SHA512
4b62457780f45db841f8550d77ea9312e31cb5afdb2aaed62f57d53fb3956bbde708cb83e10ed8d75ada294ad8dc777d456db2319860d490281bc0ab7b5750d8
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2744-118-0x0000000002510000-0x0000000002544000-memory.dmp family_redline behavioral1/memory/2744-120-0x00000000049E0000-0x0000000004A12000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
195e55a5c3026674653c1273d17c483bdb3d5f808ca9ac38f3fb887e4ed004bd.exedescription pid process Token: SeDebugPrivilege 2744 195e55a5c3026674653c1273d17c483bdb3d5f808ca9ac38f3fb887e4ed004bd.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2744-115-0x00000000005FA000-0x0000000000626000-memory.dmpFilesize
176KB
-
memory/2744-116-0x00000000004C0000-0x000000000060A000-memory.dmpFilesize
1.3MB
-
memory/2744-117-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/2744-118-0x0000000002510000-0x0000000002544000-memory.dmpFilesize
208KB
-
memory/2744-119-0x0000000004AD0000-0x0000000004FCE000-memory.dmpFilesize
5.0MB
-
memory/2744-120-0x00000000049E0000-0x0000000004A12000-memory.dmpFilesize
200KB
-
memory/2744-122-0x0000000004AC2000-0x0000000004AC3000-memory.dmpFilesize
4KB
-
memory/2744-121-0x0000000004AC0000-0x0000000004AC1000-memory.dmpFilesize
4KB
-
memory/2744-123-0x0000000004AC3000-0x0000000004AC4000-memory.dmpFilesize
4KB
-
memory/2744-124-0x0000000004FD0000-0x00000000055D6000-memory.dmpFilesize
6.0MB
-
memory/2744-125-0x0000000004AA0000-0x0000000004AB2000-memory.dmpFilesize
72KB
-
memory/2744-126-0x00000000055F0000-0x00000000056FA000-memory.dmpFilesize
1.0MB
-
memory/2744-127-0x0000000005740000-0x000000000577E000-memory.dmpFilesize
248KB
-
memory/2744-128-0x0000000004AC4000-0x0000000004AC6000-memory.dmpFilesize
8KB
-
memory/2744-129-0x0000000005790000-0x00000000057DB000-memory.dmpFilesize
300KB
-
memory/2744-130-0x0000000005DA0000-0x0000000005E16000-memory.dmpFilesize
472KB
-
memory/2744-131-0x0000000005EA0000-0x0000000005F32000-memory.dmpFilesize
584KB
-
memory/2744-132-0x0000000005E60000-0x0000000005E7E000-memory.dmpFilesize
120KB
-
memory/2744-133-0x0000000006090000-0x00000000060F6000-memory.dmpFilesize
408KB
-
memory/2744-134-0x0000000006550000-0x0000000006712000-memory.dmpFilesize
1.8MB
-
memory/2744-135-0x0000000006720000-0x0000000006C4C000-memory.dmpFilesize
5.2MB