9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e

General
Target

9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe

Filesize

381KB

Completed

27-01-2022 02:21

Score
10/10
MD5

a8ad152b6a131d69add2461074dfc280

SHA1

e8fb416d84d57981b5808a16913a620e3efc63af

SHA256

9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e

Malware Config

Extracted

Family redline
Botnet ruzkiKAKOYTO
C2

185.215.113.29:20819

Signatures 5

Filter: none

Collection
Credential Access
Discovery
  • RedLine

    Description

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine Payload

    Reported IOCs

    resourceyara_rule
    behavioral1/memory/2368-119-0x0000000002180000-0x00000000021B4000-memory.dmpfamily_redline
    behavioral1/memory/2368-126-0x0000000002400000-0x0000000002432000-memory.dmpfamily_redline
  • Reads user/profile data of web browsers

    Description

    Infostealers often target stored browser data, which can include saved credentials etc.

    TTPs

    Data from Local SystemCredentials in Files
  • Checks installed software on the system

    Description

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    Tags

    TTPs

    Query Registry
  • Suspicious use of AdjustPrivilegeToken
    9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe

    Reported IOCs

    descriptionpidprocess
    Token: SeDebugPrivilege23689082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
Processes 1
  • C:\Users\Admin\AppData\Local\Temp\9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
    "C:\Users\Admin\AppData\Local\Temp\9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe"
    Suspicious use of AdjustPrivilegeToken
    PID:2368
Network
MITRE ATT&CK Matrix
Command and Control
    Credential Access
    Defense Evasion
      Discovery
      Execution
        Exfiltration
          Impact
            Initial Access
              Lateral Movement
                Persistence
                  Privilege Escalation
                    Replay Monitor
                    00:00 00:00
                    Downloads
                    • memory/2368-119-0x0000000002180000-0x00000000021B4000-memory.dmp

                    • memory/2368-120-0x0000000002090000-0x00000000020C9000-memory.dmp

                    • memory/2368-122-0x0000000002120000-0x0000000002133000-memory.dmp

                    • memory/2368-121-0x0000000000400000-0x0000000000466000-memory.dmp

                    • memory/2368-123-0x0000000002120000-0x0000000002133000-memory.dmp

                    • memory/2368-124-0x0000000002120000-0x0000000002133000-memory.dmp

                    • memory/2368-125-0x00000000049C0000-0x0000000004EBE000-memory.dmp

                    • memory/2368-126-0x0000000002400000-0x0000000002432000-memory.dmp

                    • memory/2368-127-0x0000000004F30000-0x0000000005536000-memory.dmp

                    • memory/2368-128-0x00000000055C0000-0x00000000055D2000-memory.dmp

                    • memory/2368-129-0x00000000055F0000-0x00000000056FA000-memory.dmp

                    • memory/2368-130-0x0000000002120000-0x0000000002133000-memory.dmp

                    • memory/2368-131-0x0000000005740000-0x000000000577E000-memory.dmp

                    • memory/2368-132-0x0000000005790000-0x00000000057DB000-memory.dmp

                    • memory/2368-133-0x0000000005A30000-0x0000000005AA6000-memory.dmp

                    • memory/2368-134-0x0000000005AB0000-0x0000000005B42000-memory.dmp

                    • memory/2368-135-0x0000000005B90000-0x0000000005BAE000-memory.dmp

                    • memory/2368-136-0x0000000005D50000-0x0000000005DB6000-memory.dmp

                    • memory/2368-137-0x0000000006440000-0x0000000006602000-memory.dmp

                    • memory/2368-138-0x0000000006620000-0x0000000006B4C000-memory.dmp