9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e
9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
381KB
27-01-2022 02:21
a8ad152b6a131d69add2461074dfc280
e8fb416d84d57981b5808a16913a620e3efc63af
9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e
Extracted
| Family | redline |
| Botnet | ruzkiKAKOYTO |
| C2 |
185.215.113.29:20819 |
Filter: none
-
RedLine
Description
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
Tags
-
RedLine Payload
Reported IOCs
resource yara_rule behavioral1/memory/2368-119-0x0000000002180000-0x00000000021B4000-memory.dmp family_redline behavioral1/memory/2368-126-0x0000000002400000-0x0000000002432000-memory.dmp family_redline -
Reads user/profile data of web browsers
Description
Infostealers often target stored browser data, which can include saved credentials etc.
Tags
TTPs
-
Checks installed software on the system
Description
Looks up Uninstall key entries in the registry to enumerate software on the system.
Tags
TTPs
-
Suspicious use of AdjustPrivilegeToken9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
Reported IOCs
description pid process Token: SeDebugPrivilege 2368 9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
-
C:\Users\Admin\AppData\Local\Temp\9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exePID:2368"C:\Users\Admin\AppData\Local\Temp\9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe"Suspicious use of AdjustPrivilegeToken
-
memory/2368-119-0x0000000002180000-0x00000000021B4000-memory.dmp
-
memory/2368-120-0x0000000002090000-0x00000000020C9000-memory.dmp
-
memory/2368-122-0x0000000002120000-0x0000000002133000-memory.dmp
-
memory/2368-121-0x0000000000400000-0x0000000000466000-memory.dmp
-
memory/2368-123-0x0000000002120000-0x0000000002133000-memory.dmp
-
memory/2368-124-0x0000000002120000-0x0000000002133000-memory.dmp
-
memory/2368-125-0x00000000049C0000-0x0000000004EBE000-memory.dmp
-
memory/2368-126-0x0000000002400000-0x0000000002432000-memory.dmp
-
memory/2368-127-0x0000000004F30000-0x0000000005536000-memory.dmp
-
memory/2368-128-0x00000000055C0000-0x00000000055D2000-memory.dmp
-
memory/2368-129-0x00000000055F0000-0x00000000056FA000-memory.dmp
-
memory/2368-130-0x0000000002120000-0x0000000002133000-memory.dmp
-
memory/2368-131-0x0000000005740000-0x000000000577E000-memory.dmp
-
memory/2368-132-0x0000000005790000-0x00000000057DB000-memory.dmp
-
memory/2368-133-0x0000000005A30000-0x0000000005AA6000-memory.dmp
-
memory/2368-134-0x0000000005AB0000-0x0000000005B42000-memory.dmp
-
memory/2368-135-0x0000000005B90000-0x0000000005BAE000-memory.dmp
-
memory/2368-136-0x0000000005D50000-0x0000000005DB6000-memory.dmp
-
memory/2368-137-0x0000000006440000-0x0000000006602000-memory.dmp
-
memory/2368-138-0x0000000006620000-0x0000000006B4C000-memory.dmp