Analysis
-
max time kernel
120s -
max time network
131s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
27-01-2022 02:18
Static task
static1
Behavioral task
behavioral1
Sample
9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
Resource
win10-en-20211208
General
-
Target
9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
-
Size
381KB
-
MD5
a8ad152b6a131d69add2461074dfc280
-
SHA1
e8fb416d84d57981b5808a16913a620e3efc63af
-
SHA256
9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e
-
SHA512
0fb332d8adddd8d0579fa932f3bf05fee206ba9598c5a952692558d87175172cb540b30fd8cc63011ad2e00a27de431d68b0dce7ca6d1bbb34f023124301000d
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2368-119-0x0000000002180000-0x00000000021B4000-memory.dmp family_redline behavioral1/memory/2368-126-0x0000000002400000-0x0000000002432000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exedescription pid process Token: SeDebugPrivilege 2368 9082e20b7743984cb2f22a22cf3871e22d8d9c6f33a03fe6d95ea5c1006d4b4e.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2368-119-0x0000000002180000-0x00000000021B4000-memory.dmpFilesize
208KB
-
memory/2368-120-0x0000000002090000-0x00000000020C9000-memory.dmpFilesize
228KB
-
memory/2368-122-0x0000000002120000-0x0000000002133000-memory.dmpFilesize
76KB
-
memory/2368-121-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/2368-123-0x0000000002120000-0x0000000002133000-memory.dmpFilesize
76KB
-
memory/2368-124-0x0000000002120000-0x0000000002133000-memory.dmpFilesize
76KB
-
memory/2368-125-0x00000000049C0000-0x0000000004EBE000-memory.dmpFilesize
5.0MB
-
memory/2368-126-0x0000000002400000-0x0000000002432000-memory.dmpFilesize
200KB
-
memory/2368-127-0x0000000004F30000-0x0000000005536000-memory.dmpFilesize
6.0MB
-
memory/2368-128-0x00000000055C0000-0x00000000055D2000-memory.dmpFilesize
72KB
-
memory/2368-129-0x00000000055F0000-0x00000000056FA000-memory.dmpFilesize
1.0MB
-
memory/2368-130-0x0000000002120000-0x0000000002133000-memory.dmpFilesize
76KB
-
memory/2368-131-0x0000000005740000-0x000000000577E000-memory.dmpFilesize
248KB
-
memory/2368-132-0x0000000005790000-0x00000000057DB000-memory.dmpFilesize
300KB
-
memory/2368-133-0x0000000005A30000-0x0000000005AA6000-memory.dmpFilesize
472KB
-
memory/2368-134-0x0000000005AB0000-0x0000000005B42000-memory.dmpFilesize
584KB
-
memory/2368-135-0x0000000005B90000-0x0000000005BAE000-memory.dmpFilesize
120KB
-
memory/2368-136-0x0000000005D50000-0x0000000005DB6000-memory.dmpFilesize
408KB
-
memory/2368-137-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/2368-138-0x0000000006620000-0x0000000006B4C000-memory.dmpFilesize
5.2MB