Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
28-01-2022 10:32
Static task
static1
Behavioral task
behavioral1
Sample
b2447e963d6977df20c14f11cfd2689313588245a3b6d5b22959faa9fedd9f05.exe
Resource
win10-en-20211208
General
-
Target
b2447e963d6977df20c14f11cfd2689313588245a3b6d5b22959faa9fedd9f05.exe
-
Size
462KB
-
MD5
f1863173e6e7c37ff382a69bec002c6d
-
SHA1
fc81497cf7651a44fff12619f5aadf86402bffb9
-
SHA256
b2447e963d6977df20c14f11cfd2689313588245a3b6d5b22959faa9fedd9f05
-
SHA512
550ff073dbe2c907f4852f6a49a6cd74cf6ed0e5979009e05ddadb9a3e46048d6bef9c8480b053a23387370150433500ad96164521efb3022d58d8dcdc174649
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2608-119-0x00000000022B0000-0x00000000022E4000-memory.dmp family_redline behavioral1/memory/2608-121-0x0000000002700000-0x0000000002732000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b2447e963d6977df20c14f11cfd2689313588245a3b6d5b22959faa9fedd9f05.exedescription pid process Token: SeDebugPrivilege 2608 b2447e963d6977df20c14f11cfd2689313588245a3b6d5b22959faa9fedd9f05.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2608-115-0x00000000006D0000-0x0000000000715000-memory.dmpFilesize
276KB
-
memory/2608-116-0x00000000021D0000-0x0000000002209000-memory.dmpFilesize
228KB
-
memory/2608-117-0x0000000000400000-0x000000000049D000-memory.dmpFilesize
628KB
-
memory/2608-118-0x00000000025C0000-0x00000000025C1000-memory.dmpFilesize
4KB
-
memory/2608-119-0x00000000022B0000-0x00000000022E4000-memory.dmpFilesize
208KB
-
memory/2608-120-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB
-
memory/2608-121-0x0000000002700000-0x0000000002732000-memory.dmpFilesize
200KB
-
memory/2608-122-0x00000000025C2000-0x00000000025C3000-memory.dmpFilesize
4KB
-
memory/2608-123-0x00000000025C3000-0x00000000025C4000-memory.dmpFilesize
4KB
-
memory/2608-124-0x00000000050D0000-0x00000000056D6000-memory.dmpFilesize
6.0MB
-
memory/2608-125-0x0000000005730000-0x0000000005742000-memory.dmpFilesize
72KB
-
memory/2608-126-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2608-127-0x0000000002550000-0x00000000025C6000-memory.dmpFilesize
472KB
-
memory/2608-128-0x00000000058B0000-0x00000000058EE000-memory.dmpFilesize
248KB
-
memory/2608-129-0x0000000005900000-0x000000000594B000-memory.dmpFilesize
300KB
-
memory/2608-130-0x0000000005BA0000-0x0000000005C06000-memory.dmpFilesize
408KB
-
memory/2608-131-0x0000000006240000-0x00000000062B6000-memory.dmpFilesize
472KB
-
memory/2608-132-0x0000000006300000-0x0000000006392000-memory.dmpFilesize
584KB
-
memory/2608-133-0x00000000063B0000-0x00000000063CE000-memory.dmpFilesize
120KB
-
memory/2608-134-0x0000000006620000-0x00000000067E2000-memory.dmpFilesize
1.8MB
-
memory/2608-135-0x00000000067F0000-0x0000000006D1C000-memory.dmpFilesize
5.2MB