Analysis
-
max time kernel
144s -
max time network
167s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 00:13
Static task
static1
General
-
Target
e2f735b15f830d65289c6e25c7161dad15ffbd18dae33fe554ac153d7d5caab7.exe
-
Size
458KB
-
MD5
e3c3769131fe40692aa2776633c31867
-
SHA1
3646cd11a5aba28a8c9d84feb143e139f0701667
-
SHA256
e2f735b15f830d65289c6e25c7161dad15ffbd18dae33fe554ac153d7d5caab7
-
SHA512
2003693498b1e30890bc8de5b9e516f0cb9dec0a5b5d067b48f27eeacb831c4adceadc43a7594fa99b6855bf328ade4e83975c9160f09b9153cb5019d3e33396
Malware Config
Extracted
redline
noname
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2568-118-0x0000000002520000-0x0000000002554000-memory.dmp family_redline behavioral1/memory/2568-120-0x00000000026F0000-0x0000000002722000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e2f735b15f830d65289c6e25c7161dad15ffbd18dae33fe554ac153d7d5caab7.exedescription pid process Token: SeDebugPrivilege 2568 e2f735b15f830d65289c6e25c7161dad15ffbd18dae33fe554ac153d7d5caab7.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2568-115-0x00000000021C0000-0x00000000021EB000-memory.dmpFilesize
172KB
-
memory/2568-116-0x00000000021F0000-0x0000000002229000-memory.dmpFilesize
228KB
-
memory/2568-117-0x0000000000400000-0x000000000047A000-memory.dmpFilesize
488KB
-
memory/2568-118-0x0000000002520000-0x0000000002554000-memory.dmpFilesize
208KB
-
memory/2568-119-0x0000000004D70000-0x000000000526E000-memory.dmpFilesize
5.0MB
-
memory/2568-120-0x00000000026F0000-0x0000000002722000-memory.dmpFilesize
200KB
-
memory/2568-121-0x0000000004D60000-0x0000000004D61000-memory.dmpFilesize
4KB
-
memory/2568-122-0x0000000004D62000-0x0000000004D63000-memory.dmpFilesize
4KB
-
memory/2568-123-0x0000000004D63000-0x0000000004D64000-memory.dmpFilesize
4KB
-
memory/2568-124-0x0000000005270000-0x0000000005876000-memory.dmpFilesize
6.0MB
-
memory/2568-125-0x0000000004C20000-0x0000000004C32000-memory.dmpFilesize
72KB
-
memory/2568-126-0x0000000004C50000-0x0000000004D5A000-memory.dmpFilesize
1.0MB
-
memory/2568-127-0x00000000058C0000-0x00000000058FE000-memory.dmpFilesize
248KB
-
memory/2568-128-0x0000000004D64000-0x0000000004D66000-memory.dmpFilesize
8KB
-
memory/2568-129-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/2568-130-0x0000000000700000-0x0000000000776000-memory.dmpFilesize
472KB
-
memory/2568-131-0x00000000007F0000-0x0000000000882000-memory.dmpFilesize
584KB
-
memory/2568-132-0x00000000007C0000-0x00000000007DE000-memory.dmpFilesize
120KB
-
memory/2568-133-0x0000000005F90000-0x0000000005FF6000-memory.dmpFilesize
408KB
-
memory/2568-134-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/2568-135-0x0000000006620000-0x0000000006B4C000-memory.dmpFilesize
5.2MB