Analysis
-
max time kernel
144s -
max time network
197s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 13:22
Static task
static1
Behavioral task
behavioral1
Sample
e7076a3303f109e81cdf10bfd09b5d0a.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e7076a3303f109e81cdf10bfd09b5d0a.exe
Resource
win10-en-20211208
General
-
Target
e7076a3303f109e81cdf10bfd09b5d0a.exe
-
Size
468KB
-
MD5
e7076a3303f109e81cdf10bfd09b5d0a
-
SHA1
30adb3336dba902cfb3f615394b53480b8976694
-
SHA256
53b60511d295d3bd9c9524f275a4962d8e1cad17ee84d0676ef16bdae07d26bf
-
SHA512
5fd8e53f733ce5b45acb80669678adc8cfd7cb4724b522130776a235c6abc2c73310f9f2b8f5e5f1eb20f20ea4ad040a5dda084793b199199a198d8315be610c
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1200-119-0x0000000000E60000-0x0000000000EB6000-memory.dmp family_redline behavioral2/memory/1200-123-0x0000000000E60000-0x0000000000EB6000-memory.dmp family_redline -
.NET Reactor proctector 2 IoCs
Detects an executable protected by an unregistered version of Eziriz's .NET Reactor.
Processes:
resource yara_rule behavioral2/memory/1200-119-0x0000000000E60000-0x0000000000EB6000-memory.dmp net_reactor behavioral2/memory/1200-123-0x0000000000E60000-0x0000000000EB6000-memory.dmp net_reactor -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
e7076a3303f109e81cdf10bfd09b5d0a.exepid process 1200 e7076a3303f109e81cdf10bfd09b5d0a.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
e7076a3303f109e81cdf10bfd09b5d0a.exepid process 1200 e7076a3303f109e81cdf10bfd09b5d0a.exe 1200 e7076a3303f109e81cdf10bfd09b5d0a.exe 1200 e7076a3303f109e81cdf10bfd09b5d0a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e7076a3303f109e81cdf10bfd09b5d0a.exedescription pid process Token: SeDebugPrivilege 1200 e7076a3303f109e81cdf10bfd09b5d0a.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1200-118-0x00000000030E0000-0x0000000003124000-memory.dmpFilesize
272KB
-
memory/1200-119-0x0000000000E60000-0x0000000000EB6000-memory.dmpFilesize
344KB
-
memory/1200-120-0x0000000001350000-0x0000000001351000-memory.dmpFilesize
4KB
-
memory/1200-121-0x00000000767D0000-0x0000000076992000-memory.dmpFilesize
1.8MB
-
memory/1200-123-0x0000000000E60000-0x0000000000EB6000-memory.dmpFilesize
344KB
-
memory/1200-122-0x0000000076610000-0x0000000076701000-memory.dmpFilesize
964KB
-
memory/1200-124-0x0000000071B10000-0x0000000071B90000-memory.dmpFilesize
512KB
-
memory/1200-125-0x0000000005C70000-0x0000000005C71000-memory.dmpFilesize
4KB
-
memory/1200-126-0x00000000742B0000-0x0000000074834000-memory.dmpFilesize
5.5MB
-
memory/1200-127-0x0000000074AA0000-0x0000000075DE8000-memory.dmpFilesize
19.3MB
-
memory/1200-128-0x0000000006290000-0x0000000006896000-memory.dmpFilesize
6.0MB
-
memory/1200-129-0x00000000039B0000-0x00000000039C2000-memory.dmpFilesize
72KB
-
memory/1200-130-0x0000000005C80000-0x0000000005D8A000-memory.dmpFilesize
1.0MB
-
memory/1200-131-0x0000000005B30000-0x0000000005B6E000-memory.dmpFilesize
248KB
-
memory/1200-132-0x0000000005F60000-0x0000000006122000-memory.dmpFilesize
1.8MB
-
memory/1200-133-0x0000000005B70000-0x0000000005BBB000-memory.dmpFilesize
300KB
-
memory/1200-134-0x000000006D5B0000-0x000000006D5FB000-memory.dmpFilesize
300KB
-
memory/1200-135-0x0000000006DA0000-0x000000000729E000-memory.dmpFilesize
5.0MB
-
memory/1200-136-0x0000000006A10000-0x0000000006A76000-memory.dmpFilesize
408KB
-
memory/1200-137-0x0000000006B00000-0x0000000006B76000-memory.dmpFilesize
472KB
-
memory/1200-138-0x0000000006C20000-0x0000000006CB2000-memory.dmpFilesize
584KB
-
memory/1200-139-0x0000000006B80000-0x0000000006B9E000-memory.dmpFilesize
120KB
-
memory/1200-140-0x00000000073A0000-0x00000000073F0000-memory.dmpFilesize
320KB
-
memory/1200-141-0x0000000007B70000-0x000000000809C000-memory.dmpFilesize
5.2MB