Analysis
-
max time kernel
118s -
max time network
132s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
29-01-2022 19:56
Static task
static1
Behavioral task
behavioral1
Sample
22930bdbe1a579ae17c1f1563556acc7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
22930bdbe1a579ae17c1f1563556acc7.exe
Resource
win10-en-20211208
General
-
Target
22930bdbe1a579ae17c1f1563556acc7.exe
-
Size
623KB
-
MD5
22930bdbe1a579ae17c1f1563556acc7
-
SHA1
ea9b9bd8e6b858ba7c36263b5a9eee4ce18b53e7
-
SHA256
963c04618351dd9deec457067f8c8b0857e85e106f5b8bd9c9d33b42c8e9e154
-
SHA512
aab60c1dbeced8487faf5d0b5864b185f956225a23cfab1336bb4344ccc09d6678a03f91d69167f26e0f807154e86a6d1dd8ed8ede4512a02172a0a0d601f949
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1128-57-0x0000000001130000-0x00000000011AA000-memory.dmp family_redline behavioral1/memory/1128-65-0x0000000001130000-0x00000000011AA000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
22930bdbe1a579ae17c1f1563556acc7.exepid process 1128 22930bdbe1a579ae17c1f1563556acc7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
22930bdbe1a579ae17c1f1563556acc7.exepid process 1128 22930bdbe1a579ae17c1f1563556acc7.exe 1128 22930bdbe1a579ae17c1f1563556acc7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
22930bdbe1a579ae17c1f1563556acc7.exedescription pid process Token: SeDebugPrivilege 1128 22930bdbe1a579ae17c1f1563556acc7.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-54-0x0000000075F21000-0x0000000075F23000-memory.dmpFilesize
8KB
-
memory/1128-55-0x00000000001B0000-0x00000000001F5000-memory.dmpFilesize
276KB
-
memory/1128-56-0x0000000074900000-0x000000007494A000-memory.dmpFilesize
296KB
-
memory/1128-57-0x0000000001130000-0x00000000011AA000-memory.dmpFilesize
488KB
-
memory/1128-58-0x00000000000F0000-0x00000000000F1000-memory.dmpFilesize
4KB
-
memory/1128-60-0x0000000074E40000-0x0000000074EEC000-memory.dmpFilesize
688KB
-
memory/1128-61-0x0000000074D10000-0x0000000074D57000-memory.dmpFilesize
284KB
-
memory/1128-62-0x0000000075450000-0x00000000754A7000-memory.dmpFilesize
348KB
-
memory/1128-64-0x0000000075B00000-0x0000000075C5C000-memory.dmpFilesize
1.4MB
-
memory/1128-65-0x0000000001130000-0x00000000011AA000-memory.dmpFilesize
488KB
-
memory/1128-66-0x0000000074F60000-0x0000000074FEF000-memory.dmpFilesize
572KB
-
memory/1128-69-0x0000000004F20000-0x0000000004F21000-memory.dmpFilesize
4KB
-
memory/1128-68-0x0000000075F20000-0x0000000076B6A000-memory.dmpFilesize
12.3MB
-
memory/1128-70-0x00000000736F0000-0x0000000073707000-memory.dmpFilesize
92KB
-
memory/1128-71-0x00000000753E0000-0x0000000075415000-memory.dmpFilesize
212KB
-
memory/1128-72-0x000000006AAC0000-0x000000006AC50000-memory.dmpFilesize
1.6MB
-
memory/1128-73-0x000000006A6C0000-0x000000006A6D7000-memory.dmpFilesize
92KB