Analysis
-
max time kernel
121s -
max time network
141s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
29-01-2022 19:56
Static task
static1
Behavioral task
behavioral1
Sample
22930bdbe1a579ae17c1f1563556acc7.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
22930bdbe1a579ae17c1f1563556acc7.exe
Resource
win10-en-20211208
General
-
Target
22930bdbe1a579ae17c1f1563556acc7.exe
-
Size
623KB
-
MD5
22930bdbe1a579ae17c1f1563556acc7
-
SHA1
ea9b9bd8e6b858ba7c36263b5a9eee4ce18b53e7
-
SHA256
963c04618351dd9deec457067f8c8b0857e85e106f5b8bd9c9d33b42c8e9e154
-
SHA512
aab60c1dbeced8487faf5d0b5864b185f956225a23cfab1336bb4344ccc09d6678a03f91d69167f26e0f807154e86a6d1dd8ed8ede4512a02172a0a0d601f949
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 3 IoCs
Processes:
resource yara_rule behavioral2/memory/2820-119-0x0000000000800000-0x000000000087A000-memory.dmp family_redline behavioral2/memory/2820-123-0x0000000000800000-0x000000000087A000-memory.dmp family_redline behavioral2/memory/2820-124-0x0000000000800000-0x000000000087A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
Processes:
22930bdbe1a579ae17c1f1563556acc7.exepid process 2820 22930bdbe1a579ae17c1f1563556acc7.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
22930bdbe1a579ae17c1f1563556acc7.exepid process 2820 22930bdbe1a579ae17c1f1563556acc7.exe 2820 22930bdbe1a579ae17c1f1563556acc7.exe 2820 22930bdbe1a579ae17c1f1563556acc7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
22930bdbe1a579ae17c1f1563556acc7.exedescription pid process Token: SeDebugPrivilege 2820 22930bdbe1a579ae17c1f1563556acc7.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2820-118-0x0000000002B00000-0x0000000002B45000-memory.dmpFilesize
276KB
-
memory/2820-119-0x0000000000800000-0x000000000087A000-memory.dmpFilesize
488KB
-
memory/2820-120-0x0000000000990000-0x0000000000991000-memory.dmpFilesize
4KB
-
memory/2820-121-0x0000000074900000-0x0000000074AC2000-memory.dmpFilesize
1.8MB
-
memory/2820-122-0x0000000075280000-0x0000000075371000-memory.dmpFilesize
964KB
-
memory/2820-123-0x0000000000800000-0x000000000087A000-memory.dmpFilesize
488KB
-
memory/2820-124-0x0000000000800000-0x000000000087A000-memory.dmpFilesize
488KB
-
memory/2820-125-0x0000000071C50000-0x0000000071CD0000-memory.dmpFilesize
512KB
-
memory/2820-126-0x0000000075380000-0x0000000075904000-memory.dmpFilesize
5.5MB
-
memory/2820-127-0x00000000056A0000-0x00000000056A1000-memory.dmpFilesize
4KB
-
memory/2820-128-0x0000000075D90000-0x00000000770D8000-memory.dmpFilesize
19.3MB
-
memory/2820-129-0x0000000005CC0000-0x00000000062C6000-memory.dmpFilesize
6.0MB
-
memory/2820-130-0x00000000031C0000-0x00000000031D2000-memory.dmpFilesize
72KB
-
memory/2820-131-0x00000000056B0000-0x00000000057BA000-memory.dmpFilesize
1.0MB
-
memory/2820-132-0x00000000054F0000-0x000000000552E000-memory.dmpFilesize
248KB
-
memory/2820-133-0x0000000005990000-0x0000000005B52000-memory.dmpFilesize
1.8MB
-
memory/2820-134-0x0000000005560000-0x00000000055AB000-memory.dmpFilesize
300KB
-
memory/2820-135-0x000000006D6F0000-0x000000006D73B000-memory.dmpFilesize
300KB
-
memory/2820-136-0x00000000067D0000-0x0000000006CCE000-memory.dmpFilesize
5.0MB
-
memory/2820-137-0x00000000057C0000-0x0000000005826000-memory.dmpFilesize
408KB
-
memory/2820-138-0x0000000006570000-0x0000000006602000-memory.dmpFilesize
584KB
-
memory/2820-139-0x0000000006610000-0x0000000006686000-memory.dmpFilesize
472KB
-
memory/2820-140-0x0000000006510000-0x000000000652E000-memory.dmpFilesize
120KB
-
memory/2820-141-0x0000000007FE0000-0x0000000008030000-memory.dmpFilesize
320KB
-
memory/2820-142-0x0000000008660000-0x0000000008B8C000-memory.dmpFilesize
5.2MB