Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
09-02-2022 15:02
Static task
static1
Behavioral task
behavioral1
Sample
44e31540031873ae386202304a5078b4816bf7e4aa1c7358d6083c07faed8094.exe
Resource
win7-en-20211208
General
-
Target
44e31540031873ae386202304a5078b4816bf7e4aa1c7358d6083c07faed8094.exe
-
Size
378KB
-
MD5
097ba4f8503bac3a54e8f9ba9256531e
-
SHA1
7b0e72bcc8038971cae5329baf8239fb2a22504c
-
SHA256
44e31540031873ae386202304a5078b4816bf7e4aa1c7358d6083c07faed8094
-
SHA512
0f390c2f2b58f7b4214b9f1683fdd74e5e0d35b37a3dff87143dc6147f22a1a3fb4fdce43fd3eff3e4614f5a737c7be9cef07ce885e4ce78934b3397dd6b5c2b
Malware Config
Extracted
redline
noname
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1396-61-0x00000000004D0000-0x0000000000504000-memory.dmp family_redline behavioral1/memory/1396-64-0x0000000001EA0000-0x0000000001ED2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
44e31540031873ae386202304a5078b4816bf7e4aa1c7358d6083c07faed8094.exedescription pid process Token: SeDebugPrivilege 1396 44e31540031873ae386202304a5078b4816bf7e4aa1c7358d6083c07faed8094.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1396-55-0x00000000005BD000-0x00000000005E9000-memory.dmpFilesize
176KB
-
memory/1396-57-0x0000000000250000-0x0000000000289000-memory.dmpFilesize
228KB
-
memory/1396-58-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1396-56-0x00000000005BD000-0x00000000005E9000-memory.dmpFilesize
176KB
-
memory/1396-59-0x0000000073FFE000-0x0000000073FFF000-memory.dmpFilesize
4KB
-
memory/1396-60-0x0000000004991000-0x0000000004992000-memory.dmpFilesize
4KB
-
memory/1396-61-0x00000000004D0000-0x0000000000504000-memory.dmpFilesize
208KB
-
memory/1396-62-0x0000000004992000-0x0000000004993000-memory.dmpFilesize
4KB
-
memory/1396-63-0x0000000004993000-0x0000000004994000-memory.dmpFilesize
4KB
-
memory/1396-64-0x0000000001EA0000-0x0000000001ED2000-memory.dmpFilesize
200KB
-
memory/1396-65-0x0000000004994000-0x0000000004996000-memory.dmpFilesize
8KB