Analysis
-
max time kernel
84s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
10-02-2022 02:42
Static task
static1
General
-
Target
eb808048d2023496019b125f155cc6c5a1a42d6af4833654389966ec28103135.exe
-
Size
338KB
-
MD5
b2b5183eff172b7ff6cb8c7062cb4612
-
SHA1
efb12845999397f77ed803638f8f9491158fdb69
-
SHA256
eb808048d2023496019b125f155cc6c5a1a42d6af4833654389966ec28103135
-
SHA512
3ad23d0c01e3cda8b07f558ea2036ba0fded7aec7305a593c3edbe161e9ce980b946bf2bec74b1fa17f4d8883c9aac22af5907ab90fcd1716e69f72e4eb98647
Malware Config
Extracted
redline
noname
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1764-119-0x0000000002580000-0x00000000025B4000-memory.dmp family_redline behavioral1/memory/1764-123-0x0000000004DF0000-0x0000000004E22000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
eb808048d2023496019b125f155cc6c5a1a42d6af4833654389966ec28103135.exedescription pid process Token: SeDebugPrivilege 1764 eb808048d2023496019b125f155cc6c5a1a42d6af4833654389966ec28103135.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1764-114-0x0000000002470000-0x000000000249B000-memory.dmpFilesize
172KB
-
memory/1764-115-0x00000000024A0000-0x00000000024D9000-memory.dmpFilesize
228KB
-
memory/1764-116-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1764-117-0x00000000735CE000-0x00000000735CF000-memory.dmpFilesize
4KB
-
memory/1764-118-0x0000000004F00000-0x0000000004F01000-memory.dmpFilesize
4KB
-
memory/1764-119-0x0000000002580000-0x00000000025B4000-memory.dmpFilesize
208KB
-
memory/1764-120-0x0000000004F02000-0x0000000004F03000-memory.dmpFilesize
4KB
-
memory/1764-121-0x0000000004F03000-0x0000000004F04000-memory.dmpFilesize
4KB
-
memory/1764-122-0x0000000004F10000-0x000000000540E000-memory.dmpFilesize
5.0MB
-
memory/1764-123-0x0000000004DF0000-0x0000000004E22000-memory.dmpFilesize
200KB
-
memory/1764-124-0x0000000005410000-0x0000000005A16000-memory.dmpFilesize
6.0MB
-
memory/1764-125-0x0000000004EC0000-0x0000000004ED2000-memory.dmpFilesize
72KB
-
memory/1764-126-0x0000000005A20000-0x0000000005B2A000-memory.dmpFilesize
1.0MB
-
memory/1764-127-0x0000000004F04000-0x0000000004F06000-memory.dmpFilesize
8KB
-
memory/1764-128-0x0000000005B60000-0x0000000005B9E000-memory.dmpFilesize
248KB
-
memory/1764-129-0x0000000005BB0000-0x0000000005BFB000-memory.dmpFilesize
300KB
-
memory/1764-130-0x0000000005FD0000-0x0000000006046000-memory.dmpFilesize
472KB
-
memory/1764-131-0x0000000006150000-0x00000000061E2000-memory.dmpFilesize
584KB
-
memory/1764-132-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/1764-133-0x00000000063B0000-0x0000000006416000-memory.dmpFilesize
408KB
-
memory/1764-134-0x0000000006830000-0x00000000069F2000-memory.dmpFilesize
1.8MB
-
memory/1764-135-0x0000000006A00000-0x0000000006F2C000-memory.dmpFilesize
5.2MB