Analysis
-
max time kernel
110s -
max time network
151s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
10-02-2022 10:21
Static task
static1
Behavioral task
behavioral1
Sample
8ae8fe3a254a2d00c8510b3d5fc0c5e4db6ff36dd9d0583cf324e98d9cd41603.exe
Resource
win10-en-20211208
General
-
Target
8ae8fe3a254a2d00c8510b3d5fc0c5e4db6ff36dd9d0583cf324e98d9cd41603.exe
-
Size
339KB
-
MD5
8fa8a05213085951f660a22dffd40e7e
-
SHA1
23c6c7af7c9cd6beb0fb0894d67de196aad40162
-
SHA256
8ae8fe3a254a2d00c8510b3d5fc0c5e4db6ff36dd9d0583cf324e98d9cd41603
-
SHA512
58c539d56f923f96cfb6b29bcef5710cedbe3d09a34716c6775c489e7e5529865ee3a63f06468edbdf8401b090e902c9099a01362076b44f0bdce72f75ba538f
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1584-117-0x0000000004AD0000-0x0000000004B04000-memory.dmp family_redline behavioral1/memory/1584-124-0x0000000004BE0000-0x0000000004C12000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8ae8fe3a254a2d00c8510b3d5fc0c5e4db6ff36dd9d0583cf324e98d9cd41603.exedescription pid process Token: SeDebugPrivilege 1584 8ae8fe3a254a2d00c8510b3d5fc0c5e4db6ff36dd9d0583cf324e98d9cd41603.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1584-115-0x0000000004960000-0x000000000498B000-memory.dmpFilesize
172KB
-
memory/1584-116-0x0000000004990000-0x00000000049C9000-memory.dmpFilesize
228KB
-
memory/1584-117-0x0000000004AD0000-0x0000000004B04000-memory.dmpFilesize
208KB
-
memory/1584-119-0x00000000074D3000-0x00000000074D4000-memory.dmpFilesize
4KB
-
memory/1584-118-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1584-120-0x00000000734CE000-0x00000000734CF000-memory.dmpFilesize
4KB
-
memory/1584-121-0x00000000074D0000-0x00000000074D1000-memory.dmpFilesize
4KB
-
memory/1584-122-0x00000000074D2000-0x00000000074D3000-memory.dmpFilesize
4KB
-
memory/1584-123-0x00000000074E0000-0x00000000079DE000-memory.dmpFilesize
5.0MB
-
memory/1584-124-0x0000000004BE0000-0x0000000004C12000-memory.dmpFilesize
200KB
-
memory/1584-125-0x00000000079E0000-0x0000000007FE6000-memory.dmpFilesize
6.0MB
-
memory/1584-126-0x00000000073E0000-0x00000000073F2000-memory.dmpFilesize
72KB
-
memory/1584-127-0x0000000007FF0000-0x00000000080FA000-memory.dmpFilesize
1.0MB
-
memory/1584-128-0x0000000007450000-0x000000000748E000-memory.dmpFilesize
248KB
-
memory/1584-129-0x00000000074D4000-0x00000000074D6000-memory.dmpFilesize
8KB
-
memory/1584-130-0x0000000008100000-0x000000000814B000-memory.dmpFilesize
300KB
-
memory/1584-131-0x0000000008370000-0x00000000083D6000-memory.dmpFilesize
408KB
-
memory/1584-132-0x0000000008A30000-0x0000000008AA6000-memory.dmpFilesize
472KB
-
memory/1584-133-0x0000000008AB0000-0x0000000008B42000-memory.dmpFilesize
584KB
-
memory/1584-134-0x0000000008CC0000-0x0000000008CDE000-memory.dmpFilesize
120KB
-
memory/1584-135-0x0000000008DF0000-0x0000000008FB2000-memory.dmpFilesize
1.8MB
-
memory/1584-136-0x0000000008FC0000-0x00000000094EC000-memory.dmpFilesize
5.2MB