Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-02-2022 05:21
General
-
Target
c258d63c328a2eb6490b84c2b5586b2d47f8a24a821f6e935b4eab86ed3a6430.exe
-
Size
326KB
-
MD5
58218197c467ef27caa007d927a36d3e
-
SHA1
95b51f43da1fcf051586fb00d9a4d2a2cfb30413
-
SHA256
c258d63c328a2eb6490b84c2b5586b2d47f8a24a821f6e935b4eab86ed3a6430
-
SHA512
344961aab2b3534a6734b24123404f86d52913a8bda4700087e7ab2b2f3c7513a75b745171e1c29817d16f6c689dd05a2bfe3d7b57370f7fa17dfbaf434a9148
Malware Config
Extracted
redline
noname
185.215.113.29:20819
-
auth_value
ee92d883673b7156fdd66cac5fc8d2d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\c258d63c328a2eb6490b84c2b5586b2d47f8a24a821f6e935b4eab86ed3a6430.exe"C:\Users\Admin\AppData\Local\Temp\c258d63c328a2eb6490b84c2b5586b2d47f8a24a821f6e935b4eab86ed3a6430.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1816-116-0x00000000005CA000-0x00000000005F5000-memory.dmpFilesize
172KB
-
memory/1816-117-0x0000000002190000-0x00000000021C9000-memory.dmpFilesize
228KB
-
memory/1816-118-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1816-119-0x000000007305E000-0x000000007305F000-memory.dmpFilesize
4KB
-
memory/1816-120-0x0000000004AE0000-0x0000000004AE1000-memory.dmpFilesize
4KB
-
memory/1816-121-0x0000000004A50000-0x0000000004A84000-memory.dmpFilesize
208KB
-
memory/1816-123-0x0000000004AE3000-0x0000000004AE4000-memory.dmpFilesize
4KB
-
memory/1816-122-0x0000000004AE2000-0x0000000004AE3000-memory.dmpFilesize
4KB
-
memory/1816-124-0x0000000004AF0000-0x0000000004FEE000-memory.dmpFilesize
5.0MB
-
memory/1816-125-0x0000000004FF0000-0x0000000005022000-memory.dmpFilesize
200KB
-
memory/1816-126-0x0000000005670000-0x0000000005C76000-memory.dmpFilesize
6.0MB
-
memory/1816-127-0x00000000050E0000-0x00000000050F2000-memory.dmpFilesize
72KB
-
memory/1816-128-0x0000000005110000-0x000000000521A000-memory.dmpFilesize
1.0MB
-
memory/1816-129-0x0000000004AE4000-0x0000000004AE6000-memory.dmpFilesize
8KB
-
memory/1816-130-0x0000000005260000-0x000000000529E000-memory.dmpFilesize
248KB
-
memory/1816-131-0x0000000005530000-0x000000000557B000-memory.dmpFilesize
300KB
-
memory/1816-132-0x00000000055E0000-0x0000000005656000-memory.dmpFilesize
472KB
-
memory/1816-133-0x0000000005D90000-0x0000000005E22000-memory.dmpFilesize
584KB
-
memory/1816-134-0x00000000009B0000-0x00000000009CE000-memory.dmpFilesize
120KB
-
memory/1816-135-0x0000000005F90000-0x0000000005FF6000-memory.dmpFilesize
408KB
-
memory/1816-136-0x0000000006430000-0x00000000065F2000-memory.dmpFilesize
1.8MB
-
memory/1816-137-0x0000000006600000-0x0000000006B2C000-memory.dmpFilesize
5.2MB