Analysis
-
max time kernel
120s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-02-2022 08:33
Static task
static1
General
-
Target
ae9d1b0b30c56559d72034b32706a2fa46518712dc056e93a71366f3e1a418bb.exe
-
Size
386KB
-
MD5
360598965de17bfbe7617a00909a33fc
-
SHA1
f466593397d8731339a8398b5ea6c72f893ff3e1
-
SHA256
ae9d1b0b30c56559d72034b32706a2fa46518712dc056e93a71366f3e1a418bb
-
SHA512
938cf3a99e3e068a0e765ac2e04ecbd392618452db3838a89af9163fc8c181ec0777f6b26629b8653e9eb1366d4b60b90d8e20ed8898863febfe4bd85345afd2
Malware Config
Extracted
redline
noname
185.215.113.29:20819
-
auth_value
ee92d883673b7156fdd66cac5fc8d2d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/5060-115-0x0000000002460000-0x0000000002494000-memory.dmp family_redline behavioral1/memory/5060-117-0x0000000004B10000-0x0000000004B42000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ae9d1b0b30c56559d72034b32706a2fa46518712dc056e93a71366f3e1a418bb.exedescription pid process Token: SeDebugPrivilege 5060 ae9d1b0b30c56559d72034b32706a2fa46518712dc056e93a71366f3e1a418bb.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5060-114-0x000000000064A000-0x0000000000676000-memory.dmpFilesize
176KB
-
memory/5060-115-0x0000000002460000-0x0000000002494000-memory.dmpFilesize
208KB
-
memory/5060-116-0x0000000004CE0000-0x00000000051DE000-memory.dmpFilesize
5.0MB
-
memory/5060-117-0x0000000004B10000-0x0000000004B42000-memory.dmpFilesize
200KB
-
memory/5060-118-0x000000000064A000-0x0000000000676000-memory.dmpFilesize
176KB
-
memory/5060-119-0x00000000021D0000-0x0000000002209000-memory.dmpFilesize
228KB
-
memory/5060-121-0x00000000051E0000-0x00000000057E6000-memory.dmpFilesize
6.0MB
-
memory/5060-123-0x0000000004CD0000-0x0000000004CD1000-memory.dmpFilesize
4KB
-
memory/5060-125-0x0000000004CD2000-0x0000000004CD3000-memory.dmpFilesize
4KB
-
memory/5060-126-0x00000000057F0000-0x00000000058FA000-memory.dmpFilesize
1.0MB
-
memory/5060-124-0x0000000004C00000-0x0000000004C12000-memory.dmpFilesize
72KB
-
memory/5060-127-0x0000000004CD3000-0x0000000004CD4000-memory.dmpFilesize
4KB
-
memory/5060-128-0x0000000004CD4000-0x0000000004CD6000-memory.dmpFilesize
8KB
-
memory/5060-120-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/5060-122-0x0000000073CEE000-0x0000000073CEF000-memory.dmpFilesize
4KB
-
memory/5060-129-0x0000000004C70000-0x0000000004CAE000-memory.dmpFilesize
248KB
-
memory/5060-130-0x0000000005900000-0x000000000594B000-memory.dmpFilesize
300KB
-
memory/5060-131-0x0000000005B90000-0x0000000005C06000-memory.dmpFilesize
472KB
-
memory/5060-132-0x0000000005C10000-0x0000000005CA2000-memory.dmpFilesize
584KB
-
memory/5060-133-0x0000000005CF0000-0x0000000005D0E000-memory.dmpFilesize
120KB
-
memory/5060-134-0x0000000005E90000-0x0000000005EF6000-memory.dmpFilesize
408KB
-
memory/5060-135-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/5060-136-0x0000000006770000-0x0000000006C9C000-memory.dmpFilesize
5.2MB