Analysis
-
max time kernel
120s -
max time network
123s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
11-02-2022 18:01
Static task
static1
Behavioral task
behavioral1
Sample
8ac1ff8f3045a819c8bc2b7e6f11eef96117f8e11b81f97a1c5ac72cc807458d.exe
Resource
win7-en-20211208
General
-
Target
8ac1ff8f3045a819c8bc2b7e6f11eef96117f8e11b81f97a1c5ac72cc807458d.exe
-
Size
375KB
-
MD5
32816da2c4b57793f943d58058d9abec
-
SHA1
2b7ec6b605cabf7c1156abb99640d30c6567203d
-
SHA256
8ac1ff8f3045a819c8bc2b7e6f11eef96117f8e11b81f97a1c5ac72cc807458d
-
SHA512
634bf6e5350d5b041b093fb49c330533c0ebb42105bc386b941ab7e3c619122418b905410a660517a99e12574c78f8ddf4b5bf1f21b73233678cda0842ff94bf
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
-
auth_value
44e87155dd7a4d1957a956ed040ff3fd
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/952-54-0x0000000004840000-0x0000000004874000-memory.dmp family_redline behavioral1/memory/952-55-0x0000000006F30000-0x0000000006F62000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8ac1ff8f3045a819c8bc2b7e6f11eef96117f8e11b81f97a1c5ac72cc807458d.exedescription pid process Token: SeDebugPrivilege 952 8ac1ff8f3045a819c8bc2b7e6f11eef96117f8e11b81f97a1c5ac72cc807458d.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/952-54-0x0000000004840000-0x0000000004874000-memory.dmpFilesize
208KB
-
memory/952-55-0x0000000006F30000-0x0000000006F62000-memory.dmpFilesize
200KB
-
memory/952-56-0x0000000000220000-0x000000000024B000-memory.dmpFilesize
172KB
-
memory/952-57-0x0000000000270000-0x00000000002A9000-memory.dmpFilesize
228KB
-
memory/952-58-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/952-59-0x0000000074D3E000-0x0000000074D3F000-memory.dmpFilesize
4KB
-
memory/952-60-0x00000000070E1000-0x00000000070E2000-memory.dmpFilesize
4KB
-
memory/952-61-0x00000000070E2000-0x00000000070E3000-memory.dmpFilesize
4KB
-
memory/952-62-0x00000000070E3000-0x00000000070E4000-memory.dmpFilesize
4KB
-
memory/952-63-0x00000000070E4000-0x00000000070E6000-memory.dmpFilesize
8KB