Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
12-02-2022 09:34
Static task
static1
General
-
Target
058a8ef58153e4c017cbd054b95a216343992a197515fb3579fafcc0d629f602.exe
-
Size
384KB
-
MD5
bb435e20a94843efdb7706d19eee13c7
-
SHA1
b12ac94a5935f39b59dcc7e3809243b20227321a
-
SHA256
058a8ef58153e4c017cbd054b95a216343992a197515fb3579fafcc0d629f602
-
SHA512
ab024d4eb621ee69ac2758884144d0c68c6e6b66324d94dcf0f0fa53c1023f4d9dcb94f691838a54f0a3acba6dfa2c9ba4026c332c147b3654b5b6c3d02f4c0e
Malware Config
Extracted
redline
noname
185.215.113.29:20819
-
auth_value
ee92d883673b7156fdd66cac5fc8d2d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-120-0x00000000038F0000-0x0000000003924000-memory.dmp family_redline behavioral1/memory/2180-124-0x0000000005EA0000-0x0000000005ED2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
058a8ef58153e4c017cbd054b95a216343992a197515fb3579fafcc0d629f602.exedescription pid process Token: SeDebugPrivilege 2180 058a8ef58153e4c017cbd054b95a216343992a197515fb3579fafcc0d629f602.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-115-0x0000000001A90000-0x0000000001ABB000-memory.dmpFilesize
172KB
-
memory/2180-116-0x0000000003540000-0x0000000003579000-memory.dmpFilesize
228KB
-
memory/2180-117-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2180-118-0x000000007325E000-0x000000007325F000-memory.dmpFilesize
4KB
-
memory/2180-119-0x0000000005FF0000-0x0000000005FF1000-memory.dmpFilesize
4KB
-
memory/2180-120-0x00000000038F0000-0x0000000003924000-memory.dmpFilesize
208KB
-
memory/2180-121-0x0000000005FF2000-0x0000000005FF3000-memory.dmpFilesize
4KB
-
memory/2180-122-0x0000000005FF3000-0x0000000005FF4000-memory.dmpFilesize
4KB
-
memory/2180-123-0x0000000006000000-0x00000000064FE000-memory.dmpFilesize
5.0MB
-
memory/2180-124-0x0000000005EA0000-0x0000000005ED2000-memory.dmpFilesize
200KB
-
memory/2180-125-0x0000000006500000-0x0000000006B06000-memory.dmpFilesize
6.0MB
-
memory/2180-126-0x0000000005F90000-0x0000000005FA2000-memory.dmpFilesize
72KB
-
memory/2180-127-0x0000000006B10000-0x0000000006C1A000-memory.dmpFilesize
1.0MB
-
memory/2180-128-0x0000000005FF4000-0x0000000005FF6000-memory.dmpFilesize
8KB
-
memory/2180-129-0x0000000006C70000-0x0000000006CAE000-memory.dmpFilesize
248KB
-
memory/2180-130-0x0000000006F00000-0x0000000006F4B000-memory.dmpFilesize
300KB
-
memory/2180-131-0x00000000070A0000-0x0000000007116000-memory.dmpFilesize
472KB
-
memory/2180-132-0x0000000007120000-0x00000000071B2000-memory.dmpFilesize
584KB
-
memory/2180-133-0x0000000007300000-0x000000000731E000-memory.dmpFilesize
120KB
-
memory/2180-134-0x00000000074B0000-0x0000000007516000-memory.dmpFilesize
408KB
-
memory/2180-135-0x0000000001BA0000-0x0000000001D62000-memory.dmpFilesize
1.8MB
-
memory/2180-136-0x0000000007950000-0x0000000007E7C000-memory.dmpFilesize
5.2MB