Analysis
-
max time kernel
76s -
max time network
161s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
13-02-2022 08:50
Static task
static1
Behavioral task
behavioral1
Sample
7ed7294aa93ef5b21b6a039ec026496012633600859bf709b79d0d407157a5dd.exe
Resource
win10-en-20211208
General
-
Target
7ed7294aa93ef5b21b6a039ec026496012633600859bf709b79d0d407157a5dd.exe
-
Size
469KB
-
MD5
2034116ef318187fb471f77b91761800
-
SHA1
87754e0b15af78312dfdf3abd7861ab03eee01ff
-
SHA256
7ed7294aa93ef5b21b6a039ec026496012633600859bf709b79d0d407157a5dd
-
SHA512
aaaa2abaec0b46f2fdd09179bc2e3072db224fc2d44de8828bbabd6a8925a9b40204855207e8d54c7f25f82497860e718a1517d6b24969cd25e404c159aa7ff6
Malware Config
Extracted
redline
ruzkiKAKOYTO
185.215.113.29:20819
-
auth_value
44e87155dd7a4d1957a956ed040ff3fd
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3404-120-0x0000000004BC0000-0x0000000004BF4000-memory.dmp family_redline behavioral1/memory/3404-123-0x0000000004C70000-0x0000000004CA2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7ed7294aa93ef5b21b6a039ec026496012633600859bf709b79d0d407157a5dd.exedescription pid process Token: SeDebugPrivilege 3404 7ed7294aa93ef5b21b6a039ec026496012633600859bf709b79d0d407157a5dd.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3404-115-0x0000000002BCA000-0x0000000002BF6000-memory.dmpFilesize
176KB
-
memory/3404-116-0x0000000002BCA000-0x0000000002BF6000-memory.dmpFilesize
176KB
-
memory/3404-117-0x0000000004890000-0x00000000048C9000-memory.dmpFilesize
228KB
-
memory/3404-118-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/3404-119-0x000000007316E000-0x000000007316F000-memory.dmpFilesize
4KB
-
memory/3404-120-0x0000000004BC0000-0x0000000004BF4000-memory.dmpFilesize
208KB
-
memory/3404-121-0x0000000004D30000-0x0000000004D31000-memory.dmpFilesize
4KB
-
memory/3404-122-0x0000000007290000-0x000000000778E000-memory.dmpFilesize
5.0MB
-
memory/3404-123-0x0000000004C70000-0x0000000004CA2000-memory.dmpFilesize
200KB
-
memory/3404-124-0x0000000004D32000-0x0000000004D33000-memory.dmpFilesize
4KB
-
memory/3404-125-0x0000000004D33000-0x0000000004D34000-memory.dmpFilesize
4KB
-
memory/3404-126-0x0000000007790000-0x0000000007D96000-memory.dmpFilesize
6.0MB
-
memory/3404-127-0x0000000007DD0000-0x0000000007DE2000-memory.dmpFilesize
72KB
-
memory/3404-128-0x0000000007E00000-0x0000000007F0A000-memory.dmpFilesize
1.0MB
-
memory/3404-129-0x0000000004D34000-0x0000000004D36000-memory.dmpFilesize
8KB
-
memory/3404-130-0x0000000007F50000-0x0000000007F8E000-memory.dmpFilesize
248KB
-
memory/3404-131-0x0000000007FA0000-0x0000000007FEB000-memory.dmpFilesize
300KB
-
memory/3404-132-0x00000000085B0000-0x0000000008616000-memory.dmpFilesize
408KB
-
memory/3404-133-0x00000000089E0000-0x0000000008A56000-memory.dmpFilesize
472KB
-
memory/3404-134-0x0000000008A70000-0x0000000008B02000-memory.dmpFilesize
584KB
-
memory/3404-135-0x0000000008B80000-0x0000000008B9E000-memory.dmpFilesize
120KB
-
memory/3404-136-0x0000000008D60000-0x0000000008F22000-memory.dmpFilesize
1.8MB
-
memory/3404-137-0x0000000008F30000-0x000000000945C000-memory.dmpFilesize
5.2MB