Analysis
-
max time kernel
120s -
max time network
125s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
15-02-2022 19:31
Static task
static1
Behavioral task
behavioral1
Sample
d2b70e81fcaa5770ceacd4e708760d95.exe
Resource
win7-en-20211208
General
-
Target
d2b70e81fcaa5770ceacd4e708760d95.exe
-
Size
441KB
-
MD5
d2b70e81fcaa5770ceacd4e708760d95
-
SHA1
07c8bbc92e5588b312ebc08ae1119abff7b8d7e1
-
SHA256
61e2c6c378e1a2732efb70d5df248936b38ec60d7f98527525a428f978270501
-
SHA512
70234ab537cf7dd63630b68466ce4679b183d76fae9c199e227e24105ad594071b47af4b800180ad428d441b29358b78c530106972aa458b1f557a8203b1d7d4
Malware Config
Extracted
redline
noname
185.215.113.29:20819
-
auth_value
ee92d883673b7156fdd66cac5fc8d2d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1400-59-0x0000000000AA0000-0x0000000000AD4000-memory.dmp family_redline behavioral1/memory/1400-63-0x00000000023C0000-0x00000000023F2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d2b70e81fcaa5770ceacd4e708760d95.exedescription pid process Token: SeDebugPrivilege 1400 d2b70e81fcaa5770ceacd4e708760d95.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1400-54-0x000000000092D000-0x0000000000959000-memory.dmpFilesize
176KB
-
memory/1400-55-0x000000000092D000-0x0000000000959000-memory.dmpFilesize
176KB
-
memory/1400-56-0x00000000002D0000-0x0000000000309000-memory.dmpFilesize
228KB
-
memory/1400-57-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/1400-58-0x0000000074C3E000-0x0000000074C3F000-memory.dmpFilesize
4KB
-
memory/1400-59-0x0000000000AA0000-0x0000000000AD4000-memory.dmpFilesize
208KB
-
memory/1400-61-0x0000000004E22000-0x0000000004E23000-memory.dmpFilesize
4KB
-
memory/1400-60-0x0000000004E21000-0x0000000004E22000-memory.dmpFilesize
4KB
-
memory/1400-62-0x0000000004E23000-0x0000000004E24000-memory.dmpFilesize
4KB
-
memory/1400-63-0x00000000023C0000-0x00000000023F2000-memory.dmpFilesize
200KB
-
memory/1400-64-0x0000000004E24000-0x0000000004E26000-memory.dmpFilesize
8KB