Analysis
- max time kernel
131s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-en-20220113 - submitted
26/03/2022, 20:52
General
- Target 57f2b5ce4666fa2b27a3634682debe17.exe
- Size 580KB
- Sample220326-znqa4adfcq
- SHA256 bd0b152a5a8a90ac500a7afb219a27a859cbbb9bf3517996cd5cd33e989910c2
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine Payload 4 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\57f2b5ce4666fa2b27a3634682debe17.exe"C:\Users\Admin\AppData\Local\Temp\57f2b5ce4666fa2b27a3634682debe17.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2000-130-0x0000000000D90000-0x0000000000E19000-memory.dmp
memory/2000-131-0x0000000000CB0000-0x0000000000CB1000-memory.dmp
memory/2000-132-0x0000000000D30000-0x0000000000D76000-memory.dmp
memory/2000-133-0x0000000000D90000-0x0000000000E19000-memory.dmp
memory/2000-134-0x0000000077310000-0x0000000077525000-memory.dmp
memory/2000-135-0x0000000000D90000-0x0000000000E19000-memory.dmp
memory/2000-136-0x0000000000D90000-0x0000000000E19000-memory.dmp
memory/2000-137-0x00000000731A0000-0x0000000073229000-memory.dmp
memory/2000-138-0x0000000076D50000-0x0000000077303000-memory.dmp
memory/2000-139-0x0000000005C90000-0x00000000062A8000-memory.dmp
memory/2000-140-0x0000000003320000-0x0000000003332000-memory.dmp
memory/2000-141-0x0000000005670000-0x000000000577A000-memory.dmp
memory/2000-142-0x00000000054B0000-0x00000000054EC000-memory.dmp
memory/2000-143-0x000000006E9B0000-0x000000006E9FC000-memory.dmp
memory/2000-144-0x00000000057F0000-0x0000000005856000-memory.dmp
memory/2000-145-0x00000000063B0000-0x0000000006426000-memory.dmp
memory/2000-146-0x0000000006430000-0x00000000064C2000-memory.dmp
memory/2000-147-0x0000000006A80000-0x0000000007024000-memory.dmp
memory/2000-148-0x0000000006780000-0x000000000679E000-memory.dmp
memory/2000-149-0x0000000006830000-0x0000000006880000-memory.dmp
memory/2000-150-0x0000000007030000-0x00000000071F2000-memory.dmp
memory/2000-151-0x0000000007730000-0x0000000007C5C000-memory.dmp