metastealer | 8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b

General

Target

8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
Size

1.1MB
MD5

55d1f78cd825fbb30ef8f4abb4973837
SHA1

1df51f571986225491af34c89fbd3d84b3969d88
SHA256

8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b
SHA512

14b21ed1af86e01ff53c9ef3c2465922c4497fc6ce0454b0ad443858e3afa07f321ca6517feaf7922b64bbbc3450e38d409e48ee11a0d3d4564828f7415abc3a

Score

10^/10

metastealer redline discovery infostealer spyware stealer

Malware Config

Signatures

Meta Stealer Stealer
Meta Stealer steals passwords stored in browsers, written in C++.
stealer metastealer
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
infostealer redline

RedLine Payload 1 IoCs

resource	yara_rule
behavioral2/memory/1896-132-0x0000000000400000-0x0000000000426000-memory.dmp	family_redline

Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials in Files
T1081
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
8	checkip.amazonaws.com

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 5008 set thread context of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1896	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
1896	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
1896	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
1896	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
Token: SeDebugPrivilege	1896	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78
PID 5008 wrote to memory of 1896	5008	8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe	78

C:\Users\Admin\AppData\Local\Temp\8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
"C:\Users\Admin\AppData\Local\Temp\8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5008
- C:\Users\Admin\AppData\Local\Temp\8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe
  "C:\Users\Admin\AppData\Local\Temp\8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

1

T1081

Discovery

Query Registry

1

T1012

Lateral Movement

Collection

Data from Local System

1

T1005

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8c2570eb50280bce1adb969e1f356c60a74e761c561e312747f485cbc1c9840b.exe.log

Filesize
226B

MD5
916851e072fbabc4796d8916c5131092

SHA1
d48a602229a690c512d5fdaf4c8d77547a88e7a2

SHA256
7e750c904c43d27c89e55af809a679a96c0bb63fc511006ffbceffc2c7f6fb7d

SHA512
07ce4c881d6c411cac0b62364377e77950797c486804fb10d00555458716e3c47b1efc0d1f37e4cc3b7e6565bb402ca01c7ea8c963f9f9ace941a6e3883d2521

Download Submit
memory/1896-138-0x00000000063B0000-0x0000000006442000-memory.dmp

Filesize
584KB

Download
memory/1896-139-0x0000000006A00000-0x0000000006FA4000-memory.dmp

Filesize
5.6MB

Download
memory/1896-134-0x0000000005BF0000-0x0000000006208000-memory.dmp

Filesize
6.1MB

Download
memory/1896-135-0x00000000054D0000-0x00000000054E2000-memory.dmp

Filesize
72KB

Download
memory/1896-136-0x0000000005530000-0x000000000556C000-memory.dmp

Filesize
240KB

Download
memory/1896-132-0x0000000000400000-0x0000000000426000-memory.dmp

Filesize
152KB

Download
memory/1896-145-0x00000000088C0000-0x000000000895C000-memory.dmp

Filesize
624KB

Download
memory/1896-137-0x00000000057D0000-0x00000000058DA000-memory.dmp

Filesize
1.0MB

Download
memory/1896-140-0x0000000006820000-0x00000000069E2000-memory.dmp

Filesize
1.8MB

Download
memory/1896-141-0x00000000074E0000-0x0000000007A0C000-memory.dmp

Filesize
5.2MB

Download
memory/1896-142-0x0000000007060000-0x00000000070C6000-memory.dmp

Filesize
408KB

Download
memory/1896-143-0x00000000086A0000-0x0000000008716000-memory.dmp

Filesize
472KB

Download
memory/1896-144-0x0000000007B90000-0x0000000007BE0000-memory.dmp

Filesize
320KB

Download
memory/5008-130-0x0000000000AA0000-0x0000000000BB8000-memory.dmp

Filesize
1.1MB

Download

Analysis

Sharing