Analysis
-
max time kernel
110s -
max time network
113s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
04-05-2022 05:11
Static task
static1
Behavioral task
behavioral1
Sample
Payment Confirmation Ref-876627.exe
Resource
win7-20220414-en
General
-
Target
Payment Confirmation Ref-876627.exe
-
Size
1.1MB
-
MD5
2d75aafb29ad71871745dce716de4517
-
SHA1
23f737a59884324f91c86af756f97f272e07cedc
-
SHA256
58274c41a987c806022f227b6df900bb1bd3fab9a7a87a3d34a5bd4f1b58980d
-
SHA512
491500861bfe415470e2dba2aaa448bf3ab9056e49a1e753835a59a6925de56c5947b794d564fbc83d948361fd3f0a60ae7a4c9acfd2896397636bdc51b7f7b1
Malware Config
Extracted
redline
1
45.87.63.175:80
-
auth_value
bee3c59bada67864cb0d4dde954652de
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2008-59-0x0000000001F50000-0x0000000001F70000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
Payment Confirmation Ref-876627.exepid process 2008 Payment Confirmation Ref-876627.exe 2008 Payment Confirmation Ref-876627.exe 2008 Payment Confirmation Ref-876627.exe 2008 Payment Confirmation Ref-876627.exe 2008 Payment Confirmation Ref-876627.exe 2008 Payment Confirmation Ref-876627.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
Payment Confirmation Ref-876627.exedescription pid process Token: SeDebugPrivilege 2008 Payment Confirmation Ref-876627.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2008-54-0x0000000002170000-0x0000000002299000-memory.dmpFilesize
1.2MB
-
memory/2008-55-0x0000000002170000-0x0000000002299000-memory.dmpFilesize
1.2MB
-
memory/2008-56-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/2008-57-0x000000000E8F0000-0x000000000EA05000-memory.dmpFilesize
1.1MB
-
memory/2008-58-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB
-
memory/2008-59-0x0000000001F50000-0x0000000001F70000-memory.dmpFilesize
128KB
-
memory/2008-60-0x00000000001C0000-0x00000000001D0000-memory.dmpFilesize
64KB