Analysis
-
max time kernel
153s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
21-05-2022 12:33
Behavioral task
behavioral1
Sample
b67d29172e65df8ad67bb1bcb2a91ef1.exe
Resource
win7-20220414-en
General
-
Target
b67d29172e65df8ad67bb1bcb2a91ef1.exe
-
Size
107KB
-
MD5
b67d29172e65df8ad67bb1bcb2a91ef1
-
SHA1
49c759419071cb33da48a3355e872792112af69d
-
SHA256
aaf2bb6ec3848842acc9e7c4ce6eca304f3adf4750e18a0ba53ad124445f4826
-
SHA512
91f23742184cd0341a116e3bd259dbca13ebbf1355a1726167b0a009e2e4cf46d236d3cbedd0b40e4f04c42c4520e7e99140898d3752dbf1d97b03ef52a015e4
Malware Config
Extracted
redline
stepme#4
51.89.155.45:22595
-
auth_value
cae2ff6a126e46df01eaadfb927c199b
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2948-130-0x00000000005D0000-0x00000000005F0000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b67d29172e65df8ad67bb1bcb2a91ef1.exepid process 2948 b67d29172e65df8ad67bb1bcb2a91ef1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b67d29172e65df8ad67bb1bcb2a91ef1.exedescription pid process Token: SeDebugPrivilege 2948 b67d29172e65df8ad67bb1bcb2a91ef1.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2948-130-0x00000000005D0000-0x00000000005F0000-memory.dmpFilesize
128KB
-
memory/2948-131-0x0000000005580000-0x0000000005B98000-memory.dmpFilesize
6.1MB
-
memory/2948-132-0x0000000004F60000-0x0000000004F72000-memory.dmpFilesize
72KB
-
memory/2948-133-0x0000000005090000-0x000000000519A000-memory.dmpFilesize
1.0MB
-
memory/2948-134-0x0000000004FC0000-0x0000000004FFC000-memory.dmpFilesize
240KB
-
memory/2948-135-0x0000000005330000-0x00000000053A6000-memory.dmpFilesize
472KB
-
memory/2948-136-0x00000000053B0000-0x0000000005442000-memory.dmpFilesize
584KB
-
memory/2948-137-0x0000000006150000-0x00000000066F4000-memory.dmpFilesize
5.6MB
-
memory/2948-138-0x0000000005550000-0x000000000556E000-memory.dmpFilesize
120KB
-
memory/2948-139-0x0000000005F30000-0x0000000005F96000-memory.dmpFilesize
408KB
-
memory/2948-140-0x00000000077A0000-0x0000000007962000-memory.dmpFilesize
1.8MB
-
memory/2948-141-0x0000000007EA0000-0x00000000083CC000-memory.dmpFilesize
5.2MB