Analysis
-
max time kernel
40s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
21-05-2022 16:16
Static task
static1
Behavioral task
behavioral1
Sample
387554209a150c0c6b7e21cfcb66d767.exe
Resource
win7-20220414-en
General
-
Target
387554209a150c0c6b7e21cfcb66d767.exe
-
Size
356KB
-
MD5
387554209a150c0c6b7e21cfcb66d767
-
SHA1
b68c9aad00c0544bd927865b60751430c607623b
-
SHA256
b49caf872949f71549111d28d0a3abb8567643931b0e8d82eb500711efac308f
-
SHA512
8fb72a22f8485d7b6147e3819cd51dbf9a9c997b5d30ed5d3f7fb27160496149caad6b923882007f56070ce700eb0cc791b6265c6a5cee661dd946d0ba05654d
Malware Config
Extracted
redline
3
51.89.204.186:36124
-
auth_value
21358de8b6cf817d47956ee1614a9bfc
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/316-54-0x0000000004630000-0x0000000004666000-memory.dmp family_redline behavioral1/memory/316-55-0x0000000004660000-0x0000000004694000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
387554209a150c0c6b7e21cfcb66d767.exepid process 316 387554209a150c0c6b7e21cfcb66d767.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
387554209a150c0c6b7e21cfcb66d767.exedescription pid process Token: SeDebugPrivilege 316 387554209a150c0c6b7e21cfcb66d767.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/316-54-0x0000000004630000-0x0000000004666000-memory.dmpFilesize
216KB
-
memory/316-55-0x0000000004660000-0x0000000004694000-memory.dmpFilesize
208KB
-
memory/316-56-0x0000000076431000-0x0000000076433000-memory.dmpFilesize
8KB
-
memory/316-57-0x0000000002D0E000-0x0000000002D3A000-memory.dmpFilesize
176KB
-
memory/316-58-0x0000000000220000-0x000000000025A000-memory.dmpFilesize
232KB
-
memory/316-59-0x0000000000400000-0x0000000002B75000-memory.dmpFilesize
39.5MB