Analysis
-
max time kernel
91s -
max time network
116s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-05-2022 10:36
Behavioral task
behavioral1
Sample
2780-191-0x0000000000F80000-0x00000000014A2000-memory.exe
Resource
win7-20220414-en
General
-
Target
2780-191-0x0000000000F80000-0x00000000014A2000-memory.exe
-
Size
5.1MB
-
MD5
c0847141675cc3928f3cf19db23dc86d
-
SHA1
89b3fb2ce75fb201247c69d6972b32ceacbe9357
-
SHA256
9dc968d583f2d026ee46d35769c6f90f3f1eb9095bae7f17796b80db7d792059
-
SHA512
c5925361960cd1e65d6b954d8cd05b408e95d51ef1827c02fc6c560ddc55be7e90b767cd2252cf46e64549de51dbf8871ccb341071c41e9fb96ce579363fc274
Malware Config
Extracted
redline
1
45.10.43.167:26696
-
auth_value
3a70a3e2f548aaf61e05be9e4cadc7c1
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/4324-130-0x00000000003F0000-0x0000000000912000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2780-191-0x0000000000F80000-0x00000000014A2000-memory.exepid process 4324 2780-191-0x0000000000F80000-0x00000000014A2000-memory.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2780-191-0x0000000000F80000-0x00000000014A2000-memory.exedescription pid process Token: SeDebugPrivilege 4324 2780-191-0x0000000000F80000-0x00000000014A2000-memory.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4324-130-0x00000000003F0000-0x0000000000912000-memory.dmpFilesize
5.1MB
-
memory/4324-131-0x0000000005880000-0x0000000005E98000-memory.dmpFilesize
6.1MB
-
memory/4324-132-0x0000000005290000-0x00000000052A2000-memory.dmpFilesize
72KB
-
memory/4324-133-0x00000000053C0000-0x00000000054CA000-memory.dmpFilesize
1.0MB
-
memory/4324-134-0x00000000052F0000-0x000000000532C000-memory.dmpFilesize
240KB
-
memory/4324-135-0x0000000005640000-0x00000000056B6000-memory.dmpFilesize
472KB
-
memory/4324-136-0x0000000005760000-0x00000000057F2000-memory.dmpFilesize
584KB
-
memory/4324-137-0x0000000006450000-0x00000000069F4000-memory.dmpFilesize
5.6MB
-
memory/4324-138-0x0000000005800000-0x000000000581E000-memory.dmpFilesize
120KB
-
memory/4324-139-0x0000000005F10000-0x0000000005F76000-memory.dmpFilesize
408KB
-
memory/4324-140-0x0000000006380000-0x00000000063D0000-memory.dmpFilesize
320KB
-
memory/4324-141-0x0000000006FD0000-0x0000000007192000-memory.dmpFilesize
1.8MB
-
memory/4324-142-0x00000000076D0000-0x0000000007BFC000-memory.dmpFilesize
5.2MB