Analysis
-
max time kernel
91s -
max time network
127s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
10-06-2022 16:33
Behavioral task
behavioral1
Sample
308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exe
Resource
win7-20220414-en
General
-
Target
308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exe
-
Size
106KB
-
MD5
a46648b2dd6e96562b144ae36956f123
-
SHA1
caa5d0f31b1dcc21e2267a2b240d35e1c7ce769a
-
SHA256
308fcf160e8a3e3956eae1a8a2285d06813dd879104601e884b5af4c960ca82a
-
SHA512
311fd32bd11758d72be1324666bc8e504682e48095698cef6d65ced0422a53f636fbf4cb66348f37e945fb043cf590a57b368a64d9516e47bb04b1a53e56ec52
Malware Config
Extracted
redline
10
179.43.154.136:6001
-
auth_value
d695bfb18b65b93b53b6583424227f3c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/2756-130-0x0000000000710000-0x0000000000730000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exepid process 2756 308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exedescription pid process Token: SeDebugPrivilege 2756 308FCF160E8A3E3956EAE1A8A2285D06813DD87910460.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2756-130-0x0000000000710000-0x0000000000730000-memory.dmpFilesize
128KB
-
memory/2756-131-0x0000000005670000-0x0000000005C88000-memory.dmpFilesize
6.1MB
-
memory/2756-132-0x0000000005090000-0x00000000050A2000-memory.dmpFilesize
72KB
-
memory/2756-133-0x00000000051C0000-0x00000000052CA000-memory.dmpFilesize
1.0MB
-
memory/2756-134-0x00000000050F0000-0x000000000512C000-memory.dmpFilesize
240KB
-
memory/2756-135-0x0000000006240000-0x00000000067E4000-memory.dmpFilesize
5.6MB
-
memory/2756-136-0x0000000005590000-0x0000000005622000-memory.dmpFilesize
584KB
-
memory/2756-137-0x0000000005C90000-0x0000000005CF6000-memory.dmpFilesize
408KB
-
memory/2756-138-0x0000000006090000-0x0000000006106000-memory.dmpFilesize
472KB
-
memory/2756-139-0x00000000061B0000-0x00000000061CE000-memory.dmpFilesize
120KB
-
memory/2756-140-0x0000000006AC0000-0x0000000006B10000-memory.dmpFilesize
320KB
-
memory/2756-141-0x0000000007AA0000-0x0000000007C62000-memory.dmpFilesize
1.8MB
-
memory/2756-142-0x00000000081A0000-0x00000000086CC000-memory.dmpFilesize
5.2MB