Analysis
-
max time kernel
46s -
max time network
50s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
13-09-2022 17:47
Static task
static1
Behavioral task
behavioral1
Sample
bb97a5fc62eb5dc111ca0b7136575d79.exe
Resource
win7-20220901-en
General
-
Target
bb97a5fc62eb5dc111ca0b7136575d79.exe
-
Size
214KB
-
MD5
bb97a5fc62eb5dc111ca0b7136575d79
-
SHA1
44e4046e45b7a3b01bf21b8b309a019123108a78
-
SHA256
f91b0471d5a12bbf49fbf1da1278cb57810d472e93a3f201e4cdc5f2040cca09
-
SHA512
c427975760d2f22f1886edb8acfcf3168ad607e0e8ec60b181de47113321cef4542b24bbc03ce434c529b540e3b3d6f679fc48a5f1245e98a216b9eb340ae4c2
-
SSDEEP
3072:QKyoWw9CEqQYhBjzmPY9Eo0LuP8GcaLdibSgUzwJxjqsChsq9iBo0ZXt9:QBjzmPY9j0TbTUcJVqsCeq9iBoCXt9
Malware Config
Extracted
redline
sep10as1
185.215.113.122:15386
-
auth_value
e45012eae57b2e57b34752fc802550c3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 7 IoCs
Processes:
resource yara_rule behavioral1/memory/1220-58-0x0000000000070000-0x0000000000098000-memory.dmp family_redline behavioral1/memory/1220-59-0x0000000000070000-0x0000000000098000-memory.dmp family_redline behavioral1/memory/1220-60-0x0000000000070000-0x0000000000098000-memory.dmp family_redline behavioral1/memory/1220-61-0x0000000000092136-mapping.dmp family_redline behavioral1/memory/1220-63-0x0000000000070000-0x0000000000098000-memory.dmp family_redline behavioral1/memory/1220-67-0x0000000000070000-0x0000000000098000-memory.dmp family_redline behavioral1/memory/1220-70-0x0000000000070000-0x0000000000098000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bb97a5fc62eb5dc111ca0b7136575d79.exedescription pid process target process PID 1308 set thread context of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
bb97a5fc62eb5dc111ca0b7136575d79.exepid process 1220 bb97a5fc62eb5dc111ca0b7136575d79.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bb97a5fc62eb5dc111ca0b7136575d79.exedescription pid process Token: SeDebugPrivilege 1220 bb97a5fc62eb5dc111ca0b7136575d79.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
bb97a5fc62eb5dc111ca0b7136575d79.exedescription pid process target process PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe PID 1308 wrote to memory of 1220 1308 bb97a5fc62eb5dc111ca0b7136575d79.exe bb97a5fc62eb5dc111ca0b7136575d79.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bb97a5fc62eb5dc111ca0b7136575d79.exe"C:\Users\Admin\AppData\Local\Temp\bb97a5fc62eb5dc111ca0b7136575d79.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Users\Admin\AppData\Local\Temp\bb97a5fc62eb5dc111ca0b7136575d79.exe"C:\Users\Admin\AppData\Local\Temp\bb97a5fc62eb5dc111ca0b7136575d79.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1220
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1220-55-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-56-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-58-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-59-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-60-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-61-0x0000000000092136-mapping.dmp
-
memory/1220-63-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-67-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-70-0x0000000000070000-0x0000000000098000-memory.dmpFilesize
160KB
-
memory/1220-71-0x0000000074DA1000-0x0000000074DA3000-memory.dmpFilesize
8KB
-
memory/1308-54-0x00000000000D0000-0x000000000010A000-memory.dmpFilesize
232KB