Analysis
- max time kernel
91s - max time network
128s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
- submitted
08/12/2022, 22:30
General
- Target a5c8a40f7c15619dd13a2532c4ba3caf.exe
- Size 515KB
- Sample221208-2etchabg48
- SHA256 47882cbac974961e1e003b60646d60f2c0316acf405c40707dc2abbdcbcb8805
Malware Config
Extracted
-
redline
-
new08
-
45.15.156.26:30270
-
auth_value
814683e92a6a66a1270e3657a64bf175
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5c8a40f7c15619dd13a2532c4ba3caf.exe"C:\Users\Admin\AppData\Local\Temp\a5c8a40f7c15619dd13a2532c4ba3caf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\a5c8a40f7c15619dd13a2532c4ba3caf.exeC:\Users\Admin\AppData\Local\Temp\a5c8a40f7c15619dd13a2532c4ba3caf.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
a5c8a40f7c15619dd13a2532c4ba3caf.exe.log
memory/4260-144-0x0000000006D00000-0x0000000006EC2000-memory.dmp
memory/4260-143-0x0000000005FD0000-0x0000000006036000-memory.dmp
memory/4260-146-0x0000000006C80000-0x0000000006CD0000-memory.dmp
memory/4260-145-0x0000000007400000-0x000000000792C000-memory.dmp
memory/4260-138-0x0000000000400000-0x0000000000432000-memory.dmp
memory/4260-140-0x00000000054E0000-0x00000000055EA000-memory.dmp
memory/4260-141-0x0000000005420000-0x0000000005432000-memory.dmp
memory/4260-139-0x00000000059B0000-0x0000000005FC8000-memory.dmp
memory/4260-142-0x0000000005480000-0x00000000054BC000-memory.dmp
memory/4876-134-0x0000000007120000-0x00000000071B2000-memory.dmp
memory/4876-132-0x0000000000080000-0x0000000000108000-memory.dmp
memory/4876-136-0x00000000070B0000-0x00000000070CE000-memory.dmp
memory/4876-135-0x00000000073C0000-0x0000000007436000-memory.dmp
memory/4876-133-0x0000000007630000-0x0000000007BD4000-memory.dmp