Analysis
- max time kernel
142s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20230703-en - resource tags
- submitted
07/08/2023, 13:16
General
- Target 383502698a6390c20245f616778358e4.exe
- Size 347KB
- Sample230807-qhsplafd62
- SHA256 89adc6d8ba1275e2de3434cd3c98382acb2a0dfe1b0f1eb5c802ac8a0bb6ba54
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\383502698a6390c20245f616778358e4.exe"C:\Users\Admin\AppData\Local\Temp\383502698a6390c20245f616778358e4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/3904-133-0x0000000000680000-0x00000000006DC000-memory.dmp
memory/3904-134-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/3904-135-0x0000000007AA0000-0x0000000008044000-memory.dmp
memory/3904-136-0x00000000075D0000-0x0000000007662000-memory.dmp
memory/3904-137-0x0000000007750000-0x0000000007760000-memory.dmp
memory/3904-138-0x00000000075B0000-0x00000000075BA000-memory.dmp
memory/3904-139-0x0000000008670000-0x0000000008C88000-memory.dmp
memory/3904-140-0x0000000007710000-0x0000000007722000-memory.dmp
memory/3904-141-0x0000000008050000-0x000000000815A000-memory.dmp
memory/3904-142-0x00000000077A0000-0x00000000077DC000-memory.dmp
memory/3904-143-0x0000000008160000-0x00000000081C6000-memory.dmp
memory/3904-144-0x0000000009C60000-0x0000000009CB0000-memory.dmp
memory/3904-145-0x0000000009D30000-0x0000000009DA6000-memory.dmp
memory/3904-146-0x000000000A080000-0x000000000A242000-memory.dmp
memory/3904-147-0x000000000A780000-0x000000000ACAC000-memory.dmp
memory/3904-148-0x0000000009FA0000-0x0000000009FBE000-memory.dmp
memory/3904-149-0x00000000743E0000-0x0000000074B90000-memory.dmp
memory/3904-151-0x00000000743E0000-0x0000000074B90000-memory.dmp