Analysis
- max time kernel
143s - max time network
148s - platform
windows10-2004_x64 - resource
win10v2004-20230915-en - resource tags
- submitted
01/10/2023, 08:58
General
- Target asca1ex1234.exe
- Size 407KB
- Sample231001-kw59ysbc42
- SHA256 a744a3c6231d68eb30fd4ec1c1deb3830b13b36d3c4bae9ebf03c3d1380b0f79
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 1 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\asca1ex1234.exe"C:\Users\Admin\AppData\Local\Temp\asca1ex1234.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2528-0-0x0000000000400000-0x000000000046A000-memory.dmp
memory/2528-1-0x00000000008E0000-0x000000000093A000-memory.dmp
memory/2528-5-0x00000000744C0000-0x0000000074C70000-memory.dmp
memory/2528-6-0x0000000006FD0000-0x0000000007574000-memory.dmp
memory/2528-7-0x00000000075C0000-0x0000000007652000-memory.dmp
memory/2528-8-0x0000000007730000-0x0000000007740000-memory.dmp
memory/2528-9-0x00000000076D0000-0x00000000076DA000-memory.dmp
memory/2528-10-0x0000000007C20000-0x0000000008238000-memory.dmp
memory/2528-11-0x00000000078A0000-0x00000000078B2000-memory.dmp
memory/2528-12-0x00000000078C0000-0x00000000079CA000-memory.dmp
memory/2528-13-0x00000000079D0000-0x0000000007A0C000-memory.dmp
memory/2528-14-0x0000000007A50000-0x0000000007A9C000-memory.dmp
memory/2528-15-0x0000000008240000-0x00000000082A6000-memory.dmp
memory/2528-16-0x0000000008A00000-0x0000000008A76000-memory.dmp
memory/2528-17-0x0000000008AE0000-0x0000000008CA2000-memory.dmp
memory/2528-18-0x0000000008CB0000-0x00000000091DC000-memory.dmp
memory/2528-19-0x00000000092E0000-0x00000000092FE000-memory.dmp
memory/2528-20-0x00000000024B0000-0x0000000002500000-memory.dmp
memory/2528-23-0x0000000000400000-0x000000000046A000-memory.dmp
memory/2528-24-0x00000000744C0000-0x0000000074C70000-memory.dmp