Analysis
- max time kernel
142s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20231020-en - resource tags
- submitted
22/10/2023, 15:42
General
- Target SecuriteInfo.com.Trojan.PWS.RedLineNET.6.4539.8803.exe
- Size 496KB
- Sample231022-s5bqpscc82
- SHA256 117332feb820bbd8d10177720dae9736c7f62dd2fcc5b9518eed427f90af6524
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- RedLine payload 2 IoCs
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Suspicious behavior: EnumeratesProcesses 3 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.6.4539.8803.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.PWS.RedLineNET.6.4539.8803.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4996-0-0x0000000000400000-0x000000000047E000-memory.dmp
memory/4996-1-0x00000000006F0000-0x000000000074A000-memory.dmp
memory/4996-5-0x00000000752F0000-0x0000000075AA0000-memory.dmp
memory/4996-6-0x0000000007040000-0x00000000075E4000-memory.dmp
memory/4996-7-0x00000000075F0000-0x0000000007682000-memory.dmp
memory/4996-8-0x0000000007760000-0x0000000007770000-memory.dmp
memory/4996-9-0x0000000007720000-0x000000000772A000-memory.dmp
memory/4996-10-0x0000000008290000-0x00000000088A8000-memory.dmp
memory/4996-11-0x00000000078F0000-0x0000000007902000-memory.dmp
memory/4996-12-0x0000000007910000-0x0000000007A1A000-memory.dmp
memory/4996-13-0x0000000007A20000-0x0000000007A5C000-memory.dmp
memory/4996-14-0x0000000007AA0000-0x0000000007AEC000-memory.dmp
memory/4996-15-0x0000000007C70000-0x0000000007CD6000-memory.dmp
memory/4996-16-0x00000000081E0000-0x0000000008256000-memory.dmp
memory/4996-17-0x0000000008AE0000-0x0000000008CA2000-memory.dmp
memory/4996-18-0x0000000008CC0000-0x00000000091EC000-memory.dmp
memory/4996-19-0x00000000092F0000-0x000000000930E000-memory.dmp
memory/4996-22-0x0000000000400000-0x000000000047E000-memory.dmp
memory/4996-23-0x00000000752F0000-0x0000000075AA0000-memory.dmp