Analysis
-
max time kernel
46s -
max time network
20s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 21:33
Behavioral task
behavioral1
Sample
SomeOne.exe
Resource
win7-20240221-en
General
-
Target
SomeOne.exe
-
Size
297KB
-
MD5
336a39a3965dba11c37cb930c36a9d34
-
SHA1
36a66cd92beccb3c1433d6618da4b9aec4d5ae85
-
SHA256
11283eacf56982ad438e1060d9f11763c365f8ffedcf8e17f798b051f1a394db
-
SHA512
6f146427200216a012fb143cb4415b98023e88da54776a24c14cd13b229d754d8710fd52a32edfe32ef3bcfd72af0349bc1e665f750241e613fadcd3ac95e336
-
SSDEEP
3072:nqFFrqwIOGaHy9MGSwTc4klV4w5qv65TlacJTrcfHIicZqf7D34deqiOLCbBOy:qBIOGu4kcw5hlVJTrqzcZqf7DInL
Malware Config
Extracted
redline
SomeOne
67.203.7.148:2909
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2992-0-0x00000000001C0000-0x0000000000210000-memory.dmp family_redline behavioral1/memory/2992-2-0x00000000045E0000-0x0000000004620000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
SomeOne.exepid process 2992 SomeOne.exe 2992 SomeOne.exe 2992 SomeOne.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
SomeOne.exedescription pid process Token: SeDebugPrivilege 2992 SomeOne.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2992-0-0x00000000001C0000-0x0000000000210000-memory.dmpFilesize
320KB
-
memory/2992-1-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB
-
memory/2992-2-0x00000000045E0000-0x0000000004620000-memory.dmpFilesize
256KB
-
memory/2992-3-0x0000000074AD0000-0x00000000751BE000-memory.dmpFilesize
6.9MB