Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
11-02-2022 07:14
General
-
Target
a3b4e3fd8555d92a91de7ea794bcdc801fac630af22e7fee1f9927af0c3ec625.exe
-
Size
327KB
-
MD5
b623e3467a36eaec79f0f42ed24bd412
-
SHA1
76813a9b9fb1baf8d9b271b34aae423f443ed700
-
SHA256
a3b4e3fd8555d92a91de7ea794bcdc801fac630af22e7fee1f9927af0c3ec625
-
SHA512
e04043cb3957fded31295b2129564d36613dcc674a21af09714e42bd255259f63600acb0c5b481592d4b13d30cb2fa9c3aff961e8e077df1fe5cf3e1cf15e756
Malware Config
Extracted
redline
noname
185.215.113.29:20819
-
auth_value
ee92d883673b7156fdd66cac5fc8d2d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a3b4e3fd8555d92a91de7ea794bcdc801fac630af22e7fee1f9927af0c3ec625.exe"C:\Users\Admin\AppData\Local\Temp\a3b4e3fd8555d92a91de7ea794bcdc801fac630af22e7fee1f9927af0c3ec625.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2068-114-0x00000000006BA000-0x00000000006E6000-memory.dmpFilesize
176KB
-
memory/2068-115-0x00000000006BA000-0x00000000006E6000-memory.dmpFilesize
176KB
-
memory/2068-116-0x00000000005D0000-0x0000000000609000-memory.dmpFilesize
228KB
-
memory/2068-117-0x0000000000400000-0x000000000043C000-memory.dmpFilesize
240KB
-
memory/2068-118-0x00000000738DE000-0x00000000738DF000-memory.dmpFilesize
4KB
-
memory/2068-119-0x00000000024E0000-0x0000000002514000-memory.dmpFilesize
208KB
-
memory/2068-120-0x0000000004BF0000-0x00000000050EE000-memory.dmpFilesize
5.0MB
-
memory/2068-121-0x0000000002580000-0x00000000025B2000-memory.dmpFilesize
200KB
-
memory/2068-122-0x00000000050F0000-0x00000000056F6000-memory.dmpFilesize
6.0MB
-
memory/2068-123-0x0000000005700000-0x0000000005712000-memory.dmpFilesize
72KB
-
memory/2068-125-0x0000000002552000-0x0000000002553000-memory.dmpFilesize
4KB
-
memory/2068-124-0x0000000002550000-0x0000000002551000-memory.dmpFilesize
4KB
-
memory/2068-127-0x0000000005720000-0x000000000582A000-memory.dmpFilesize
1.0MB
-
memory/2068-126-0x0000000002553000-0x0000000002554000-memory.dmpFilesize
4KB
-
memory/2068-128-0x0000000005870000-0x00000000058AE000-memory.dmpFilesize
248KB
-
memory/2068-129-0x00000000058C0000-0x000000000590B000-memory.dmpFilesize
300KB
-
memory/2068-130-0x0000000002554000-0x0000000002556000-memory.dmpFilesize
8KB
-
memory/2068-131-0x0000000005B60000-0x0000000005BD6000-memory.dmpFilesize
472KB
-
memory/2068-132-0x0000000005BE0000-0x0000000005C72000-memory.dmpFilesize
584KB
-
memory/2068-133-0x0000000005DC0000-0x0000000005DDE000-memory.dmpFilesize
120KB
-
memory/2068-134-0x0000000005E40000-0x0000000005EA6000-memory.dmpFilesize
408KB
-
memory/2068-135-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/2068-136-0x0000000006760000-0x0000000006C8C000-memory.dmpFilesize
5.2MB