Analysis
-
max time kernel
311s -
max time network
319s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
11-05-2022 22:21
Static task
static1
Behavioral task
behavioral1
Sample
2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exe
Resource
win7-20220414-en
General
-
Target
2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exe
-
Size
399KB
-
MD5
b39816bc106dc09aba8a1341d83bfe29
-
SHA1
8ec230bf2515b9a79c0e8c06053cdb75d40e09ee
-
SHA256
2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22
-
SHA512
8d540901ff1fb7db8cb9a2b6eb172df7a4e24270b508bd53e83c7d17c67458142848f98c555288d2203fd84b1ce30324bde1bb06bf3cfdce1c4c5b660b594eba
Malware Config
Extracted
redline
2
51.89.204.186:36124
-
auth_value
aa046d0ca32fcb8538726e938e3bd00c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/2388-162-0x0000000002350000-0x0000000002384000-memory.dmp family_redline behavioral2/memory/2388-169-0x0000000002850000-0x0000000002884000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exepid process 2388 2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exedescription pid process Token: SeDebugPrivilege 2388 2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exe"C:\Users\Admin\AppData\Local\Temp\2bcc9ed563669f8007cec75c3fe6cd79fa0425cd781da80e0241557c2806de22.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2388-118-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-119-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-120-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-121-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-122-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-123-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-124-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-125-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-126-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-127-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-128-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-129-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-130-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-131-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-132-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-133-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-134-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-135-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-136-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-137-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-138-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-139-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-140-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-142-0x0000000000500000-0x00000000005AE000-memory.dmpFilesize
696KB
-
memory/2388-143-0x0000000000660000-0x000000000069A000-memory.dmpFilesize
232KB
-
memory/2388-144-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-145-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-146-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-147-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-148-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-149-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-150-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-151-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-152-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-153-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-154-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-155-0x0000000000400000-0x00000000004F8000-memory.dmpFilesize
992KB
-
memory/2388-156-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-157-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-158-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-160-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-159-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-161-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-162-0x0000000002350000-0x0000000002384000-memory.dmpFilesize
208KB
-
memory/2388-163-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-164-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-165-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-166-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-167-0x0000000004CC0000-0x00000000051BE000-memory.dmpFilesize
5.0MB
-
memory/2388-168-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-169-0x0000000002850000-0x0000000002884000-memory.dmpFilesize
208KB
-
memory/2388-170-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-171-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-172-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-173-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-174-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-175-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-176-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-177-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-178-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-179-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-180-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-181-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-182-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-183-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-184-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-185-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-186-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-187-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-188-0x0000000005840000-0x0000000005E46000-memory.dmpFilesize
6.0MB
-
memory/2388-189-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/2388-190-0x0000000007560000-0x0000000007572000-memory.dmpFilesize
72KB
-
memory/2388-192-0x00000000075C0000-0x00000000076CA000-memory.dmpFilesize
1.0MB
-
memory/2388-200-0x00000000077A0000-0x00000000077DE000-memory.dmpFilesize
248KB
-
memory/2388-202-0x0000000007800000-0x000000000784B000-memory.dmpFilesize
300KB
-
memory/2388-206-0x0000000008200000-0x0000000008276000-memory.dmpFilesize
472KB
-
memory/2388-207-0x00000000082F0000-0x0000000008382000-memory.dmpFilesize
584KB
-
memory/2388-209-0x00000000082C0000-0x00000000082DE000-memory.dmpFilesize
120KB
-
memory/2388-211-0x0000000008510000-0x0000000008576000-memory.dmpFilesize
408KB
-
memory/2388-219-0x00000000090C0000-0x0000000009282000-memory.dmpFilesize
1.8MB
-
memory/2388-220-0x0000000009290000-0x00000000097BC000-memory.dmpFilesize
5.2MB
-
memory/2388-223-0x00000000098C0000-0x0000000009910000-memory.dmpFilesize
320KB