Analysis
-
max time kernel
53s -
max time network
71s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
14-05-2022 20:35
Static task
static1
General
-
Target
35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exe
-
Size
369KB
-
MD5
5c3b80f727dfc29bc2b7c0533884af69
-
SHA1
3569ccfee5903f5f8fc5033c2edddfdae8c2843b
-
SHA256
35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d
-
SHA512
39b2b370c566ff3ea97bd6864d05ec4ee83e94db337c4b557657768573ac3344a4b159be1b0f34bf80b55662b12d006e146c369f296f7b93255d9b2e70ded339
Malware Config
Extracted
redline
51
193.106.191.182:23196
-
auth_value
21351f5b8358ade7446b0c10ec81735e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exepid process 1568 35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exe 1568 35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exedescription pid process Token: SeDebugPrivilege 1568 35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exe"C:\Users\Admin\AppData\Local\Temp\35c48bad902f444bdf1514015ab33d309a525a5375fa44f2a6026b4379632b5d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1568-117-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-118-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-119-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-120-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-121-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-122-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-123-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-124-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-125-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-126-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-127-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-128-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-129-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-130-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-131-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-132-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-133-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-134-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-135-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-136-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-137-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-138-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-139-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-140-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-141-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-142-0x00000000008D9000-0x0000000000903000-memory.dmpFilesize
168KB
-
memory/1568-143-0x0000000000840000-0x0000000000877000-memory.dmpFilesize
220KB
-
memory/1568-144-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-145-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-146-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-147-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-148-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-149-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-150-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-151-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-153-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-152-0x0000000000400000-0x00000000004F1000-memory.dmpFilesize
964KB
-
memory/1568-154-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-155-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-156-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-157-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-158-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-159-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-160-0x0000000000CE0000-0x0000000000D10000-memory.dmpFilesize
192KB
-
memory/1568-161-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-162-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-163-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-164-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-165-0x0000000004C90000-0x000000000518E000-memory.dmpFilesize
5.0MB
-
memory/1568-166-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-167-0x00000000023B0000-0x00000000023DE000-memory.dmpFilesize
184KB
-
memory/1568-168-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-169-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-170-0x0000000005190000-0x0000000005796000-memory.dmpFilesize
6.0MB
-
memory/1568-171-0x0000000002800000-0x0000000002812000-memory.dmpFilesize
72KB
-
memory/1568-172-0x0000000002820000-0x000000000292A000-memory.dmpFilesize
1.0MB
-
memory/1568-173-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-174-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-175-0x00000000057A0000-0x00000000057DE000-memory.dmpFilesize
248KB
-
memory/1568-176-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-177-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-178-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-179-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-180-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-181-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-182-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-183-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-184-0x0000000005810000-0x000000000585B000-memory.dmpFilesize
300KB
-
memory/1568-185-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-186-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-187-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-188-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-189-0x0000000005AA0000-0x0000000005B06000-memory.dmpFilesize
408KB
-
memory/1568-190-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-191-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-192-0x00000000775D0000-0x000000007775E000-memory.dmpFilesize
1.6MB
-
memory/1568-197-0x0000000006160000-0x00000000061D6000-memory.dmpFilesize
472KB
-
memory/1568-198-0x0000000006200000-0x0000000006292000-memory.dmpFilesize
584KB
-
memory/1568-201-0x0000000006300000-0x000000000631E000-memory.dmpFilesize
120KB
-
memory/1568-202-0x0000000006530000-0x00000000066F2000-memory.dmpFilesize
1.8MB
-
memory/1568-203-0x0000000006700000-0x0000000006C2C000-memory.dmpFilesize
5.2MB