Analysis
-
max time kernel
52s -
max time network
72s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
15-05-2022 16:21
Static task
static1
General
-
Target
d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exe
-
Size
347KB
-
MD5
0ac4fd484b5bda7667a6523dda0ebaa9
-
SHA1
90c99d6fec6bbc6f4b65b4204c58c9a995dda5db
-
SHA256
d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a
-
SHA512
08ae61b86c6efc76e542bb26a8fc2bde770644f2172be28673e35d67974a5e116e4ef73f868507f0d5c98f10d542850435466b324def3edd6c1beaa2612d39ad
Malware Config
Extracted
redline
51
193.106.191.182:23196
-
auth_value
21351f5b8358ade7446b0c10ec81735e
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exepid process 2236 d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exe 2236 d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exedescription pid process Token: SeDebugPrivilege 2236 d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exe"C:\Users\Admin\AppData\Local\Temp\d31545fc93b660bdfcd83ccf1cd5543b865021da5107e3a758b12f2196d9183a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2236-117-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-118-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-119-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-120-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-121-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-122-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-123-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-124-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-125-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-126-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-127-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-128-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-129-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-130-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-131-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-132-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-133-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-134-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-135-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-136-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-137-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-138-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-139-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-140-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-141-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-142-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-143-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-144-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-145-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-146-0x0000000002DAA000-0x0000000002DD4000-memory.dmpFilesize
168KB
-
memory/2236-148-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-147-0x0000000002C10000-0x0000000002D5A000-memory.dmpFilesize
1.3MB
-
memory/2236-149-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-150-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-151-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-153-0x0000000000400000-0x0000000002B73000-memory.dmpFilesize
39.4MB
-
memory/2236-152-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-154-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-155-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-156-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-157-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-158-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-159-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-160-0x0000000004880000-0x00000000048B0000-memory.dmpFilesize
192KB
-
memory/2236-161-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-162-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-163-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-164-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-165-0x0000000007170000-0x000000000766E000-memory.dmpFilesize
5.0MB
-
memory/2236-166-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-167-0x0000000004BD0000-0x0000000004BFE000-memory.dmpFilesize
184KB
-
memory/2236-168-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-169-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-170-0x0000000007670000-0x0000000007C76000-memory.dmpFilesize
6.0MB
-
memory/2236-171-0x0000000007CC0000-0x0000000007CD2000-memory.dmpFilesize
72KB
-
memory/2236-172-0x0000000007CF0000-0x0000000007DFA000-memory.dmpFilesize
1.0MB
-
memory/2236-173-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-174-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-175-0x0000000007E00000-0x0000000007E3E000-memory.dmpFilesize
248KB
-
memory/2236-176-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-177-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-178-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-179-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-180-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-181-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-182-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-183-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-185-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-184-0x0000000007E90000-0x0000000007EDB000-memory.dmpFilesize
300KB
-
memory/2236-186-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-187-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-188-0x0000000008120000-0x0000000008196000-memory.dmpFilesize
472KB
-
memory/2236-189-0x00000000081A0000-0x0000000008232000-memory.dmpFilesize
584KB
-
memory/2236-190-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-191-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-192-0x0000000008280000-0x000000000829E000-memory.dmpFilesize
120KB
-
memory/2236-193-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-194-0x0000000008440000-0x00000000084A6000-memory.dmpFilesize
408KB
-
memory/2236-195-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2236-202-0x0000000008C40000-0x0000000008E02000-memory.dmpFilesize
1.8MB
-
memory/2236-203-0x0000000008E20000-0x000000000934C000-memory.dmpFilesize
5.2MB