Analysis
-
max time kernel
66s -
max time network
69s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
20-05-2022 17:52
Static task
static1
General
-
Target
6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exe
-
Size
384KB
-
MD5
8541ac7cf0202ddc53e9046d8f0c44f5
-
SHA1
4b814437cd710c67998bbf2d26c226f7de167423
-
SHA256
6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e
-
SHA512
14fafa794bcd1c4bfa7e25b0f418165711fb74dc8cb6d5bf2dc5dc4541d154d7d0fda2dfa81ac4c2c8642b5cd58f7dc554754a15ab41749b91734e1ea59e0ab1
Malware Config
Extracted
redline
test1
185.215.113.75:80
-
auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exepid process 3580 6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exedescription pid process Token: SeDebugPrivilege 3580 6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exe"C:\Users\Admin\AppData\Local\Temp\6e85a1535c9ce115199a7da32b0ba2f14a5e1d7d9df9bc606b091cc72407749e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3580-116-0x0000000002D5B000-0x0000000002D85000-memory.dmpFilesize
168KB
-
memory/3580-117-0x0000000004D10000-0x0000000004D40000-memory.dmpFilesize
192KB
-
memory/3580-118-0x0000000007340000-0x000000000783E000-memory.dmpFilesize
5.0MB
-
memory/3580-119-0x0000000002C20000-0x0000000002D6A000-memory.dmpFilesize
1.3MB
-
memory/3580-120-0x00000000048E0000-0x0000000004917000-memory.dmpFilesize
220KB
-
memory/3580-121-0x0000000007200000-0x000000000722E000-memory.dmpFilesize
184KB
-
memory/3580-122-0x0000000000400000-0x0000000002B7C000-memory.dmpFilesize
39.5MB
-
memory/3580-123-0x0000000007840000-0x0000000007E46000-memory.dmpFilesize
6.0MB
-
memory/3580-124-0x00000000072E0000-0x00000000072F2000-memory.dmpFilesize
72KB
-
memory/3580-125-0x0000000007E50000-0x0000000007F5A000-memory.dmpFilesize
1.0MB
-
memory/3580-126-0x0000000007F60000-0x0000000007F9E000-memory.dmpFilesize
248KB
-
memory/3580-127-0x0000000007FD0000-0x000000000801B000-memory.dmpFilesize
300KB
-
memory/3580-128-0x0000000008D30000-0x0000000008DA6000-memory.dmpFilesize
472KB
-
memory/3580-129-0x0000000008DC0000-0x0000000008E52000-memory.dmpFilesize
584KB
-
memory/3580-130-0x0000000008E90000-0x0000000008EAE000-memory.dmpFilesize
120KB
-
memory/3580-131-0x0000000009060000-0x00000000090C6000-memory.dmpFilesize
408KB
-
memory/3580-132-0x00000000094D0000-0x0000000009692000-memory.dmpFilesize
1.8MB
-
memory/3580-133-0x00000000096A0000-0x0000000009BCC000-memory.dmpFilesize
5.2MB