Analysis
-
max time kernel
54s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-05-2022 02:12
Static task
static1
General
-
Target
e7a690dae9484e6f3cf049e4d09f4a22c98ff9eaa2fd7f363630907ed56f00ce.exe
-
Size
414KB
-
MD5
a2e8bed72837f55df3881ee10030eb13
-
SHA1
9f44c98157fb1fa6f3d88cbda5361c6faa24df39
-
SHA256
e7a690dae9484e6f3cf049e4d09f4a22c98ff9eaa2fd7f363630907ed56f00ce
-
SHA512
bd83a3da9805376d8a3c8d54fbe053ff452e398a965e8e20dc9963fbb9a15d065f5428d5ad37cab4a48b0b583a7d60f3779946395761b4404efef86f08ab534e
Malware Config
Extracted
redline
Ruzki
193.233.48.58:38989
-
auth_value
80c38cc7772c328c028b0e4f42a3fac6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/1728-120-0x0000000002260000-0x0000000002294000-memory.dmp family_redline behavioral1/memory/1728-125-0x00000000025D0000-0x0000000002604000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e7a690dae9484e6f3cf049e4d09f4a22c98ff9eaa2fd7f363630907ed56f00ce.exedescription pid process Token: SeDebugPrivilege 1728 e7a690dae9484e6f3cf049e4d09f4a22c98ff9eaa2fd7f363630907ed56f00ce.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1728-120-0x0000000002260000-0x0000000002294000-memory.dmpFilesize
208KB
-
memory/1728-121-0x00000000004B0000-0x000000000055E000-memory.dmpFilesize
696KB
-
memory/1728-122-0x00000000020D0000-0x0000000002109000-memory.dmpFilesize
228KB
-
memory/1728-123-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/1728-124-0x0000000004DB0000-0x00000000052AE000-memory.dmpFilesize
5.0MB
-
memory/1728-125-0x00000000025D0000-0x0000000002604000-memory.dmpFilesize
208KB
-
memory/1728-126-0x00000000052B0000-0x00000000058B6000-memory.dmpFilesize
6.0MB
-
memory/1728-127-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/1728-128-0x0000000004C60000-0x0000000004D6A000-memory.dmpFilesize
1.0MB
-
memory/1728-129-0x00000000058C0000-0x00000000058FE000-memory.dmpFilesize
248KB
-
memory/1728-130-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/1728-131-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/1728-132-0x0000000006250000-0x00000000062C6000-memory.dmpFilesize
472KB
-
memory/1728-133-0x0000000006310000-0x00000000063A2000-memory.dmpFilesize
584KB
-
memory/1728-134-0x0000000006520000-0x000000000653E000-memory.dmpFilesize
120KB
-
memory/1728-135-0x0000000006640000-0x0000000006802000-memory.dmpFilesize
1.8MB
-
memory/1728-136-0x0000000006810000-0x0000000006D3C000-memory.dmpFilesize
5.2MB