Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-05-2022 03:51
Static task
static1
General
-
Target
9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exe
-
Size
407KB
-
MD5
3ec10aabc7106231e8b806faf72acc0b
-
SHA1
5e879fff6a963e167e0aa30defb3fbd6dbb3ba5e
-
SHA256
9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e
-
SHA512
8c8740a6ef25366301ea675c8a8d75ec82a1218dbce77be44f1dd62a71296fb6153212b749afb1c382f798c14de437be98f969e567ca862a810321ead1e43799
Malware Config
Extracted
redline
test1
185.215.113.75:80
-
auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exepid process 2524 9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exedescription pid process Token: SeDebugPrivilege 2524 9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exe"C:\Users\Admin\AppData\Local\Temp\9b313dbcfebf4909fd1e84c77ee8ba1e761454c684dc349fdc62620ad39b2d0e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2524-117-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-118-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-119-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-120-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-121-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-122-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-123-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-125-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-126-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-127-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-128-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-129-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-130-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-131-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-132-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-133-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-134-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-135-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-136-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-138-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-139-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-137-0x0000000000570000-0x00000000006BA000-memory.dmpFilesize
1.3MB
-
memory/2524-140-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-141-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-142-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-143-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-144-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-145-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-146-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/2524-147-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-148-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-149-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-150-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-151-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-152-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-153-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-154-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-155-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-156-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-157-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-158-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-159-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-160-0x0000000002360000-0x0000000002390000-memory.dmpFilesize
192KB
-
memory/2524-161-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-162-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-163-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-164-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-165-0x0000000004C50000-0x000000000514E000-memory.dmpFilesize
5.0MB
-
memory/2524-166-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-167-0x0000000002700000-0x000000000272E000-memory.dmpFilesize
184KB
-
memory/2524-168-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-169-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-170-0x0000000005150000-0x0000000005756000-memory.dmpFilesize
6.0MB
-
memory/2524-171-0x00000000028C0000-0x00000000028D2000-memory.dmpFilesize
72KB
-
memory/2524-172-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2524-173-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-174-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-175-0x0000000005870000-0x00000000058AE000-memory.dmpFilesize
248KB
-
memory/2524-176-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-177-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-178-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-179-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-180-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-181-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-182-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-183-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-184-0x0000000005B80000-0x0000000005BCB000-memory.dmpFilesize
300KB
-
memory/2524-185-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-186-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-187-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-188-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-189-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-190-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-191-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2524-208-0x0000000006530000-0x0000000006596000-memory.dmpFilesize
408KB
-
memory/2524-216-0x0000000006870000-0x00000000068E6000-memory.dmpFilesize
472KB
-
memory/2524-217-0x0000000006920000-0x00000000069B2000-memory.dmpFilesize
584KB
-
memory/2524-220-0x0000000006A10000-0x0000000006A2E000-memory.dmpFilesize
120KB
-
memory/2524-221-0x0000000006C50000-0x0000000006E12000-memory.dmpFilesize
1.8MB
-
memory/2524-222-0x0000000006E20000-0x000000000734C000-memory.dmpFilesize
5.2MB