Analysis
-
max time kernel
53s -
max time network
56s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-05-2022 08:12
Static task
static1
General
-
Target
4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exe
-
Size
407KB
-
MD5
5689ccd3b873ad7eff2a5644e79cfd55
-
SHA1
2a32e9340c25aa87ff1bdf0667cb8f0d99a85da9
-
SHA256
4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077
-
SHA512
69ac3eafa60c81d55a0e0688aeca48d0d362edec827dc2bb9dcbec7e8d7e3ba49529983bd38305e917cbecdd7e85415d59ba3a9947574fa51f1637e8f637b48d
Malware Config
Extracted
redline
test1
185.215.113.75:80
-
auth_value
7ab4a4e2eae9eb7ae10f64f68df53bb3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exepid process 2356 4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exedescription pid process Token: SeDebugPrivilege 2356 4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exe"C:\Users\Admin\AppData\Local\Temp\4d1f6d0fc3f5bd80702a598d006547955b3ebbe05dabc44db2aeec50f9d5d077.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2356-118-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-119-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-120-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-121-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-122-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-123-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-124-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-126-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-127-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-128-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-129-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-130-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-131-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-132-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-133-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-134-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-135-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-136-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-137-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-138-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-139-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-140-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-142-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-143-0x0000000000710000-0x0000000000747000-memory.dmpFilesize
220KB
-
memory/2356-144-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-145-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-146-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-147-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-148-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-141-0x0000000000590000-0x00000000006DA000-memory.dmpFilesize
1.3MB
-
memory/2356-149-0x0000000000400000-0x00000000004A7000-memory.dmpFilesize
668KB
-
memory/2356-150-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-151-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-152-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-153-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-154-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-155-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-156-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-157-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-158-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-159-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-160-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-161-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-162-0x0000000002380000-0x00000000023B0000-memory.dmpFilesize
192KB
-
memory/2356-163-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-164-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-165-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-166-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-167-0x0000000004BF0000-0x00000000050EE000-memory.dmpFilesize
5.0MB
-
memory/2356-168-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-169-0x0000000002640000-0x000000000266E000-memory.dmpFilesize
184KB
-
memory/2356-170-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-171-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-172-0x00000000050F0000-0x00000000056F6000-memory.dmpFilesize
6.0MB
-
memory/2356-173-0x0000000005730000-0x0000000005742000-memory.dmpFilesize
72KB
-
memory/2356-174-0x0000000005760000-0x000000000586A000-memory.dmpFilesize
1.0MB
-
memory/2356-175-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-176-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-177-0x0000000005870000-0x00000000058AE000-memory.dmpFilesize
248KB
-
memory/2356-178-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-179-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-180-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-181-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-182-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-183-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-184-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-185-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-186-0x0000000005900000-0x000000000594B000-memory.dmpFilesize
300KB
-
memory/2356-187-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-188-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-189-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-190-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-191-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-192-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-193-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-210-0x0000000006680000-0x00000000066E6000-memory.dmpFilesize
408KB
-
memory/2356-218-0x00000000069A0000-0x0000000006A16000-memory.dmpFilesize
472KB
-
memory/2356-219-0x0000000006A80000-0x0000000006B12000-memory.dmpFilesize
584KB
-
memory/2356-222-0x0000000006B60000-0x0000000006B7E000-memory.dmpFilesize
120KB
-
memory/2356-223-0x0000000006E90000-0x0000000007052000-memory.dmpFilesize
1.8MB
-
memory/2356-224-0x0000000007060000-0x000000000758C000-memory.dmpFilesize
5.2MB