Analysis
-
max time kernel
55s -
max time network
57s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-05-2022 14:40
Static task
static1
General
-
Target
9c57f3c93142e0638e6cd548691aef43dd3c879456a240fb6dbe0949114d61ea.exe
-
Size
416KB
-
MD5
221f4ec8379708e984bcdec9b9c6ab80
-
SHA1
be6d6ab17a4deb02640edaad468603b4b813bf49
-
SHA256
9c57f3c93142e0638e6cd548691aef43dd3c879456a240fb6dbe0949114d61ea
-
SHA512
cf1cf51c57dee52d91fe30e3f7adebbdcc857266243bb1db50887ccb66b052a1b87add61547f338a1daa6269f67aea24d406fd99dcf7476967646f26fd00659d
Malware Config
Extracted
redline
Ruzki
193.233.48.58:38989
-
auth_value
80c38cc7772c328c028b0e4f42a3fac6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3248-117-0x0000000002480000-0x00000000024B4000-memory.dmp family_redline behavioral1/memory/3248-122-0x0000000002510000-0x0000000002544000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9c57f3c93142e0638e6cd548691aef43dd3c879456a240fb6dbe0949114d61ea.exedescription pid process Token: SeDebugPrivilege 3248 9c57f3c93142e0638e6cd548691aef43dd3c879456a240fb6dbe0949114d61ea.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3248-117-0x0000000002480000-0x00000000024B4000-memory.dmpFilesize
208KB
-
memory/3248-118-0x0000000000731000-0x000000000075D000-memory.dmpFilesize
176KB
-
memory/3248-119-0x00000000020C0000-0x00000000020F9000-memory.dmpFilesize
228KB
-
memory/3248-120-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3248-121-0x0000000004C90000-0x000000000518E000-memory.dmpFilesize
5.0MB
-
memory/3248-122-0x0000000002510000-0x0000000002544000-memory.dmpFilesize
208KB
-
memory/3248-123-0x0000000005190000-0x0000000005796000-memory.dmpFilesize
6.0MB
-
memory/3248-124-0x0000000004C30000-0x0000000004C42000-memory.dmpFilesize
72KB
-
memory/3248-125-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/3248-126-0x00000000058B0000-0x00000000058EE000-memory.dmpFilesize
248KB
-
memory/3248-127-0x0000000005A10000-0x0000000005A5B000-memory.dmpFilesize
300KB
-
memory/3248-128-0x0000000005BB0000-0x0000000005C26000-memory.dmpFilesize
472KB
-
memory/3248-129-0x0000000005CA0000-0x0000000005D32000-memory.dmpFilesize
584KB
-
memory/3248-130-0x0000000005C70000-0x0000000005C8E000-memory.dmpFilesize
120KB
-
memory/3248-131-0x0000000005E90000-0x0000000005EF6000-memory.dmpFilesize
408KB
-
memory/3248-132-0x00000000065E0000-0x00000000067A2000-memory.dmpFilesize
1.8MB
-
memory/3248-133-0x00000000067B0000-0x0000000006CDC000-memory.dmpFilesize
5.2MB