Analysis
-
max time kernel
51s -
max time network
67s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-05-2022 14:01
Static task
static1
General
-
Target
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2.exe
-
Size
415KB
-
MD5
fd0aa3448c0a9b3c3bcbcd5cb48df998
-
SHA1
f5ef12524403bea2b36c6d62604d6cdb64debc42
-
SHA256
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2
-
SHA512
552f7ed23eaa1fc7de0b4fc8080720d80806c68c5e0399f152576b4b1a1e9429ab81aef8b70fead4baf6ebf1cadb6a0b7f8c2340a0db08f8ab36349659fc8ab6
Malware Config
Extracted
redline
Ruzki
193.233.48.58:38989
-
auth_value
80c38cc7772c328c028b0e4f42a3fac6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3216-120-0x00000000023F0000-0x0000000002424000-memory.dmp family_redline behavioral1/memory/3216-122-0x0000000002620000-0x0000000002654000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2.exedescription pid process Token: SeDebugPrivilege 3216 638d41f2284bfc2b6197276dbfae09c638a42cbb5150c4d7c117a83cda2d81d2.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3216-117-0x0000000000861000-0x000000000088D000-memory.dmpFilesize
176KB
-
memory/3216-118-0x0000000000610000-0x0000000000649000-memory.dmpFilesize
228KB
-
memory/3216-119-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3216-120-0x00000000023F0000-0x0000000002424000-memory.dmpFilesize
208KB
-
memory/3216-121-0x0000000004C50000-0x000000000514E000-memory.dmpFilesize
5.0MB
-
memory/3216-122-0x0000000002620000-0x0000000002654000-memory.dmpFilesize
208KB
-
memory/3216-123-0x0000000005150000-0x0000000005756000-memory.dmpFilesize
6.0MB
-
memory/3216-124-0x0000000005760000-0x0000000005772000-memory.dmpFilesize
72KB
-
memory/3216-125-0x0000000005780000-0x000000000588A000-memory.dmpFilesize
1.0MB
-
memory/3216-126-0x00000000058B0000-0x00000000058EE000-memory.dmpFilesize
248KB
-
memory/3216-127-0x0000000005910000-0x000000000595B000-memory.dmpFilesize
300KB
-
memory/3216-128-0x0000000005BB0000-0x0000000005C16000-memory.dmpFilesize
408KB
-
memory/3216-129-0x0000000006250000-0x00000000062C6000-memory.dmpFilesize
472KB
-
memory/3216-130-0x0000000006310000-0x00000000063A2000-memory.dmpFilesize
584KB
-
memory/3216-131-0x0000000006410000-0x000000000642E000-memory.dmpFilesize
120KB
-
memory/3216-132-0x0000000006640000-0x0000000006802000-memory.dmpFilesize
1.8MB
-
memory/3216-133-0x0000000006810000-0x0000000006D3C000-memory.dmpFilesize
5.2MB