Analysis
-
max time kernel
49s -
max time network
61s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
21-05-2022 16:00
Static task
static1
General
-
Target
ea33e7b1f13909c73a8add54ba33518350bae327ed50f86b7206c58ab3932501.exe
-
Size
416KB
-
MD5
5c1d76890d095ce1450a1402db13bdb9
-
SHA1
641b5a9c79af3c03d9281ed4ced1643106279e1d
-
SHA256
ea33e7b1f13909c73a8add54ba33518350bae327ed50f86b7206c58ab3932501
-
SHA512
a648da778a0fa6639e357be949329234e62d4f36acb40b7894c6cf0261ef6045fbb3b7ef266b2ed2964a4d2af751558c439f1b8ed95c8bf9d3611beab2b63787
Malware Config
Extracted
redline
Ruzki
193.233.48.58:38989
-
auth_value
80c38cc7772c328c028b0e4f42a3fac6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3676-161-0x0000000002360000-0x0000000002394000-memory.dmp family_redline behavioral1/memory/3676-168-0x00000000049F0000-0x0000000004A24000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ea33e7b1f13909c73a8add54ba33518350bae327ed50f86b7206c58ab3932501.exedescription pid process Token: SeDebugPrivilege 3676 ea33e7b1f13909c73a8add54ba33518350bae327ed50f86b7206c58ab3932501.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3676-117-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-118-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-119-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-120-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-121-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-122-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-123-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-125-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-126-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-127-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-128-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-129-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-130-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-131-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-132-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-133-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-134-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-135-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-136-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-137-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-139-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-138-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-140-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-141-0x00000000004B0000-0x00000000005FA000-memory.dmpFilesize
1.3MB
-
memory/3676-142-0x00000000004B0000-0x000000000055E000-memory.dmpFilesize
696KB
-
memory/3676-143-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-144-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-145-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-146-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-147-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-148-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-149-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-150-0x0000000000400000-0x00000000004A9000-memory.dmpFilesize
676KB
-
memory/3676-151-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-152-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-153-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-154-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-155-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-156-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-157-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-158-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-159-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-160-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-161-0x0000000002360000-0x0000000002394000-memory.dmpFilesize
208KB
-
memory/3676-162-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-163-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-164-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-165-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-166-0x0000000004A80000-0x0000000004F7E000-memory.dmpFilesize
5.0MB
-
memory/3676-167-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-168-0x00000000049F0000-0x0000000004A24000-memory.dmpFilesize
208KB
-
memory/3676-169-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-170-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-171-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-172-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-173-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-174-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-175-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-176-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-177-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-178-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-179-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-180-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-181-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-182-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-183-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-184-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-185-0x0000000004F80000-0x0000000005586000-memory.dmpFilesize
6.0MB
-
memory/3676-186-0x0000000005610000-0x0000000005622000-memory.dmpFilesize
72KB
-
memory/3676-187-0x0000000005640000-0x000000000574A000-memory.dmpFilesize
1.0MB
-
memory/3676-188-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-189-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-190-0x0000000005770000-0x00000000057AE000-memory.dmpFilesize
248KB
-
memory/3676-191-0x0000000077000000-0x000000007718E000-memory.dmpFilesize
1.6MB
-
memory/3676-192-0x00000000057D0000-0x000000000581B000-memory.dmpFilesize
300KB
-
memory/3676-197-0x0000000005A70000-0x0000000005AD6000-memory.dmpFilesize
408KB
-
memory/3676-205-0x0000000006110000-0x0000000006186000-memory.dmpFilesize
472KB
-
memory/3676-206-0x00000000061D0000-0x0000000006262000-memory.dmpFilesize
584KB
-
memory/3676-209-0x00000000062D0000-0x00000000062EE000-memory.dmpFilesize
120KB
-
memory/3676-210-0x0000000006500000-0x00000000066C2000-memory.dmpFilesize
1.8MB
-
memory/3676-211-0x00000000066D0000-0x0000000006BFC000-memory.dmpFilesize
5.2MB