Analysis
-
max time kernel
44s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
23-05-2022 13:02
Static task
static1
Behavioral task
behavioral1
Sample
bca2e6292b5ed2ca4360347f96803d43.exe
Resource
win7-20220414-en
General
-
Target
bca2e6292b5ed2ca4360347f96803d43.exe
-
Size
383KB
-
MD5
bca2e6292b5ed2ca4360347f96803d43
-
SHA1
33ff78733149fb69f08c93dc415807f01c729af7
-
SHA256
11f864b4614cb3265b353220873deb49b07153a9d7547de3b15c2e95742a7798
-
SHA512
2736a409834fa1239eda8a504b12f407a099b4f7e05f45be68ddf7d7ab94d5d78125e998ef76ef0d7a732c58727bcd1fc55b3284bcd533d8bf1c1aace3a91bfa
Malware Config
Extracted
redline
top
185.215.113.75:81
-
auth_value
ff6259bc2baf33b54b454aad484fb0ee
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bca2e6292b5ed2ca4360347f96803d43.exepid process 1972 bca2e6292b5ed2ca4360347f96803d43.exe 1972 bca2e6292b5ed2ca4360347f96803d43.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bca2e6292b5ed2ca4360347f96803d43.exedescription pid process Token: SeDebugPrivilege 1972 bca2e6292b5ed2ca4360347f96803d43.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1972-54-0x00000000005B8000-0x00000000005E2000-memory.dmpFilesize
168KB
-
memory/1972-55-0x0000000001EF0000-0x0000000001F20000-memory.dmpFilesize
192KB
-
memory/1972-56-0x0000000001F20000-0x0000000001F4E000-memory.dmpFilesize
184KB
-
memory/1972-57-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1972-58-0x00000000005B8000-0x00000000005E2000-memory.dmpFilesize
168KB
-
memory/1972-59-0x0000000000220000-0x0000000000257000-memory.dmpFilesize
220KB
-
memory/1972-60-0x0000000000400000-0x00000000004A5000-memory.dmpFilesize
660KB