Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
26-05-2022 12:45
Static task
static1
General
-
Target
d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exe
-
Size
291KB
-
MD5
f5235ad54325f1eac5b4845bfeda104d
-
SHA1
9dd19514fc91331e7a77e86ed4e23d8e311758cb
-
SHA256
d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7
-
SHA512
8fb2be6202846c2a1f53ce8b54555298e262b8161619a66520adf0a8e714243fe9ee880620f07adbc7eadcbf22bb2c405c268e49e21ee8798b6e1b7cfbacd607
Malware Config
Extracted
redline
top
185.215.113.75:81
-
auth_value
ff6259bc2baf33b54b454aad484fb0ee
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exepid process 3064 d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exe 3064 d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exedescription pid process Token: SeDebugPrivilege 3064 d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exe"C:\Users\Admin\AppData\Local\Temp\d315efdd07dada247ff5a33f95fc74e0f1503f0a4bdbc5fed5ddbd040cd3eaa7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3064-117-0x00000000005FA000-0x0000000000623000-memory.dmpFilesize
164KB
-
memory/3064-118-0x0000000002310000-0x0000000002340000-memory.dmpFilesize
192KB
-
memory/3064-119-0x0000000004C00000-0x00000000050FE000-memory.dmpFilesize
5.0MB
-
memory/3064-120-0x00000000025C0000-0x00000000025EE000-memory.dmpFilesize
184KB
-
memory/3064-121-0x00000000004C0000-0x000000000060A000-memory.dmpFilesize
1.3MB
-
memory/3064-122-0x0000000002180000-0x00000000021B7000-memory.dmpFilesize
220KB
-
memory/3064-123-0x0000000000400000-0x0000000000450000-memory.dmpFilesize
320KB
-
memory/3064-124-0x0000000005100000-0x0000000005706000-memory.dmpFilesize
6.0MB
-
memory/3064-125-0x0000000002780000-0x0000000002792000-memory.dmpFilesize
72KB
-
memory/3064-126-0x0000000005710000-0x000000000581A000-memory.dmpFilesize
1.0MB
-
memory/3064-127-0x0000000005860000-0x000000000589E000-memory.dmpFilesize
248KB
-
memory/3064-128-0x00000000058A0000-0x00000000058EB000-memory.dmpFilesize
300KB
-
memory/3064-129-0x0000000006600000-0x0000000006666000-memory.dmpFilesize
408KB
-
memory/3064-130-0x0000000006920000-0x0000000006996000-memory.dmpFilesize
472KB
-
memory/3064-131-0x00000000069D0000-0x0000000006A62000-memory.dmpFilesize
584KB
-
memory/3064-132-0x0000000006AF0000-0x0000000006B0E000-memory.dmpFilesize
120KB
-
memory/3064-133-0x0000000006E20000-0x0000000006FE2000-memory.dmpFilesize
1.8MB
-
memory/3064-134-0x0000000006FF0000-0x000000000751C000-memory.dmpFilesize
5.2MB