Analysis
-
max time kernel
51s -
max time network
62s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
27-05-2022 15:02
Static task
static1
General
-
Target
033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exe
-
Size
406KB
-
MD5
3c0ba66cde32f31d8dca6528e71e57f1
-
SHA1
e45c771572645ec7761091644872a30d68a19117
-
SHA256
033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a
-
SHA512
bcd80732168278b61c78215be9a356d1c2ffc221fabc24b82431f86b4ff6f573c8f4a73ffe59e7c06ca192b121fbb0854a51e295568f1706168f044a3cff3ab4
Malware Config
Extracted
redline
top
185.215.113.75:81
-
auth_value
ff6259bc2baf33b54b454aad484fb0ee
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exepid process 2280 033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exe 2280 033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exedescription pid process Token: SeDebugPrivilege 2280 033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exe"C:\Users\Admin\AppData\Local\Temp\033502b09209cef3f5cd3751d67a6db79bc68cdcdba11c3d1b7d00b119eb2f2a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2280-118-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-119-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-120-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-121-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-122-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-123-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-124-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-125-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-126-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-127-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-128-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-129-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-130-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-131-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-132-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-133-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-134-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-135-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-136-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-137-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-139-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-138-0x0000000000BF7000-0x0000000000C21000-memory.dmpFilesize
168KB
-
memory/2280-141-0x0000000000930000-0x0000000000A7A000-memory.dmpFilesize
1.3MB
-
memory/2280-140-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-142-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-143-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-144-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-145-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-146-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-147-0x0000000000400000-0x000000000092E000-memory.dmpFilesize
5.2MB
-
memory/2280-148-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-149-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-150-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-151-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-152-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-153-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-154-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-155-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-156-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-157-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-158-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-159-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-160-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-161-0x0000000000E20000-0x0000000000E50000-memory.dmpFilesize
192KB
-
memory/2280-162-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-163-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-164-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-165-0x0000000072150000-0x00000000734DF000-memory.dmpFilesize
19.6MB
-
memory/2280-166-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-167-0x0000000004FF0000-0x00000000054EE000-memory.dmpFilesize
5.0MB
-
memory/2280-168-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-169-0x0000000002B50000-0x0000000002B7E000-memory.dmpFilesize
184KB
-
memory/2280-170-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-171-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-172-0x00000000054F0000-0x0000000005AF6000-memory.dmpFilesize
6.0MB
-
memory/2280-173-0x0000000004F50000-0x0000000004F62000-memory.dmpFilesize
72KB
-
memory/2280-174-0x0000000005B00000-0x0000000005C0A000-memory.dmpFilesize
1.0MB
-
memory/2280-175-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-176-0x0000000071630000-0x0000000072040000-memory.dmpFilesize
10.1MB
-
memory/2280-177-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-178-0x0000000004F80000-0x0000000004FBE000-memory.dmpFilesize
248KB
-
memory/2280-179-0x0000000071370000-0x000000007162B000-memory.dmpFilesize
2.7MB
-
memory/2280-180-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-181-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-182-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-184-0x0000000070C30000-0x000000007136E000-memory.dmpFilesize
7.2MB
-
memory/2280-185-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-183-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-187-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-186-0x0000000070350000-0x000000007044C000-memory.dmpFilesize
1008KB
-
memory/2280-188-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-189-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-190-0x0000000005C40000-0x0000000005C8B000-memory.dmpFilesize
300KB
-
memory/2280-191-0x0000000070450000-0x0000000070C30000-memory.dmpFilesize
7.9MB
-
memory/2280-192-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-193-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-194-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-195-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-196-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-197-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-198-0x00000000774E0000-0x000000007766E000-memory.dmpFilesize
1.6MB
-
memory/2280-200-0x0000000000BF7000-0x0000000000C21000-memory.dmpFilesize
168KB
-
memory/2280-202-0x0000000000930000-0x0000000000A7A000-memory.dmpFilesize
1.3MB
-
memory/2280-217-0x00000000069A0000-0x0000000006A06000-memory.dmpFilesize
408KB
-
memory/2280-225-0x0000000006CF0000-0x0000000006D66000-memory.dmpFilesize
472KB
-
memory/2280-226-0x0000000000400000-0x000000000092E000-memory.dmpFilesize
5.2MB
-
memory/2280-227-0x0000000006DC0000-0x0000000006E52000-memory.dmpFilesize
584KB
-
memory/2280-230-0x0000000006FA0000-0x0000000006FBE000-memory.dmpFilesize
120KB
-
memory/2280-231-0x0000000072150000-0x00000000734DF000-memory.dmpFilesize
19.6MB
-
memory/2280-232-0x00000000071D0000-0x0000000007392000-memory.dmpFilesize
1.8MB
-
memory/2280-233-0x0000000071630000-0x0000000072040000-memory.dmpFilesize
10.1MB
-
memory/2280-234-0x00000000073A0000-0x00000000078CC000-memory.dmpFilesize
5.2MB
-
memory/2280-237-0x0000000070C30000-0x000000007136E000-memory.dmpFilesize
7.2MB
-
memory/2280-239-0x0000000000BF7000-0x0000000000C21000-memory.dmpFilesize
168KB
-
memory/2280-240-0x0000000071370000-0x000000007162B000-memory.dmpFilesize
2.7MB
-
memory/2280-241-0x0000000070350000-0x000000007044C000-memory.dmpFilesize
1008KB
-
memory/2280-242-0x0000000071370000-0x000000007162B000-memory.dmpFilesize
2.7MB
-
memory/2280-243-0x0000000000400000-0x000000000092E000-memory.dmpFilesize
5.2MB
-
memory/2280-244-0x0000000072150000-0x00000000734DF000-memory.dmpFilesize
19.6MB
-
memory/2280-245-0x0000000070450000-0x0000000070C30000-memory.dmpFilesize
7.9MB
-
memory/2280-246-0x0000000071630000-0x0000000072040000-memory.dmpFilesize
10.1MB
-
memory/2280-247-0x0000000070C30000-0x000000007136E000-memory.dmpFilesize
7.2MB