Analysis
-
max time kernel
164s -
max time network
178s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
27-05-2022 16:01
Static task
static1
General
-
Target
9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exe
-
Size
407KB
-
MD5
404b89fe3e18d018df4f30af647e474f
-
SHA1
2f8720f1548d505720d0966a43a6a1cedd73ac74
-
SHA256
9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0
-
SHA512
0563a99ffb4f8bad11e3f3ed9bdf86db2b52d6a63a3df3b89058257e0ec3740dbb7494b795512b895e36e3e99d27b49513d4a1a7c4cd6ce5700adee7a0580483
Malware Config
Extracted
redline
top
185.215.113.75:81
-
auth_value
ff6259bc2baf33b54b454aad484fb0ee
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exepid process 2072 9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exe 2072 9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exedescription pid process Token: SeDebugPrivilege 2072 9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exe"C:\Users\Admin\AppData\Local\Temp\9ee2246cc32c5d62c41f8144a951ecb1a25999ba0e63fd8a5ab8a9aaeae227b0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2072-119-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-120-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-121-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-122-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-123-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-124-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-125-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-126-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-127-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-128-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-129-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-130-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-132-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-131-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-133-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-134-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-136-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-137-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-138-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-139-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-140-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-141-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-142-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-143-0x0000000000A30000-0x0000000000B7A000-memory.dmpFilesize
1.3MB
-
memory/2072-144-0x0000000000A30000-0x0000000000B7A000-memory.dmpFilesize
1.3MB
-
memory/2072-145-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-146-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-147-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-148-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-149-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-150-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-151-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-152-0x0000000000400000-0x000000000092E000-memory.dmpFilesize
5.2MB
-
memory/2072-153-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-154-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-156-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-155-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-157-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-158-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-159-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-160-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-161-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-162-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-163-0x0000000002960000-0x0000000002990000-memory.dmpFilesize
192KB
-
memory/2072-164-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-165-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-166-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-167-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-168-0x0000000004FC0000-0x00000000054BE000-memory.dmpFilesize
5.0MB
-
memory/2072-169-0x0000000072490000-0x000000007381F000-memory.dmpFilesize
19.6MB
-
memory/2072-170-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-171-0x0000000004E70000-0x0000000004E9E000-memory.dmpFilesize
184KB
-
memory/2072-172-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-173-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-175-0x0000000071970000-0x0000000072380000-memory.dmpFilesize
10.1MB
-
memory/2072-176-0x0000000004F50000-0x0000000004F62000-memory.dmpFilesize
72KB
-
memory/2072-174-0x00000000054C0000-0x0000000005AC6000-memory.dmpFilesize
6.0MB
-
memory/2072-177-0x0000000005AD0000-0x0000000005BDA000-memory.dmpFilesize
1.0MB
-
memory/2072-178-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-179-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-180-0x0000000005BE0000-0x0000000005C1E000-memory.dmpFilesize
248KB
-
memory/2072-181-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-182-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-183-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-184-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-185-0x00000000716B0000-0x000000007196B000-memory.dmpFilesize
2.7MB
-
memory/2072-186-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-187-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-188-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-189-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-190-0x0000000070F70000-0x00000000716AE000-memory.dmpFilesize
7.2MB
-
memory/2072-191-0x0000000070790000-0x0000000070F70000-memory.dmpFilesize
7.9MB
-
memory/2072-192-0x0000000005C40000-0x0000000005C8B000-memory.dmpFilesize
300KB
-
memory/2072-193-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-194-0x0000000070690000-0x000000007078C000-memory.dmpFilesize
1008KB
-
memory/2072-195-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-196-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-197-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-198-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-199-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-200-0x0000000077820000-0x00000000779AE000-memory.dmpFilesize
1.6MB
-
memory/2072-217-0x00000000069A0000-0x0000000006A06000-memory.dmpFilesize
408KB
-
memory/2072-225-0x0000000006CE0000-0x0000000006D56000-memory.dmpFilesize
472KB
-
memory/2072-226-0x0000000006DC0000-0x0000000006E52000-memory.dmpFilesize
584KB
-
memory/2072-229-0x0000000006FA0000-0x0000000006FBE000-memory.dmpFilesize
120KB
-
memory/2072-230-0x00000000071D0000-0x0000000007392000-memory.dmpFilesize
1.8MB
-
memory/2072-231-0x0000000000A30000-0x0000000000B7A000-memory.dmpFilesize
1.3MB
-
memory/2072-232-0x00000000073A0000-0x00000000078CC000-memory.dmpFilesize
5.2MB
-
memory/2072-235-0x0000000000400000-0x000000000092E000-memory.dmpFilesize
5.2MB
-
memory/2072-236-0x0000000072490000-0x000000007381F000-memory.dmpFilesize
19.6MB
-
memory/2072-237-0x0000000071970000-0x0000000072380000-memory.dmpFilesize
10.1MB
-
memory/2072-238-0x00000000716B0000-0x000000007196B000-memory.dmpFilesize
2.7MB
-
memory/2072-239-0x0000000070F70000-0x00000000716AE000-memory.dmpFilesize
7.2MB
-
memory/2072-240-0x0000000070790000-0x0000000070F70000-memory.dmpFilesize
7.9MB
-
memory/2072-241-0x0000000070690000-0x000000007078C000-memory.dmpFilesize
1008KB
-
memory/2072-243-0x0000000000400000-0x000000000092E000-memory.dmpFilesize
5.2MB
-
memory/2072-244-0x0000000072490000-0x000000007381F000-memory.dmpFilesize
19.6MB
-
memory/2072-246-0x00000000716B0000-0x000000007196B000-memory.dmpFilesize
2.7MB
-
memory/2072-245-0x0000000071970000-0x0000000072380000-memory.dmpFilesize
10.1MB
-
memory/2072-247-0x0000000070F70000-0x00000000716AE000-memory.dmpFilesize
7.2MB