Analysis

  • max time kernel
    51s
  • max time network
    149s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • submitted
    27-05-2022 17:21

General

  • Target

    3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe

  • Size

    392KB

  • MD5

    9be6e9c68af390bec141cde90eaf3901

  • SHA1

    2f9a32927ca921836ee59d7dad42d9ea68747adc

  • SHA256

    3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee

  • SHA512

    33d88e6d1c10763edee986cdf0edfa83eba4d1ee2ab61241e21b1ec82f4670d8e84dc76dfc5584f31843bded667c016bdc14db7fb2507a9f15245edf2867205f

Malware Config

Extracted

Family

redline

Botnet

top

C2

185.215.113.75:81

Attributes
  • auth_value

    ff6259bc2baf33b54b454aad484fb0ee

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe
    "C:\Users\Admin\AppData\Local\Temp\3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1888

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1888-119-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-120-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-122-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-121-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-123-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-124-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-125-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-126-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-127-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-128-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-129-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-130-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-131-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-132-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-133-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-134-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-136-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-137-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-138-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-139-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-140-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-141-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-142-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-143-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-144-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-145-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-148-0x0000000002500000-0x0000000002537000-memory.dmp
    Filesize

    220KB

  • memory/1888-149-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-151-0x0000000000400000-0x000000000092B000-memory.dmp
    Filesize

    5.2MB

  • memory/1888-150-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-152-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-147-0x0000000000A60000-0x0000000000BAA000-memory.dmp
    Filesize

    1.3MB

  • memory/1888-146-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-153-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-154-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-156-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-155-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-157-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-158-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-159-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-160-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-161-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-162-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-164-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-163-0x0000000002730000-0x0000000002760000-memory.dmp
    Filesize

    192KB

  • memory/1888-165-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-166-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-167-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-168-0x0000000071C90000-0x000000007301F000-memory.dmp
    Filesize

    19.6MB

  • memory/1888-169-0x0000000004F70000-0x000000000546E000-memory.dmp
    Filesize

    5.0MB

  • memory/1888-170-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-171-0x0000000002A40000-0x0000000002A6E000-memory.dmp
    Filesize

    184KB

  • memory/1888-172-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-173-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-175-0x0000000005AA0000-0x0000000005AB2000-memory.dmp
    Filesize

    72KB

  • memory/1888-174-0x0000000005470000-0x0000000005A76000-memory.dmp
    Filesize

    6.0MB

  • memory/1888-176-0x0000000005AC0000-0x0000000005BCA000-memory.dmp
    Filesize

    1.0MB

  • memory/1888-177-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-178-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-180-0x0000000005BD0000-0x0000000005C0E000-memory.dmp
    Filesize

    248KB

  • memory/1888-179-0x0000000071170000-0x0000000071B80000-memory.dmp
    Filesize

    10.1MB

  • memory/1888-183-0x0000000070770000-0x0000000070EAE000-memory.dmp
    Filesize

    7.2MB

  • memory/1888-182-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-181-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-184-0x000000006FE90000-0x000000006FF8C000-memory.dmp
    Filesize

    1008KB

  • memory/1888-187-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-189-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-188-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-186-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-185-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-190-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-191-0x0000000005C40000-0x0000000005C8B000-memory.dmp
    Filesize

    300KB

  • memory/1888-192-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-193-0x0000000070EB0000-0x000000007116B000-memory.dmp
    Filesize

    2.7MB

  • memory/1888-194-0x000000006FF90000-0x0000000070770000-memory.dmp
    Filesize

    7.9MB

  • memory/1888-195-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-196-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-197-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-200-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-199-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-198-0x0000000077020000-0x00000000771AE000-memory.dmp
    Filesize

    1.6MB

  • memory/1888-217-0x00000000069C0000-0x0000000006A36000-memory.dmp
    Filesize

    472KB

  • memory/1888-218-0x0000000006AE0000-0x0000000006B72000-memory.dmp
    Filesize

    584KB

  • memory/1888-221-0x0000000006A90000-0x0000000006AAE000-memory.dmp
    Filesize

    120KB

  • memory/1888-222-0x0000000006BC0000-0x0000000006C26000-memory.dmp
    Filesize

    408KB

  • memory/1888-230-0x0000000007040000-0x0000000007202000-memory.dmp
    Filesize

    1.8MB

  • memory/1888-231-0x0000000007220000-0x000000000774C000-memory.dmp
    Filesize

    5.2MB

  • memory/1888-234-0x0000000000400000-0x000000000092B000-memory.dmp
    Filesize

    5.2MB

  • memory/1888-236-0x0000000000400000-0x000000000092B000-memory.dmp
    Filesize

    5.2MB

  • memory/1888-237-0x0000000071C90000-0x000000007301F000-memory.dmp
    Filesize

    19.6MB

  • memory/1888-239-0x000000006FF90000-0x0000000070770000-memory.dmp
    Filesize

    7.9MB

  • memory/1888-240-0x0000000071170000-0x0000000071B80000-memory.dmp
    Filesize

    10.1MB

  • memory/1888-241-0x0000000070770000-0x0000000070EAE000-memory.dmp
    Filesize

    7.2MB

  • memory/1888-238-0x0000000070EB0000-0x000000007116B000-memory.dmp
    Filesize

    2.7MB

  • memory/1888-242-0x0000000071C90000-0x000000007301F000-memory.dmp
    Filesize

    19.6MB

  • memory/1888-243-0x0000000071170000-0x0000000071B80000-memory.dmp
    Filesize

    10.1MB

  • memory/1888-244-0x000000006FE90000-0x000000006FF8C000-memory.dmp
    Filesize

    1008KB

  • memory/1888-245-0x0000000070770000-0x0000000070EAE000-memory.dmp
    Filesize

    7.2MB