Analysis
-
max time kernel
51s -
max time network
149s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
27-05-2022 17:21
Static task
static1
General
-
Target
3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe
-
Size
392KB
-
MD5
9be6e9c68af390bec141cde90eaf3901
-
SHA1
2f9a32927ca921836ee59d7dad42d9ea68747adc
-
SHA256
3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee
-
SHA512
33d88e6d1c10763edee986cdf0edfa83eba4d1ee2ab61241e21b1ec82f4670d8e84dc76dfc5584f31843bded667c016bdc14db7fb2507a9f15245edf2867205f
Malware Config
Extracted
redline
top
185.215.113.75:81
-
auth_value
ff6259bc2baf33b54b454aad484fb0ee
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exepid process 1888 3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe 1888 3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exedescription pid process Token: SeDebugPrivilege 1888 3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe"C:\Users\Admin\AppData\Local\Temp\3d534efc61c6ca92ba2fe9c543a44ff25859a9161882c42e22c7113ecb8078ee.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1888-119-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-120-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-122-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-121-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-123-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-124-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-125-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-126-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-127-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-128-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-129-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-130-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-131-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-132-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-133-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-134-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-136-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-137-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-138-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-139-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-140-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-141-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-142-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-143-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-144-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-145-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-148-0x0000000002500000-0x0000000002537000-memory.dmpFilesize
220KB
-
memory/1888-149-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-151-0x0000000000400000-0x000000000092B000-memory.dmpFilesize
5.2MB
-
memory/1888-150-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-152-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-147-0x0000000000A60000-0x0000000000BAA000-memory.dmpFilesize
1.3MB
-
memory/1888-146-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-153-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-154-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-156-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-155-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-157-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-158-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-159-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-160-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-161-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-162-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-164-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-163-0x0000000002730000-0x0000000002760000-memory.dmpFilesize
192KB
-
memory/1888-165-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-166-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-167-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-168-0x0000000071C90000-0x000000007301F000-memory.dmpFilesize
19.6MB
-
memory/1888-169-0x0000000004F70000-0x000000000546E000-memory.dmpFilesize
5.0MB
-
memory/1888-170-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-171-0x0000000002A40000-0x0000000002A6E000-memory.dmpFilesize
184KB
-
memory/1888-172-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-173-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-175-0x0000000005AA0000-0x0000000005AB2000-memory.dmpFilesize
72KB
-
memory/1888-174-0x0000000005470000-0x0000000005A76000-memory.dmpFilesize
6.0MB
-
memory/1888-176-0x0000000005AC0000-0x0000000005BCA000-memory.dmpFilesize
1.0MB
-
memory/1888-177-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-178-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-180-0x0000000005BD0000-0x0000000005C0E000-memory.dmpFilesize
248KB
-
memory/1888-179-0x0000000071170000-0x0000000071B80000-memory.dmpFilesize
10.1MB
-
memory/1888-183-0x0000000070770000-0x0000000070EAE000-memory.dmpFilesize
7.2MB
-
memory/1888-182-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-181-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-184-0x000000006FE90000-0x000000006FF8C000-memory.dmpFilesize
1008KB
-
memory/1888-187-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-189-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-188-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-186-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-185-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-190-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-191-0x0000000005C40000-0x0000000005C8B000-memory.dmpFilesize
300KB
-
memory/1888-192-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-193-0x0000000070EB0000-0x000000007116B000-memory.dmpFilesize
2.7MB
-
memory/1888-194-0x000000006FF90000-0x0000000070770000-memory.dmpFilesize
7.9MB
-
memory/1888-195-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-196-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-197-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-200-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-199-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-198-0x0000000077020000-0x00000000771AE000-memory.dmpFilesize
1.6MB
-
memory/1888-217-0x00000000069C0000-0x0000000006A36000-memory.dmpFilesize
472KB
-
memory/1888-218-0x0000000006AE0000-0x0000000006B72000-memory.dmpFilesize
584KB
-
memory/1888-221-0x0000000006A90000-0x0000000006AAE000-memory.dmpFilesize
120KB
-
memory/1888-222-0x0000000006BC0000-0x0000000006C26000-memory.dmpFilesize
408KB
-
memory/1888-230-0x0000000007040000-0x0000000007202000-memory.dmpFilesize
1.8MB
-
memory/1888-231-0x0000000007220000-0x000000000774C000-memory.dmpFilesize
5.2MB
-
memory/1888-234-0x0000000000400000-0x000000000092B000-memory.dmpFilesize
5.2MB
-
memory/1888-236-0x0000000000400000-0x000000000092B000-memory.dmpFilesize
5.2MB
-
memory/1888-237-0x0000000071C90000-0x000000007301F000-memory.dmpFilesize
19.6MB
-
memory/1888-239-0x000000006FF90000-0x0000000070770000-memory.dmpFilesize
7.9MB
-
memory/1888-240-0x0000000071170000-0x0000000071B80000-memory.dmpFilesize
10.1MB
-
memory/1888-241-0x0000000070770000-0x0000000070EAE000-memory.dmpFilesize
7.2MB
-
memory/1888-238-0x0000000070EB0000-0x000000007116B000-memory.dmpFilesize
2.7MB
-
memory/1888-242-0x0000000071C90000-0x000000007301F000-memory.dmpFilesize
19.6MB
-
memory/1888-243-0x0000000071170000-0x0000000071B80000-memory.dmpFilesize
10.1MB
-
memory/1888-244-0x000000006FE90000-0x000000006FF8C000-memory.dmpFilesize
1008KB
-
memory/1888-245-0x0000000070770000-0x0000000070EAE000-memory.dmpFilesize
7.2MB