Analysis
-
max time kernel
52s -
max time network
73s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
02-06-2022 23:46
Static task
static1
General
-
Target
351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exe
-
Size
383KB
-
MD5
2df37cebbb77cff9d372d1dcd2c9bcfb
-
SHA1
49c5963ff879ff2013d0f64a102061fd536cdd3f
-
SHA256
351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f
-
SHA512
2cb7b4f054493f2bc7f4d57f1dc82dd19ada54b9d0fddf7310ffd0aa16a881bc7378b31662f19fc53dcc17032271cfba73ddc6546094423fdd4afc92b7ff2737
Malware Config
Extracted
redline
mx
193.106.191.222:23196
-
auth_value
8cfa634189948115f1f5e1900e4b66b6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exepid process 3900 351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exe 3900 351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exedescription pid process Token: SeDebugPrivilege 3900 351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exe"C:\Users\Admin\AppData\Local\Temp\351379bf31eef3f7f45e05cdc6c0066c0ccb209788010a14576b58dad2277e3f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3900
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3900-116-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-117-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-118-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-119-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-121-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-120-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-122-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-123-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-124-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-125-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-126-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-127-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-128-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-129-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-130-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-131-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-132-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-133-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-134-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-135-0x0000000000821000-0x000000000084C000-memory.dmpFilesize
172KB
-
memory/3900-136-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-137-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-139-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-140-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-138-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/3900-141-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-142-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-143-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-144-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-145-0x0000000000400000-0x0000000000505000-memory.dmpFilesize
1.0MB
-
memory/3900-146-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-147-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-148-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-149-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-150-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-152-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-151-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-153-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-154-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-155-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-156-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-157-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-158-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-160-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-159-0x0000000004A00000-0x0000000004A32000-memory.dmpFilesize
200KB
-
memory/3900-161-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-162-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-163-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-164-0x0000000004A30000-0x0000000004F2E000-memory.dmpFilesize
5.0MB
-
memory/3900-165-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-166-0x0000000004F70000-0x0000000004FA0000-memory.dmpFilesize
192KB
-
memory/3900-167-0x0000000072550000-0x00000000738DF000-memory.dmpFilesize
19.6MB
-
memory/3900-168-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-169-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-170-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-171-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-172-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-173-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-174-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-175-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-176-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-177-0x0000000071A30000-0x0000000072440000-memory.dmpFilesize
10.1MB
-
memory/3900-178-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-179-0x0000000005040000-0x0000000005646000-memory.dmpFilesize
6.0MB
-
memory/3900-180-0x0000000071250000-0x0000000071A30000-memory.dmpFilesize
7.9MB
-
memory/3900-181-0x00000000056D0000-0x00000000056E2000-memory.dmpFilesize
72KB
-
memory/3900-182-0x0000000070E50000-0x0000000071243000-memory.dmpFilesize
3.9MB
-
memory/3900-183-0x0000000005700000-0x000000000580A000-memory.dmpFilesize
1.0MB
-
memory/3900-184-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-185-0x000000006EF90000-0x0000000070297000-memory.dmpFilesize
19.0MB
-
memory/3900-186-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-188-0x0000000005830000-0x000000000586E000-memory.dmpFilesize
248KB
-
memory/3900-187-0x000000006E0A0000-0x000000006E7DE000-memory.dmpFilesize
7.2MB
-
memory/3900-189-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-190-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-192-0x00000000702A0000-0x0000000070E4E000-memory.dmpFilesize
11.7MB
-
memory/3900-191-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-194-0x000000006E7E0000-0x000000006EA9B000-memory.dmpFilesize
2.7MB
-
memory/3900-193-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-195-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-196-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-198-0x000000006DFA0000-0x000000006E09C000-memory.dmpFilesize
1008KB
-
memory/3900-197-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3900-199-0x00000000058A0000-0x00000000058EB000-memory.dmpFilesize
300KB
-
memory/3900-203-0x0000000005B40000-0x0000000005BB6000-memory.dmpFilesize
472KB
-
memory/3900-204-0x0000000005C30000-0x0000000005CC2000-memory.dmpFilesize
584KB
-
memory/3900-207-0x0000000005B10000-0x0000000005B2E000-memory.dmpFilesize
120KB
-
memory/3900-209-0x0000000005D10000-0x0000000005D76000-memory.dmpFilesize
408KB
-
memory/3900-217-0x0000000006650000-0x0000000006812000-memory.dmpFilesize
1.8MB
-
memory/3900-218-0x0000000006820000-0x0000000006D4C000-memory.dmpFilesize
5.2MB
-
memory/3900-221-0x0000000000821000-0x000000000084C000-memory.dmpFilesize
172KB
-
memory/3900-222-0x0000000000510000-0x000000000065A000-memory.dmpFilesize
1.3MB
-
memory/3900-223-0x0000000000400000-0x0000000000505000-memory.dmpFilesize
1.0MB
-
memory/3900-224-0x0000000072550000-0x00000000738DF000-memory.dmpFilesize
19.6MB
-
memory/3900-229-0x0000000000821000-0x000000000084C000-memory.dmpFilesize
172KB
-
memory/3900-230-0x0000000000400000-0x0000000000505000-memory.dmpFilesize
1.0MB
-
memory/3900-231-0x000000006DFA0000-0x000000006E09C000-memory.dmpFilesize
1008KB
-
memory/3900-232-0x00000000702A0000-0x0000000070E4E000-memory.dmpFilesize
11.7MB
-
memory/3900-233-0x0000000071250000-0x0000000071A30000-memory.dmpFilesize
7.9MB
-
memory/3900-234-0x000000006E7E0000-0x000000006EA9B000-memory.dmpFilesize
2.7MB
-
memory/3900-235-0x0000000071A30000-0x0000000072440000-memory.dmpFilesize
10.1MB
-
memory/3900-236-0x000000006E0A0000-0x000000006E7DE000-memory.dmpFilesize
7.2MB
-
memory/3900-237-0x0000000072550000-0x00000000738DF000-memory.dmpFilesize
19.6MB