Analysis
-
max time kernel
145s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
03-06-2022 08:52
Static task
static1
General
-
Target
b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exe
-
Size
382KB
-
MD5
fa8629756835908dcdc95d9e1e55bb50
-
SHA1
4364f580b3bad3103956b59ad120d2d9416a9127
-
SHA256
b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f
-
SHA512
ea40ebd8d831ee81c29837eb7c4aa154afafb0dcdf22d9ba835214b2591510d03ebde2e3c48a71b1c0c8b4facbca2fb9283ef92f80f79803138cd202d91f624f
Malware Config
Extracted
redline
mx
193.106.191.222:23196
-
auth_value
8cfa634189948115f1f5e1900e4b66b6
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exepid process 2656 b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exe 2656 b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exedescription pid process Token: SeDebugPrivilege 2656 b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exe"C:\Users\Admin\AppData\Local\Temp\b3e2481f1fb8659ff720ebbcc871b62c3c37bd1856f5f70bd249f09cb42dd99f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2656-118-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-119-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-120-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-121-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-122-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-123-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-124-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-125-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-126-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-127-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-128-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-129-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-130-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-131-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-132-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-133-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-134-0x00000000007A1000-0x00000000007CB000-memory.dmpFilesize
168KB
-
memory/2656-135-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-136-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-137-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-138-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-139-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-140-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-141-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-142-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/2656-143-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-144-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-145-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-146-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-147-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-148-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-149-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-150-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-151-0x0000000000400000-0x0000000000505000-memory.dmpFilesize
1.0MB
-
memory/2656-152-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-154-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-153-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-155-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-156-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-157-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-158-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-159-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-160-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-161-0x0000000002590000-0x00000000025C2000-memory.dmpFilesize
200KB
-
memory/2656-162-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-163-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-164-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-165-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-166-0x0000000072020000-0x00000000733AF000-memory.dmpFilesize
19.6MB
-
memory/2656-167-0x0000000004BA0000-0x000000000509E000-memory.dmpFilesize
5.0MB
-
memory/2656-168-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-169-0x00000000050A0000-0x00000000050D0000-memory.dmpFilesize
192KB
-
memory/2656-170-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-171-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-172-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-173-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-174-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-175-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-176-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-177-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-178-0x0000000071500000-0x0000000071F10000-memory.dmpFilesize
10.1MB
-
memory/2656-179-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-180-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-181-0x0000000005180000-0x0000000005786000-memory.dmpFilesize
6.0MB
-
memory/2656-182-0x0000000005810000-0x0000000005822000-memory.dmpFilesize
72KB
-
memory/2656-183-0x0000000070D20000-0x0000000071500000-memory.dmpFilesize
7.9MB
-
memory/2656-184-0x0000000005840000-0x000000000594A000-memory.dmpFilesize
1.0MB
-
memory/2656-185-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-186-0x000000006FD70000-0x000000007091E000-memory.dmpFilesize
11.7MB
-
memory/2656-187-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-188-0x0000000005970000-0x00000000059AE000-memory.dmpFilesize
248KB
-
memory/2656-189-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-190-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-191-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-192-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-193-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-194-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-195-0x00000000773B0000-0x000000007753E000-memory.dmpFilesize
1.6MB
-
memory/2656-196-0x00000000059E0000-0x0000000005A2B000-memory.dmpFilesize
300KB
-
memory/2656-198-0x000000006EA60000-0x000000006FD67000-memory.dmpFilesize
19.0MB
-
memory/2656-199-0x000000006DB70000-0x000000006E2AE000-memory.dmpFilesize
7.2MB
-
memory/2656-202-0x0000000070920000-0x0000000070D13000-memory.dmpFilesize
3.9MB
-
memory/2656-203-0x000000006E2B0000-0x000000006E56B000-memory.dmpFilesize
2.7MB
-
memory/2656-204-0x000000006DA70000-0x000000006DB6C000-memory.dmpFilesize
1008KB
-
memory/2656-206-0x0000000005C80000-0x0000000005CE6000-memory.dmpFilesize
408KB
-
memory/2656-214-0x0000000006320000-0x0000000006396000-memory.dmpFilesize
472KB
-
memory/2656-215-0x0000000006400000-0x0000000006492000-memory.dmpFilesize
584KB
-
memory/2656-218-0x00000000065E0000-0x00000000065FE000-memory.dmpFilesize
120KB
-
memory/2656-219-0x0000000006810000-0x00000000069D2000-memory.dmpFilesize
1.8MB
-
memory/2656-220-0x00000000069E0000-0x0000000006F0C000-memory.dmpFilesize
5.2MB
-
memory/2656-223-0x00000000007A1000-0x00000000007CB000-memory.dmpFilesize
168KB
-
memory/2656-224-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/2656-229-0x0000000000400000-0x0000000000505000-memory.dmpFilesize
1.0MB
-
memory/2656-230-0x0000000072020000-0x00000000733AF000-memory.dmpFilesize
19.6MB
-
memory/2656-231-0x0000000070D20000-0x0000000071500000-memory.dmpFilesize
7.9MB
-
memory/2656-232-0x000000006E2B0000-0x000000006E56B000-memory.dmpFilesize
2.7MB
-
memory/2656-233-0x0000000071500000-0x0000000071F10000-memory.dmpFilesize
10.1MB
-
memory/2656-234-0x000000006DB70000-0x000000006E2AE000-memory.dmpFilesize
7.2MB
-
memory/2656-235-0x000000006FD70000-0x000000007091E000-memory.dmpFilesize
11.7MB