Analysis
-
max time kernel
53s -
max time network
60s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
08-06-2022 02:07
Static task
static1
General
-
Target
aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exe
-
Size
318KB
-
MD5
808f85f1ebf6d750b1a90b304f956d18
-
SHA1
3cee26343babb05dca861510b4f5a72ee2463067
-
SHA256
aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62
-
SHA512
7f8077fbcffc26b9e1d75b52ca579e2d81c2426153e532d2942ce1523ba67d4058fd599ec3e0465378d63c3753e6be2fe298e243bcbd443623edfbde1b89eabf
Malware Config
Extracted
redline
Lyla2
185.215.113.201:21921
-
auth_value
f3b96059847b054b3939cadefd4424ee
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exepid process 1924 aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exe 1924 aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exedescription pid process Token: SeDebugPrivilege 1924 aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exe"C:\Users\Admin\AppData\Local\Temp\aafd5d84fd0f99df9d49eac6cda00c1b08c24c4d1a3fce8d9f388fbde1a41f62.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1924-117-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-118-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-119-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-120-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-121-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-122-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-123-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-124-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-125-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-126-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-127-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-128-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-129-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-130-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-131-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-132-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-133-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-134-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-135-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-136-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-137-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-138-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-140-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-141-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-142-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-143-0x0000000000920000-0x00000000009CE000-memory.dmpFilesize
696KB
-
memory/1924-145-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-144-0x0000000002640000-0x0000000002677000-memory.dmpFilesize
220KB
-
memory/1924-146-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-147-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-148-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-149-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-150-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-151-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-152-0x0000000000400000-0x000000000091A000-memory.dmpFilesize
5.1MB
-
memory/1924-153-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-154-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-155-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-156-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-157-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-158-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-159-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-160-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-161-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-162-0x0000000002980000-0x00000000029B0000-memory.dmpFilesize
192KB
-
memory/1924-163-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-164-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-165-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-166-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-167-0x0000000005130000-0x000000000562E000-memory.dmpFilesize
5.0MB
-
memory/1924-168-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-169-0x0000000000920000-0x00000000009CE000-memory.dmpFilesize
696KB
-
memory/1924-170-0x0000000002640000-0x0000000002677000-memory.dmpFilesize
220KB
-
memory/1924-171-0x0000000004FC0000-0x0000000004FEE000-memory.dmpFilesize
184KB
-
memory/1924-172-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-173-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-174-0x0000000005630000-0x0000000005C36000-memory.dmpFilesize
6.0MB
-
memory/1924-175-0x0000000005080000-0x0000000005092000-memory.dmpFilesize
72KB
-
memory/1924-176-0x0000000005C40000-0x0000000005D4A000-memory.dmpFilesize
1.0MB
-
memory/1924-177-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-178-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-179-0x00000000050B0000-0x00000000050EE000-memory.dmpFilesize
248KB
-
memory/1924-180-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-181-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-182-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-183-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-184-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-185-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-186-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-187-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-188-0x0000000005E70000-0x0000000005EBB000-memory.dmpFilesize
300KB
-
memory/1924-189-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-190-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-191-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-192-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-193-0x0000000006000000-0x0000000006066000-memory.dmpFilesize
408KB
-
memory/1924-194-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-195-0x0000000077BF0000-0x0000000077D7E000-memory.dmpFilesize
1.6MB
-
memory/1924-201-0x00000000066B0000-0x0000000006726000-memory.dmpFilesize
472KB
-
memory/1924-202-0x0000000006780000-0x0000000006812000-memory.dmpFilesize
584KB
-
memory/1924-205-0x0000000006860000-0x000000000687E000-memory.dmpFilesize
120KB
-
memory/1924-206-0x0000000006A00000-0x0000000006A50000-memory.dmpFilesize
320KB
-
memory/1924-207-0x0000000006B80000-0x0000000006D42000-memory.dmpFilesize
1.8MB
-
memory/1924-208-0x0000000006D50000-0x000000000727C000-memory.dmpFilesize
5.2MB
-
memory/1924-213-0x0000000000400000-0x000000000091A000-memory.dmpFilesize
5.1MB