Analysis
-
max time kernel
51s -
max time network
147s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
16-06-2022 14:51
Static task
static1
General
-
Target
5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exe
-
Size
389KB
-
MD5
f27ea0f9aad45d8e55517b57b56513d9
-
SHA1
e8569930258ed418933e6d749242de78f3063dd6
-
SHA256
5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab
-
SHA512
b4cdbcf14a41a1b6c119c5ff04c7ea5ecab62f70d99c1e58aab44b0fd81f75308dd69a98a9ecfda0f3a14429c96237e0ef1a0503584d8ed6fc08d8b2b0109561
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exepid process 1636 5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exe 1636 5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exedescription pid process Token: SeDebugPrivilege 1636 5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exe"C:\Users\Admin\AppData\Local\Temp\5d2a7ab7d92e58478524f9e025b13e8f8f91e71940cf427e4252eb0627b01dab.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1636
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1636-119-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-120-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-121-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-122-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-123-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-124-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-125-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-126-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-127-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-128-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-129-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-130-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-131-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-132-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-133-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-134-0x0000000000D26000-0x0000000000D50000-memory.dmpFilesize
168KB
-
memory/1636-135-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-136-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-137-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-138-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-139-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-140-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-141-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-142-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-143-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-144-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-145-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-146-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-147-0x0000000000C00000-0x0000000000D4A000-memory.dmpFilesize
1.3MB
-
memory/1636-148-0x0000000000C00000-0x0000000000D4A000-memory.dmpFilesize
1.3MB
-
memory/1636-149-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/1636-150-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-151-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-152-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-153-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-156-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-155-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-154-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-157-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-158-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-159-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-162-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-163-0x0000000002AB0000-0x0000000002AE0000-memory.dmpFilesize
192KB
-
memory/1636-164-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-165-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-166-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-161-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-160-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-167-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-169-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-170-0x0000000002C80000-0x0000000002CAE000-memory.dmpFilesize
184KB
-
memory/1636-168-0x00000000053D0000-0x00000000058CE000-memory.dmpFilesize
5.0MB
-
memory/1636-171-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-172-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-173-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-174-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-175-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-176-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-177-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-179-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-178-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-180-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-182-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/1636-181-0x00000000058D0000-0x0000000005ED6000-memory.dmpFilesize
6.0MB
-
memory/1636-183-0x0000000005EE0000-0x0000000005FEA000-memory.dmpFilesize
1.0MB
-
memory/1636-184-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-185-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-186-0x0000000005320000-0x000000000535E000-memory.dmpFilesize
248KB
-
memory/1636-187-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-188-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-190-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-189-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-192-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-191-0x0000000077E60000-0x0000000077FEE000-memory.dmpFilesize
1.6MB
-
memory/1636-194-0x00000000060F0000-0x000000000613B000-memory.dmpFilesize
300KB
-
memory/1636-199-0x0000000006260000-0x00000000062C6000-memory.dmpFilesize
408KB
-
memory/1636-207-0x0000000006900000-0x0000000006976000-memory.dmpFilesize
472KB
-
memory/1636-208-0x00000000069D0000-0x0000000006A62000-memory.dmpFilesize
584KB
-
memory/1636-211-0x0000000006AC0000-0x0000000006ADE000-memory.dmpFilesize
120KB
-
memory/1636-212-0x0000000006EF0000-0x00000000070B2000-memory.dmpFilesize
1.8MB
-
memory/1636-213-0x00000000070C0000-0x00000000075EC000-memory.dmpFilesize
5.2MB
-
memory/1636-215-0x0000000000C00000-0x0000000000D4A000-memory.dmpFilesize
1.3MB
-
memory/1636-216-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/1636-222-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB