Analysis
-
max time kernel
54s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
16-06-2022 16:31
Static task
static1
General
-
Target
07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exe
-
Size
389KB
-
MD5
830dc53ba197a8c80f90bcca07aea81d
-
SHA1
9ab47d13f3b83af3cd7e5740d395be69923020e0
-
SHA256
07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5
-
SHA512
53fd8edafdf785ca24fac4793a8588fc27945c1265c8918b370bb02402019e3d0d4e0e881b0e1c743e781c8fadb0bb584065cfb0d2e3c338dd9ff2b9653ec837
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exepid process 1652 07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exe 1652 07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exedescription pid process Token: SeDebugPrivilege 1652 07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exe"C:\Users\Admin\AppData\Local\Temp\07c3fb89bccdb5ef1b84d4d24576fb18ee399eda8a4f03aacef670268935a0d5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1652
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1652-119-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-120-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-121-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-122-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-123-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-124-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-125-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-126-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-127-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-128-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-129-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-130-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-131-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-132-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-133-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-135-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-136-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-137-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-138-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-139-0x0000000000C50000-0x0000000000D9A000-memory.dmpFilesize
1.3MB
-
memory/1652-140-0x0000000000C50000-0x0000000000D9A000-memory.dmpFilesize
1.3MB
-
memory/1652-141-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-142-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-143-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-144-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-145-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-146-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-147-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-148-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-149-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-150-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/1652-151-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-152-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-153-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-154-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-156-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-155-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-157-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-158-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-159-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-160-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-161-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-162-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-163-0x0000000002B80000-0x0000000002BB0000-memory.dmpFilesize
192KB
-
memory/1652-164-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-165-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-166-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-167-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-168-0x0000000005370000-0x000000000586E000-memory.dmpFilesize
5.0MB
-
memory/1652-169-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-170-0x0000000002D00000-0x0000000002D2E000-memory.dmpFilesize
184KB
-
memory/1652-171-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-172-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-173-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-174-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-175-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-176-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-177-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-178-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-179-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-180-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-181-0x0000000005870000-0x0000000005E76000-memory.dmpFilesize
6.0MB
-
memory/1652-182-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/1652-183-0x0000000005E80000-0x0000000005F8A000-memory.dmpFilesize
1.0MB
-
memory/1652-184-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-185-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-186-0x0000000005320000-0x000000000535E000-memory.dmpFilesize
248KB
-
memory/1652-187-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-188-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-189-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-190-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-191-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-192-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-193-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1652-194-0x00000000060C0000-0x000000000610B000-memory.dmpFilesize
300KB
-
memory/1652-199-0x0000000006260000-0x00000000062C6000-memory.dmpFilesize
408KB
-
memory/1652-207-0x00000000068E0000-0x0000000006956000-memory.dmpFilesize
472KB
-
memory/1652-208-0x00000000069A0000-0x0000000006A32000-memory.dmpFilesize
584KB
-
memory/1652-211-0x0000000006AC0000-0x0000000006ADE000-memory.dmpFilesize
120KB
-
memory/1652-212-0x0000000006DF0000-0x0000000006FB2000-memory.dmpFilesize
1.8MB
-
memory/1652-213-0x0000000006FC0000-0x00000000074EC000-memory.dmpFilesize
5.2MB
-
memory/1652-216-0x0000000000C50000-0x0000000000D9A000-memory.dmpFilesize
1.3MB
-
memory/1652-217-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/1652-222-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB