Analysis
-
max time kernel
51s -
max time network
60s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-06-2022 22:31
Static task
static1
General
-
Target
bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exe
-
Size
305KB
-
MD5
af5ad1b7a6203bec529846f40d25777d
-
SHA1
ac37f742458d9ed5337c3d4eddcfb7c32d83c853
-
SHA256
bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5
-
SHA512
77428f7742501653210a832a978cab5ffb4ac8852c6f798c810909f85fb7344ff5a56b2c67840ef7ba6103389027485f800aa475e1926a04fc45389af729a908
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exepid process 3768 bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exe 3768 bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exedescription pid process Token: SeDebugPrivilege 3768 bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exe"C:\Users\Admin\AppData\Local\Temp\bc08a66b7ffb858c35346ba6bb18b102827081e8032e884abdecedc0fd0d38f5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3768
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3768-117-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-118-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-119-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-120-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-121-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-122-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-124-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-125-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-126-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-127-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-123-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-128-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-129-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-130-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-131-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-132-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-133-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-135-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-136-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-134-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-137-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-138-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-139-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-140-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-141-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-142-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-143-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-144-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-145-0x0000000002F9A000-0x0000000002FC4000-memory.dmpFilesize
168KB
-
memory/3768-146-0x0000000002F10000-0x0000000002F47000-memory.dmpFilesize
220KB
-
memory/3768-147-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-148-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-149-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-150-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-151-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-152-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-153-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-154-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-155-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB
-
memory/3768-156-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-157-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-158-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-159-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-160-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-161-0x0000000004D00000-0x0000000004D30000-memory.dmpFilesize
192KB
-
memory/3768-162-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-163-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-164-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-165-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-166-0x0000000007440000-0x000000000793E000-memory.dmpFilesize
5.0MB
-
memory/3768-167-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-168-0x0000000004D90000-0x0000000004DBE000-memory.dmpFilesize
184KB
-
memory/3768-169-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-170-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-171-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-172-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-173-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-174-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-175-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-176-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-177-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-178-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-179-0x0000000007F50000-0x0000000008556000-memory.dmpFilesize
6.0MB
-
memory/3768-180-0x0000000004F90000-0x0000000004FA2000-memory.dmpFilesize
72KB
-
memory/3768-181-0x0000000007940000-0x0000000007A4A000-memory.dmpFilesize
1.0MB
-
memory/3768-182-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-183-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-184-0x0000000007A50000-0x0000000007A8E000-memory.dmpFilesize
248KB
-
memory/3768-185-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-186-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-187-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-188-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-189-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-190-0x0000000076F60000-0x00000000770EE000-memory.dmpFilesize
1.6MB
-
memory/3768-192-0x0000000007AC0000-0x0000000007B0B000-memory.dmpFilesize
300KB
-
memory/3768-196-0x0000000002F9A000-0x0000000002FC4000-memory.dmpFilesize
168KB
-
memory/3768-197-0x0000000002F10000-0x0000000002F47000-memory.dmpFilesize
220KB
-
memory/3768-199-0x0000000007D60000-0x0000000007DC6000-memory.dmpFilesize
408KB
-
memory/3768-207-0x0000000008A10000-0x0000000008A86000-memory.dmpFilesize
472KB
-
memory/3768-208-0x0000000008AE0000-0x0000000008B72000-memory.dmpFilesize
584KB
-
memory/3768-211-0x0000000008CE0000-0x0000000008CFE000-memory.dmpFilesize
120KB
-
memory/3768-212-0x0000000008F00000-0x00000000090C2000-memory.dmpFilesize
1.8MB
-
memory/3768-213-0x00000000090D0000-0x00000000095FC000-memory.dmpFilesize
5.2MB
-
memory/3768-220-0x0000000002F9A000-0x0000000002FC4000-memory.dmpFilesize
168KB
-
memory/3768-221-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB