Analysis
-
max time kernel
95s -
max time network
98s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-06-2022 05:51
Static task
static1
General
-
Target
2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exe
-
Size
378KB
-
MD5
59508f67553e3c02ca1a938fd5032859
-
SHA1
b9f6f0766673b85339342164c3378a253241177d
-
SHA256
2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29
-
SHA512
ab062907c2bbd18567c4264905179d619545ef4e5762553595a306bbe11c81ff8bb06ce47b3e5e881e0dd40e25e67ac48e6f435eea01c16f0dc89169595fe050
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exepid process 412 2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exe 412 2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exedescription pid process Token: SeDebugPrivilege 412 2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exe"C:\Users\Admin\AppData\Local\Temp\2e1528587c5982a969aaf3047868a6cedb7fbf13bb122ac18ca845516ccafe29.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:412
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/412-118-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-119-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-120-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-121-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-122-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-123-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-124-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-125-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-126-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-127-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-128-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-129-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-130-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-131-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-132-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-133-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-134-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-135-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-136-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-137-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-138-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-139-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-141-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-142-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-143-0x00000000007B0000-0x00000000008FA000-memory.dmpFilesize
1.3MB
-
memory/412-144-0x0000000002390000-0x00000000023C7000-memory.dmpFilesize
220KB
-
memory/412-145-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-146-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-148-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-147-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-149-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-150-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-151-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-152-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB
-
memory/412-153-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-154-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-155-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-156-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-157-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-158-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-159-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-160-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-161-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-162-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-163-0x00000000026D0000-0x0000000002700000-memory.dmpFilesize
192KB
-
memory/412-164-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-165-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-166-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-167-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-168-0x0000000004F90000-0x000000000548E000-memory.dmpFilesize
5.0MB
-
memory/412-169-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-170-0x00000000028A0000-0x00000000028CE000-memory.dmpFilesize
184KB
-
memory/412-171-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-172-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-173-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-174-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-175-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-176-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-177-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-178-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-179-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-180-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-181-0x0000000005AA0000-0x00000000060A6000-memory.dmpFilesize
6.0MB
-
memory/412-182-0x0000000002AA0000-0x0000000002AB2000-memory.dmpFilesize
72KB
-
memory/412-183-0x0000000004E40000-0x0000000004F4A000-memory.dmpFilesize
1.0MB
-
memory/412-184-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-185-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-186-0x0000000005490000-0x00000000054CE000-memory.dmpFilesize
248KB
-
memory/412-187-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-188-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-189-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-190-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-191-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-192-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/412-194-0x00000000054D0000-0x000000000551B000-memory.dmpFilesize
300KB
-
memory/412-199-0x0000000005770000-0x00000000057D6000-memory.dmpFilesize
408KB
-
memory/412-207-0x0000000006420000-0x0000000006496000-memory.dmpFilesize
472KB
-
memory/412-208-0x0000000006500000-0x0000000006592000-memory.dmpFilesize
584KB
-
memory/412-211-0x00000000066E0000-0x00000000066FE000-memory.dmpFilesize
120KB
-
memory/412-212-0x00000000007B0000-0x00000000008FA000-memory.dmpFilesize
1.3MB
-
memory/412-213-0x0000000002390000-0x00000000023C7000-memory.dmpFilesize
220KB
-
memory/412-214-0x0000000006910000-0x0000000006AD2000-memory.dmpFilesize
1.8MB
-
memory/412-215-0x0000000006AE0000-0x000000000700C000-memory.dmpFilesize
5.2MB
-
memory/412-222-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB