Analysis
-
max time kernel
54s -
max time network
57s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-06-2022 08:01
Static task
static1
General
-
Target
bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exe
-
Size
377KB
-
MD5
5604d92fe68de1f8809d97ddb97f35a4
-
SHA1
cc18fd0a5c5af813e082157146c372526a4256b8
-
SHA256
bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221
-
SHA512
f09466667125fb7f77cfc873d6a7118ab76d91303501aaf03499f42771fada156c982d47da9a491445eeeb700355ac25b79720610fd85da4fb099d249e6ba884
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exepid process 2356 bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exe 2356 bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exedescription pid process Token: SeDebugPrivilege 2356 bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exe"C:\Users\Admin\AppData\Local\Temp\bf4b2ed4bf21b2785dae516b669b5d9ac4e0420d2f8183b691f183c76555c221.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2356
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2356-118-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-119-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-120-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-121-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-122-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-123-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-124-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-125-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-126-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-127-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-128-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-129-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-130-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-131-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-132-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-134-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-135-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-133-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-136-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-137-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-138-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-139-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-141-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-142-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-143-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-144-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-145-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-146-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-147-0x0000000000780000-0x00000000008CA000-memory.dmpFilesize
1.3MB
-
memory/2356-148-0x0000000000780000-0x00000000008CA000-memory.dmpFilesize
1.3MB
-
memory/2356-150-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB
-
memory/2356-149-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-151-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-152-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-153-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-154-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-156-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-155-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-157-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-158-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-159-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-160-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-161-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-162-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-163-0x0000000002380000-0x00000000023B0000-memory.dmpFilesize
192KB
-
memory/2356-164-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-165-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-166-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-167-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-168-0x0000000004D00000-0x00000000051FE000-memory.dmpFilesize
5.0MB
-
memory/2356-169-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-170-0x00000000026B0000-0x00000000026DE000-memory.dmpFilesize
184KB
-
memory/2356-171-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-172-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-173-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-174-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-175-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-176-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-177-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-178-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-179-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-180-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-181-0x0000000005200000-0x0000000005806000-memory.dmpFilesize
6.0MB
-
memory/2356-182-0x0000000004CB0000-0x0000000004CC2000-memory.dmpFilesize
72KB
-
memory/2356-183-0x0000000005810000-0x000000000591A000-memory.dmpFilesize
1.0MB
-
memory/2356-184-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-185-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-186-0x0000000005930000-0x000000000596E000-memory.dmpFilesize
248KB
-
memory/2356-187-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-188-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-189-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-190-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-191-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-192-0x0000000077CE0000-0x0000000077E6E000-memory.dmpFilesize
1.6MB
-
memory/2356-194-0x00000000059A0000-0x00000000059EB000-memory.dmpFilesize
300KB
-
memory/2356-198-0x0000000005C40000-0x0000000005CB6000-memory.dmpFilesize
472KB
-
memory/2356-199-0x0000000005D30000-0x0000000005DC2000-memory.dmpFilesize
584KB
-
memory/2356-202-0x0000000005CC0000-0x0000000005CDE000-memory.dmpFilesize
120KB
-
memory/2356-204-0x0000000005F20000-0x0000000005F86000-memory.dmpFilesize
408KB
-
memory/2356-212-0x0000000006640000-0x0000000006802000-memory.dmpFilesize
1.8MB
-
memory/2356-213-0x0000000006820000-0x0000000006D4C000-memory.dmpFilesize
5.2MB
-
memory/2356-216-0x0000000000780000-0x00000000008CA000-memory.dmpFilesize
1.3MB
-
memory/2356-217-0x0000000000780000-0x00000000008CA000-memory.dmpFilesize
1.3MB
-
memory/2356-218-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB
-
memory/2356-223-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB