Analysis
-
max time kernel
52s -
max time network
72s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-06-2022 14:11
Static task
static1
General
-
Target
4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exe
-
Size
379KB
-
MD5
41aa2d8645f76c0ce0c5d3862150fc78
-
SHA1
ae0ddb329bd9d43c8b512d1afa1768c566ed81b5
-
SHA256
4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055
-
SHA512
b6041c61d54245b2224d8e776e8be91431aa253442c831ead464c353b358270e52faeb8af9f6efcf6710f6140ee9820bb97fd83c607316699b8507c16ec669e4
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exepid process 3832 4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exe 3832 4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exedescription pid process Token: SeDebugPrivilege 3832 4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exe"C:\Users\Admin\AppData\Local\Temp\4c0e459fe51caf92d61f677b8d12228c314d2c4be3084030f7b159d8524d8055.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3832-119-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-120-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-121-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-122-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-123-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-124-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-125-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-127-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-126-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-129-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-130-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-128-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-131-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-132-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-133-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-134-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-135-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-136-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-137-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-138-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-139-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-140-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-141-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-142-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-143-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-144-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-145-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-146-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-147-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-148-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-149-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-150-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-151-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-152-0x00000000009DA000-0x0000000000A04000-memory.dmpFilesize
168KB
-
memory/3832-154-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-155-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-156-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB
-
memory/3832-153-0x00000000007E0000-0x0000000000817000-memory.dmpFilesize
220KB
-
memory/3832-157-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-158-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-159-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-160-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-162-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-164-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-165-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-166-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-163-0x0000000002530000-0x0000000002560000-memory.dmpFilesize
192KB
-
memory/3832-167-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-161-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-170-0x0000000002810000-0x000000000283E000-memory.dmpFilesize
184KB
-
memory/3832-169-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-171-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-168-0x0000000004DE0000-0x00000000052DE000-memory.dmpFilesize
5.0MB
-
memory/3832-172-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-173-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-174-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-175-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-176-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-177-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-178-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-179-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-180-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-182-0x0000000002A70000-0x0000000002A82000-memory.dmpFilesize
72KB
-
memory/3832-183-0x0000000005940000-0x0000000005A4A000-memory.dmpFilesize
1.0MB
-
memory/3832-181-0x00000000052E0000-0x00000000058E6000-memory.dmpFilesize
6.0MB
-
memory/3832-184-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-186-0x0000000005A70000-0x0000000005AAE000-memory.dmpFilesize
248KB
-
memory/3832-185-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-187-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-190-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-191-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-192-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-189-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-188-0x0000000077B10000-0x0000000077C9E000-memory.dmpFilesize
1.6MB
-
memory/3832-194-0x0000000005AE0000-0x0000000005B2B000-memory.dmpFilesize
300KB
-
memory/3832-198-0x0000000005D80000-0x0000000005DF6000-memory.dmpFilesize
472KB
-
memory/3832-199-0x0000000005E70000-0x0000000005F02000-memory.dmpFilesize
584KB
-
memory/3832-202-0x0000000005D50000-0x0000000005D6E000-memory.dmpFilesize
120KB
-
memory/3832-204-0x00000000060B0000-0x0000000006116000-memory.dmpFilesize
408KB
-
memory/3832-212-0x0000000006A10000-0x0000000006BD2000-memory.dmpFilesize
1.8MB
-
memory/3832-213-0x0000000006BE0000-0x000000000710C000-memory.dmpFilesize
5.2MB
-
memory/3832-221-0x0000000000400000-0x000000000067B000-memory.dmpFilesize
2.5MB
-
memory/3832-220-0x00000000009DA000-0x0000000000A04000-memory.dmpFilesize
168KB