Analysis
-
max time kernel
139s -
max time network
141s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
17-06-2022 18:41
Static task
static1
General
-
Target
8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exe
-
Size
305KB
-
MD5
bc9c28575dc4d138d79aaa06c2136fb9
-
SHA1
ccab4aaff69151955b1bd9d31923a7c9216e57d2
-
SHA256
8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8
-
SHA512
753e755ce9e9a4039325c8680615e4bbc5cfa613c805f4422718e16636f00e5d98e047112a59d24431fd5ac62635961521d0cf18886f2d32a663b2800d329d4a
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exepid process 3604 8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exe 3604 8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exedescription pid process Token: SeDebugPrivilege 3604 8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exe"C:\Users\Admin\AppData\Local\Temp\8c0575bbf0921b7eb45f1683e47e020441a7b6b112f2d16e96163e6a37b2f1d8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3604-116-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-117-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-118-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-119-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-120-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-121-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-122-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-123-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-125-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-124-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-126-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-128-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-127-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-129-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-131-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-130-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-133-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-132-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-134-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-135-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-137-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-136-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-138-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-139-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-141-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-142-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-143-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-144-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-145-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-146-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-147-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-148-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-149-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-151-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-150-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-152-0x0000000002C70000-0x0000000002D1E000-memory.dmpFilesize
696KB
-
memory/3604-153-0x0000000004A10000-0x0000000004A47000-memory.dmpFilesize
220KB
-
memory/3604-154-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-155-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-156-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB
-
memory/3604-157-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-158-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-159-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-160-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-161-0x0000000004DE0000-0x0000000004E10000-memory.dmpFilesize
192KB
-
memory/3604-162-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-163-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-164-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-165-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-166-0x0000000007400000-0x00000000078FE000-memory.dmpFilesize
5.0MB
-
memory/3604-167-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-168-0x0000000007300000-0x000000000732E000-memory.dmpFilesize
184KB
-
memory/3604-169-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-170-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-171-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-172-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-173-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-174-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-175-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-176-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-177-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-178-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-179-0x0000000007900000-0x0000000007F06000-memory.dmpFilesize
6.0MB
-
memory/3604-180-0x0000000007F10000-0x0000000007F22000-memory.dmpFilesize
72KB
-
memory/3604-181-0x0000000007F30000-0x000000000803A000-memory.dmpFilesize
1.0MB
-
memory/3604-182-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-183-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-184-0x0000000008060000-0x000000000809E000-memory.dmpFilesize
248KB
-
memory/3604-185-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-186-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-187-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-188-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-189-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-190-0x00000000770D0000-0x000000007725E000-memory.dmpFilesize
1.6MB
-
memory/3604-192-0x00000000080D0000-0x000000000811B000-memory.dmpFilesize
300KB
-
memory/3604-197-0x0000000008370000-0x00000000083D6000-memory.dmpFilesize
408KB
-
memory/3604-205-0x0000000008A20000-0x0000000008A96000-memory.dmpFilesize
472KB
-
memory/3604-206-0x0000000008AF0000-0x0000000008B82000-memory.dmpFilesize
584KB
-
memory/3604-209-0x0000000008CF0000-0x0000000008D0E000-memory.dmpFilesize
120KB
-
memory/3604-210-0x0000000002C70000-0x0000000002D1E000-memory.dmpFilesize
696KB
-
memory/3604-211-0x0000000008F00000-0x00000000090C2000-memory.dmpFilesize
1.8MB
-
memory/3604-212-0x00000000090D0000-0x00000000095FC000-memory.dmpFilesize
5.2MB
-
memory/3604-219-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB