Analysis
-
max time kernel
54s -
max time network
143s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
18-06-2022 01:31
Static task
static1
General
-
Target
211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exe
-
Size
306KB
-
MD5
d039ee6755e8f7f28d5bf5e17c1b0ba8
-
SHA1
dcb717b458bd2135fbfe3f74b7132111e9da1775
-
SHA256
211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5
-
SHA512
5c9d1a60e407859616312df6d25d817d3f15713ec7509b041410a9d982e30ceaaeb284af7ac74c0e2b34a131b7bc1ed698160be7e6ce6b3ce5f0c907b1b0a9d8
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exepid process 1728 211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exe 1728 211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exedescription pid process Token: SeDebugPrivilege 1728 211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exe"C:\Users\Admin\AppData\Local\Temp\211ad74399b310e05181a8958999abfa60aa2981d9727d7fe8e6371cdcc217a5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1728-119-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-120-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-121-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-122-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-123-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-124-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-126-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-125-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-127-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-128-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-129-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-130-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-131-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-132-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-134-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-133-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-136-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-135-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-137-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-138-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-139-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-140-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-141-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-142-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-143-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-144-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-145-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-146-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-147-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-148-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-149-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-150-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-151-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-153-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-152-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-154-0x0000000002F2A000-0x0000000002F54000-memory.dmpFilesize
168KB
-
memory/1728-155-0x00000000049B0000-0x00000000049E7000-memory.dmpFilesize
220KB
-
memory/1728-156-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-157-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-158-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB
-
memory/1728-161-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-162-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-163-0x0000000004E00000-0x0000000004E30000-memory.dmpFilesize
192KB
-
memory/1728-164-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-160-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-159-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-165-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-166-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-167-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-168-0x00000000073D0000-0x00000000078CE000-memory.dmpFilesize
5.0MB
-
memory/1728-170-0x00000000072F0000-0x000000000731E000-memory.dmpFilesize
184KB
-
memory/1728-169-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-171-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-172-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-173-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-174-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-175-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-176-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-177-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-178-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-179-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-180-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-181-0x00000000078D0000-0x0000000007ED6000-memory.dmpFilesize
6.0MB
-
memory/1728-182-0x0000000007F00000-0x0000000007F12000-memory.dmpFilesize
72KB
-
memory/1728-183-0x0000000007F30000-0x000000000803A000-memory.dmpFilesize
1.0MB
-
memory/1728-184-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-186-0x0000000008060000-0x000000000809E000-memory.dmpFilesize
248KB
-
memory/1728-185-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-187-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-188-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-189-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-190-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-191-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-192-0x00000000771D0000-0x000000007735E000-memory.dmpFilesize
1.6MB
-
memory/1728-194-0x00000000080D0000-0x000000000811B000-memory.dmpFilesize
300KB
-
memory/1728-198-0x0000000008370000-0x00000000083E6000-memory.dmpFilesize
472KB
-
memory/1728-199-0x00000000083F0000-0x0000000008482000-memory.dmpFilesize
584KB
-
memory/1728-202-0x00000000084D0000-0x00000000084EE000-memory.dmpFilesize
120KB
-
memory/1728-204-0x0000000008680000-0x00000000086E6000-memory.dmpFilesize
408KB
-
memory/1728-212-0x0000000008E70000-0x0000000009032000-memory.dmpFilesize
1.8MB
-
memory/1728-213-0x0000000009050000-0x000000000957C000-memory.dmpFilesize
5.2MB
-
memory/1728-214-0x0000000002F2A000-0x0000000002F54000-memory.dmpFilesize
168KB
-
memory/1728-221-0x0000000002F2A000-0x0000000002F54000-memory.dmpFilesize
168KB
-
memory/1728-222-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB