Analysis
-
max time kernel
52s -
max time network
153s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
18-06-2022 04:21
Static task
static1
General
-
Target
d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exe
-
Size
306KB
-
MD5
4a3ccfa5a45b36b7cb76479f5a78a40b
-
SHA1
43245eea66e099421eb4a8ca8d61556f1cb010b3
-
SHA256
d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595
-
SHA512
d5aeaae17c0641dbd452bd2e68983814b95dc23777b75ae0b2e44b27c70c771991cdeb0e3d0cdb0f111a5e5f14fd22962e38b207f71a21003f3897f6f62988d0
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exepid process 4688 d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exe 4688 d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exedescription pid process Token: SeDebugPrivilege 4688 d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exe"C:\Users\Admin\AppData\Local\Temp\d110530e4b04c058461a34e51a1b2cc9ad9ca0c3344f9b47ec311d1020c3f595.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4688
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4688-117-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-118-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-119-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-120-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-121-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-122-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-123-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-125-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-124-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-126-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-127-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-128-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-129-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-130-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-131-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-132-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-133-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-134-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-135-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-136-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-137-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-138-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-139-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-140-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-142-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-143-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-144-0x0000000002D50000-0x0000000002E9A000-memory.dmpFilesize
1.3MB
-
memory/4688-145-0x00000000049A0000-0x00000000049D7000-memory.dmpFilesize
220KB
-
memory/4688-146-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-147-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-148-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-149-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-150-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-151-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-152-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-153-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-154-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-155-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-156-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-158-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-157-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB
-
memory/4688-159-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-160-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-161-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-162-0x0000000004CC0000-0x0000000004CF0000-memory.dmpFilesize
192KB
-
memory/4688-163-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-164-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-165-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-166-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-167-0x0000000007470000-0x000000000796E000-memory.dmpFilesize
5.0MB
-
memory/4688-168-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-169-0x00000000072F0000-0x000000000731E000-memory.dmpFilesize
184KB
-
memory/4688-170-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-171-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-172-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-173-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-174-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-175-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-176-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-177-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-178-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-179-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-180-0x0000000007970000-0x0000000007F76000-memory.dmpFilesize
6.0MB
-
memory/4688-181-0x00000000073E0000-0x00000000073F2000-memory.dmpFilesize
72KB
-
memory/4688-182-0x0000000007F80000-0x000000000808A000-memory.dmpFilesize
1.0MB
-
memory/4688-183-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-184-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-185-0x0000000008090000-0x00000000080CE000-memory.dmpFilesize
248KB
-
memory/4688-186-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-187-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-188-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-189-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-190-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-191-0x00000000778F0000-0x0000000077A7E000-memory.dmpFilesize
1.6MB
-
memory/4688-193-0x00000000080D0000-0x000000000811B000-memory.dmpFilesize
300KB
-
memory/4688-198-0x0000000008370000-0x00000000083D6000-memory.dmpFilesize
408KB
-
memory/4688-206-0x0000000008A10000-0x0000000008A86000-memory.dmpFilesize
472KB
-
memory/4688-207-0x0000000008AC0000-0x0000000008B52000-memory.dmpFilesize
584KB
-
memory/4688-210-0x0000000008B90000-0x0000000008BAE000-memory.dmpFilesize
120KB
-
memory/4688-211-0x0000000002D50000-0x0000000002E9A000-memory.dmpFilesize
1.3MB
-
memory/4688-212-0x00000000049A0000-0x00000000049D7000-memory.dmpFilesize
220KB
-
memory/4688-213-0x0000000008F00000-0x00000000090C2000-memory.dmpFilesize
1.8MB
-
memory/4688-214-0x00000000090D0000-0x00000000095FC000-memory.dmpFilesize
5.2MB
-
memory/4688-221-0x0000000000400000-0x0000000002C6B000-memory.dmpFilesize
40.4MB