Analysis
-
max time kernel
57s -
max time network
78s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
18-06-2022 06:01
Static task
static1
General
-
Target
05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe
-
Size
306KB
-
MD5
753b85917e8456e20bac69a229b17cae
-
SHA1
a7d353d7b7a7bcb422935b7d03812b6f62c225ab
-
SHA256
05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6
-
SHA512
c335e7607d1bd9aa5d25a8daa922c6191b34d3eb807f30a97efbc3916a4a818abbe5968dc9b95c7dff28fa20854d97aa2a11f98b6207caffb0d120bc6497398a
Malware Config
Extracted
redline
META
193.106.191.245:23196
-
auth_value
2ea67e19fe494687c77a179004b4a1c8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exedescription pid process target process PID 2756 set thread context of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exepid process 4576 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 4576 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exedescription pid process Token: SeDebugPrivilege 4576 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exedescription pid process target process PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe PID 2756 wrote to memory of 4576 2756 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe 05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe"C:\Users\Admin\AppData\Local\Temp\05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2756 -
C:\Users\Admin\AppData\Local\Temp\05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe"C:\Users\Admin\AppData\Local\Temp\05745825ddc88f8c0032fee69868537e73a36924439ee591b9850b3a405a2ee6.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4576
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2756-114-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-115-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-116-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-117-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-118-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-119-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-120-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-121-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-123-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-122-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-124-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-125-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-126-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-127-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-128-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-130-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-131-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-132-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-133-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-129-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-134-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-135-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-136-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-137-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-138-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-139-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-140-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-141-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-142-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/2756-146-0x0000000002E5A000-0x0000000002E85000-memory.dmpFilesize
172KB
-
memory/4576-143-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4576-144-0x000000000040CD2F-mapping.dmp
-
memory/4576-145-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-147-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-148-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-149-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-150-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-151-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4576-152-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-153-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-154-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-155-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-156-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-157-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-159-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-160-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-161-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-163-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-164-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-165-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-166-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4576-167-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-168-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-162-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-158-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-169-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-170-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-171-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-172-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-173-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-174-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-175-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-176-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-177-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-178-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-179-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB
-
memory/4576-180-0x0000000077140000-0x00000000772CE000-memory.dmpFilesize
1.6MB
-
memory/4576-185-0x0000000002160000-0x0000000002190000-memory.dmpFilesize
192KB
-
memory/4576-190-0x0000000004A60000-0x0000000004F5E000-memory.dmpFilesize
5.0MB
-
memory/4576-192-0x00000000024E0000-0x000000000250E000-memory.dmpFilesize
184KB
-
memory/4576-203-0x0000000004F60000-0x0000000005566000-memory.dmpFilesize
6.0MB
-
memory/4576-204-0x00000000026D0000-0x00000000026E2000-memory.dmpFilesize
72KB
-
memory/4576-205-0x0000000005570000-0x000000000567A000-memory.dmpFilesize
1.0MB
-
memory/4576-208-0x0000000005690000-0x00000000056CE000-memory.dmpFilesize
248KB
-
memory/4576-216-0x0000000005700000-0x000000000574B000-memory.dmpFilesize
300KB
-
memory/4576-221-0x00000000058A0000-0x0000000005906000-memory.dmpFilesize
408KB
-
memory/4576-229-0x0000000006020000-0x0000000006096000-memory.dmpFilesize
472KB
-
memory/4576-230-0x00000000060E0000-0x0000000006172000-memory.dmpFilesize
584KB
-
memory/4576-233-0x0000000006200000-0x000000000621E000-memory.dmpFilesize
120KB
-
memory/4576-234-0x0000000006430000-0x00000000065F2000-memory.dmpFilesize
1.8MB
-
memory/4576-235-0x0000000006600000-0x0000000006B2C000-memory.dmpFilesize
5.2MB
-
memory/4576-242-0x0000000000400000-0x000000000043A000-memory.dmpFilesize
232KB