Analysis
-
max time kernel
50s -
max time network
73s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
25-06-2022 20:16
Static task
static1
General
-
Target
6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exe
-
Size
388KB
-
MD5
66d69e373c82b48c75ae5c95afb3d733
-
SHA1
64a010071218c9519ab8ec68fccd15ef472742aa
-
SHA256
6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8
-
SHA512
dba4478c20da9f076161b9882b63ead7066fab000100800e7ac85d16bddbc40f9dfea991176fc9697d30d41c12816074633b6ddad57f97937d5beeeaa4e2089e
Malware Config
Extracted
redline
RUZKI
193.106.191.246:23196
-
auth_value
121027c094f768a0a0e9b562f6417952
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exepid process 1820 6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exe 1820 6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exedescription pid process Token: SeDebugPrivilege 1820 6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exe"C:\Users\Admin\AppData\Local\Temp\6f3684a400dd071f47887a983e1e740733e184a7764af99289f11bee1eec38f8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1820-116-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-117-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-118-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-119-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-120-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-121-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-122-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-124-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-125-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-126-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-127-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-128-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-130-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-129-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-131-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-132-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-133-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-134-0x0000000000C40000-0x0000000000D8A000-memory.dmpFilesize
1.3MB
-
memory/1820-135-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-136-0x0000000000C40000-0x0000000000D8A000-memory.dmpFilesize
1.3MB
-
memory/1820-138-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-137-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-139-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-140-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-141-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-142-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-143-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-144-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-145-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-146-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-147-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-149-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/1820-148-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-150-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-151-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-152-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-153-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-154-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-155-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-156-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-157-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-158-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-159-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-161-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-160-0x00000000028B0000-0x00000000028E0000-memory.dmpFilesize
192KB
-
memory/1820-162-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-163-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-164-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-165-0x00000000052D0000-0x00000000057CE000-memory.dmpFilesize
5.0MB
-
memory/1820-166-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-167-0x0000000002C30000-0x0000000002C5E000-memory.dmpFilesize
184KB
-
memory/1820-168-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-169-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-170-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-171-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-172-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-173-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-175-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-174-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-176-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-177-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-178-0x00000000057D0000-0x0000000005DD6000-memory.dmpFilesize
6.0MB
-
memory/1820-179-0x0000000002E40000-0x0000000002E52000-memory.dmpFilesize
72KB
-
memory/1820-180-0x0000000005DE0000-0x0000000005EEA000-memory.dmpFilesize
1.0MB
-
memory/1820-181-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-182-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-183-0x00000000051E0000-0x000000000521E000-memory.dmpFilesize
248KB
-
memory/1820-184-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-185-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-186-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-187-0x0000000000C40000-0x0000000000D8A000-memory.dmpFilesize
1.3MB
-
memory/1820-188-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/1820-189-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-190-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-191-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-192-0x0000000077600000-0x000000007778E000-memory.dmpFilesize
1.6MB
-
memory/1820-193-0x0000000005250000-0x000000000529B000-memory.dmpFilesize
300KB
-
memory/1820-197-0x0000000006120000-0x0000000006196000-memory.dmpFilesize
472KB
-
memory/1820-198-0x0000000006210000-0x00000000062A2000-memory.dmpFilesize
584KB
-
memory/1820-201-0x00000000060F0000-0x000000000610E000-memory.dmpFilesize
120KB
-
memory/1820-203-0x0000000006420000-0x0000000006486000-memory.dmpFilesize
408KB
-
memory/1820-211-0x0000000006C20000-0x0000000006DE2000-memory.dmpFilesize
1.8MB
-
memory/1820-212-0x0000000006E00000-0x000000000732C000-memory.dmpFilesize
5.2MB
-
memory/1820-219-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB