Analysis
-
max time kernel
155s -
max time network
107s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
26-06-2022 01:03
Static task
static1
General
-
Target
b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exe
-
Size
389KB
-
MD5
0a29b330e439e4ff0c05133b1efd09ea
-
SHA1
4b8ad70abce97b71a52a55ec0101ee1679e4758c
-
SHA256
b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef
-
SHA512
cc6809646cd95f75c54f118f11084480a3d89e506c2cb3d64d30738d156e3925f208f92e08dd14d0b351583252d94bf9c9547525d17b04561d35275f5dfebc78
Malware Config
Extracted
redline
RUZKI
193.106.191.246:23196
-
auth_value
121027c094f768a0a0e9b562f6417952
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exepid process 2260 b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exe 2260 b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exedescription pid process Token: SeDebugPrivilege 2260 b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exe"C:\Users\Admin\AppData\Local\Temp\b2ac037d43b8d8135b6f7a2392f6f9a6c56bf276fc7c0cf41acf99f42950e2ef.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2260-117-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-118-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-119-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-120-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-121-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-122-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-123-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-124-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-125-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-126-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-127-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-128-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-129-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-130-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-131-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-132-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-133-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-134-0x0000000000EA1000-0x0000000000ECB000-memory.dmpFilesize
168KB
-
memory/2260-135-0x0000000000DC0000-0x0000000000DF7000-memory.dmpFilesize
220KB
-
memory/2260-136-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-137-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-138-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-140-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-139-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-141-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-142-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-143-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-144-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-145-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-146-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/2260-147-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-148-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-149-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-150-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-151-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-152-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-153-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-154-0x0000000000EA1000-0x0000000000ECB000-memory.dmpFilesize
168KB
-
memory/2260-155-0x0000000000DC0000-0x0000000000DF7000-memory.dmpFilesize
220KB
-
memory/2260-156-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-157-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/2260-158-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-159-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-160-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-161-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-162-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-163-0x0000000002A40000-0x0000000002A70000-memory.dmpFilesize
192KB
-
memory/2260-164-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-165-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-166-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-167-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-168-0x0000000005380000-0x000000000587E000-memory.dmpFilesize
5.0MB
-
memory/2260-169-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-170-0x0000000002DD0000-0x0000000002DFE000-memory.dmpFilesize
184KB
-
memory/2260-171-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-172-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-173-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-174-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-175-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-176-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-177-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-178-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-179-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-180-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-181-0x0000000005A80000-0x0000000006086000-memory.dmpFilesize
6.0MB
-
memory/2260-182-0x0000000002BD0000-0x0000000002BE2000-memory.dmpFilesize
72KB
-
memory/2260-183-0x0000000006090000-0x000000000619A000-memory.dmpFilesize
1.0MB
-
memory/2260-184-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-185-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-186-0x0000000002C20000-0x0000000002C5E000-memory.dmpFilesize
248KB
-
memory/2260-187-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-188-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-189-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-190-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-191-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-192-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-193-0x0000000077440000-0x00000000775CE000-memory.dmpFilesize
1.6MB
-
memory/2260-194-0x0000000005300000-0x000000000534B000-memory.dmpFilesize
300KB
-
memory/2260-199-0x00000000063A0000-0x0000000006406000-memory.dmpFilesize
408KB
-
memory/2260-207-0x00000000067D0000-0x0000000006846000-memory.dmpFilesize
472KB
-
memory/2260-208-0x00000000068A0000-0x0000000006932000-memory.dmpFilesize
584KB
-
memory/2260-211-0x0000000006940000-0x000000000695E000-memory.dmpFilesize
120KB
-
memory/2260-212-0x0000000006BB0000-0x0000000006D72000-memory.dmpFilesize
1.8MB
-
memory/2260-213-0x0000000006D80000-0x00000000072AC000-memory.dmpFilesize
5.2MB