Analysis
-
max time kernel
54s -
max time network
75s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
26-06-2022 12:03
Static task
static1
General
-
Target
dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exe
-
Size
389KB
-
MD5
22409c56c2acb74d9f2cbe70d88de235
-
SHA1
5edbe2741741f48c3daf1d4e037078efd15ddaef
-
SHA256
dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7
-
SHA512
2fc883f7a336304645518a1f13915b0e0b654f558efdab5b7231d9c483690ce1c91d1e5545219c3f701b044552e1433b076cf5029122c19bffc30e2e13a90d28
Malware Config
Extracted
redline
RUZKI
193.106.191.246:23196
-
auth_value
121027c094f768a0a0e9b562f6417952
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exepid process 3664 dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exe 3664 dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exedescription pid process Token: SeDebugPrivilege 3664 dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exe"C:\Users\Admin\AppData\Local\Temp\dc08bb32d2c58f89d2c38598c1e3fafef12b69ea5dbfcb4b7431ece37b558be7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3664-114-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-115-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-116-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-117-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-118-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-119-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-120-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-122-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-123-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-124-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-125-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-126-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-127-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-128-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-129-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-130-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-131-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-132-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-133-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-134-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-135-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-136-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-137-0x0000000000B60000-0x0000000000C0E000-memory.dmpFilesize
696KB
-
memory/3664-138-0x0000000002770000-0x00000000027A7000-memory.dmpFilesize
220KB
-
memory/3664-139-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-140-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-141-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-142-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-143-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-144-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-145-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-146-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-148-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/3664-147-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-149-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-151-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-150-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-152-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-153-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-154-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-155-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-156-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-157-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-158-0x0000000002A40000-0x0000000002A70000-memory.dmpFilesize
192KB
-
memory/3664-159-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-160-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-161-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-162-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-163-0x0000000005420000-0x000000000591E000-memory.dmpFilesize
5.0MB
-
memory/3664-164-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-165-0x0000000002DC0000-0x0000000002DEE000-memory.dmpFilesize
184KB
-
memory/3664-166-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-167-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-168-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-169-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-170-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-171-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-172-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-173-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-174-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-175-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-176-0x0000000005920000-0x0000000005F26000-memory.dmpFilesize
6.0MB
-
memory/3664-177-0x00000000052D0000-0x00000000052E2000-memory.dmpFilesize
72KB
-
memory/3664-178-0x0000000005300000-0x000000000540A000-memory.dmpFilesize
1.0MB
-
memory/3664-179-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-180-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-181-0x0000000005F50000-0x0000000005F8E000-memory.dmpFilesize
248KB
-
memory/3664-182-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-183-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-184-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-185-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-186-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-187-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-188-0x0000000077970000-0x0000000077AFE000-memory.dmpFilesize
1.6MB
-
memory/3664-189-0x00000000060C0000-0x000000000610B000-memory.dmpFilesize
300KB
-
memory/3664-193-0x0000000006260000-0x00000000062D6000-memory.dmpFilesize
472KB
-
memory/3664-194-0x0000000000B60000-0x0000000000C0E000-memory.dmpFilesize
696KB
-
memory/3664-195-0x0000000002770000-0x00000000027A7000-memory.dmpFilesize
220KB
-
memory/3664-196-0x0000000006350000-0x00000000063E2000-memory.dmpFilesize
584KB
-
memory/3664-199-0x0000000006230000-0x000000000624E000-memory.dmpFilesize
120KB
-
memory/3664-201-0x0000000006560000-0x00000000065C6000-memory.dmpFilesize
408KB
-
memory/3664-209-0x0000000006D60000-0x0000000006F22000-memory.dmpFilesize
1.8MB
-
memory/3664-210-0x0000000006F40000-0x000000000746C000-memory.dmpFilesize
5.2MB
-
memory/3664-217-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB