Analysis
-
max time kernel
50s -
max time network
63s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
27-06-2022 08:01
Static task
static1
General
-
Target
19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exe
-
Size
389KB
-
MD5
75d2d10c413f8e86096163cbf8cafef2
-
SHA1
256302b80e803ba7527499425392b98135b9532c
-
SHA256
19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203
-
SHA512
30a324fded61c544ee25adef64f5c18221cb1d931d1a5a3d22d60e52d3eea553bb6db546c7a6a54152718d9b011ce6f6f7a209696b64c96dfd485bd4da8ed9ca
Malware Config
Extracted
redline
RUZKI
193.106.191.246:23196
-
auth_value
121027c094f768a0a0e9b562f6417952
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exepid process 4468 19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exe 4468 19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exedescription pid process Token: SeDebugPrivilege 4468 19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exe"C:\Users\Admin\AppData\Local\Temp\19617d10b29676cfeb039c25c8dc9f9b361e6590dae0e28d62edbdb814642203.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4468-117-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-118-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-119-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-120-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-121-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-122-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-123-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-124-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-125-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-126-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-127-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-128-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-130-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-129-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-131-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-132-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-133-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-134-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-135-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-136-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-137-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-138-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-139-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-140-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-141-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-143-0x0000000000EB0000-0x0000000000EE7000-memory.dmpFilesize
220KB
-
memory/4468-144-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-142-0x0000000000CC1000-0x0000000000CEB000-memory.dmpFilesize
168KB
-
memory/4468-145-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-146-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-147-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-148-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-149-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-150-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-152-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-151-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-153-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/4468-154-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-155-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-156-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-157-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-158-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-159-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-161-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-160-0x0000000002900000-0x0000000002930000-memory.dmpFilesize
192KB
-
memory/4468-162-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-163-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-164-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-165-0x00000000054E0000-0x00000000059DE000-memory.dmpFilesize
5.0MB
-
memory/4468-166-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-167-0x0000000002CE0000-0x0000000002D0E000-memory.dmpFilesize
184KB
-
memory/4468-168-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-169-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-170-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-171-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-172-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-173-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-174-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-175-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-176-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-177-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-178-0x00000000059E0000-0x0000000005FE6000-memory.dmpFilesize
6.0MB
-
memory/4468-179-0x00000000052E0000-0x00000000052F2000-memory.dmpFilesize
72KB
-
memory/4468-180-0x0000000005300000-0x000000000540A000-memory.dmpFilesize
1.0MB
-
memory/4468-181-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-182-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-183-0x0000000005430000-0x000000000546E000-memory.dmpFilesize
248KB
-
memory/4468-184-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-185-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-186-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-187-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-188-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-189-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-190-0x0000000077B70000-0x0000000077CFE000-memory.dmpFilesize
1.6MB
-
memory/4468-191-0x0000000005FF0000-0x000000000603B000-memory.dmpFilesize
300KB
-
memory/4468-196-0x0000000006260000-0x00000000062C6000-memory.dmpFilesize
408KB
-
memory/4468-204-0x0000000006910000-0x0000000006986000-memory.dmpFilesize
472KB
-
memory/4468-205-0x00000000069C0000-0x0000000006A52000-memory.dmpFilesize
584KB
-
memory/4468-208-0x0000000006BC0000-0x0000000006BDE000-memory.dmpFilesize
120KB
-
memory/4468-209-0x0000000000CC1000-0x0000000000CEB000-memory.dmpFilesize
168KB
-
memory/4468-210-0x0000000006DF0000-0x0000000006FB2000-memory.dmpFilesize
1.8MB
-
memory/4468-211-0x0000000006FC0000-0x00000000074EC000-memory.dmpFilesize
5.2MB
-
memory/4468-218-0x0000000000400000-0x0000000000B54000-memory.dmpFilesize
7.3MB
-
memory/4468-219-0x0000000000CC1000-0x0000000000CEB000-memory.dmpFilesize
168KB