Analysis
-
max time kernel
52s -
max time network
74s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
06-07-2022 12:20
Static task
static1
General
-
Target
6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exe
-
Size
395KB
-
MD5
63245c865cbd91d32654728e91dc2af3
-
SHA1
c361bedd0aeb9c991adc879079b959b53dd393d9
-
SHA256
6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2
-
SHA512
08d054f4833265ae7e19969aea4d6808826c62af0ed9de06135a3bf58566007f8997a0898f0b50de214c93d0fcfd71aa67fd3ebe8c70e16532b080456a731a0d
Malware Config
Extracted
redline
ib1.4
levelcupsecurity.eu:80
-
auth_value
363e918b58f663fdb3c6d525cf98d4b0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exepid process 3460 6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exe 3460 6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exedescription pid process Token: SeDebugPrivilege 3460 6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exe"C:\Users\Admin\AppData\Local\Temp\6d3d678f0be39c51fbbb94a40cc9da4a36d9eae49d7f57787218c59e7228e7d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3460-116-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-117-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-118-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-119-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-120-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-121-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-122-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-123-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-124-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-125-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-126-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-127-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-128-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-129-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-130-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-132-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-133-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-134-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-135-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-136-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-137-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-139-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-140-0x00000000027C0000-0x00000000027F8000-memory.dmpFilesize
224KB
-
memory/3460-141-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-138-0x0000000000BE0000-0x0000000000D2A000-memory.dmpFilesize
1.3MB
-
memory/3460-142-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-143-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-144-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-145-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-146-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-147-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-148-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-149-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-150-0x0000000000400000-0x0000000000A94000-memory.dmpFilesize
6.6MB
-
memory/3460-151-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-152-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-153-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-154-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-155-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-156-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-157-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-158-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-159-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-160-0x0000000002A30000-0x0000000002A60000-memory.dmpFilesize
192KB
-
memory/3460-161-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-162-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-163-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-164-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-165-0x00000000052F0000-0x00000000057EE000-memory.dmpFilesize
5.0MB
-
memory/3460-166-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-167-0x0000000002C20000-0x0000000002C50000-memory.dmpFilesize
192KB
-
memory/3460-168-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-169-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-170-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-171-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-172-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-173-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-174-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-175-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-176-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-177-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-178-0x00000000057F0000-0x0000000005DF6000-memory.dmpFilesize
6.0MB
-
memory/3460-179-0x0000000005280000-0x0000000005292000-memory.dmpFilesize
72KB
-
memory/3460-180-0x0000000005E00000-0x0000000005F0A000-memory.dmpFilesize
1.0MB
-
memory/3460-181-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-182-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-183-0x0000000005F10000-0x0000000005F4E000-memory.dmpFilesize
248KB
-
memory/3460-184-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-185-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-186-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-187-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-188-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-189-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-190-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/3460-191-0x0000000005F70000-0x0000000005FBB000-memory.dmpFilesize
300KB
-
memory/3460-215-0x0000000006CC0000-0x0000000006D26000-memory.dmpFilesize
408KB
-
memory/3460-218-0x00000000027C0000-0x00000000027F8000-memory.dmpFilesize
224KB
-
memory/3460-224-0x0000000007050000-0x00000000070C6000-memory.dmpFilesize
472KB
-
memory/3460-225-0x00000000070D0000-0x0000000007162000-memory.dmpFilesize
584KB
-
memory/3460-228-0x00000000071C0000-0x00000000071DE000-memory.dmpFilesize
120KB
-
memory/3460-229-0x0000000000400000-0x0000000000A94000-memory.dmpFilesize
6.6MB
-
memory/3460-231-0x00000000081B0000-0x0000000008200000-memory.dmpFilesize
320KB
-
memory/3460-232-0x0000000008400000-0x00000000085C2000-memory.dmpFilesize
1.8MB
-
memory/3460-233-0x00000000085E0000-0x0000000008B0C000-memory.dmpFilesize
5.2MB
-
memory/3460-240-0x0000000000400000-0x0000000000A94000-memory.dmpFilesize
6.6MB