Analysis
-
max time kernel
51s -
max time network
54s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
06-07-2022 19:30
Static task
static1
General
-
Target
f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exe
-
Size
430KB
-
MD5
2ed3a9d630c87d7a0e42aeaed17881c1
-
SHA1
6f03c13bb8fc868ff65349f04b510a3835934742
-
SHA256
f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92
-
SHA512
4c3b252dfcc61f8ee1776bb2715c19a89477f2feeab79bd4cf0e8fafb9c01afb027ff37046449a15233a6546c2cac7b726f2982eeb6c8d2e0c4462443a454816
Malware Config
Extracted
redline
ib1.4
levelcupsecurity.eu:80
-
auth_value
363e918b58f663fdb3c6d525cf98d4b0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exepid process 1312 f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exe 1312 f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exedescription pid process Token: SeDebugPrivilege 1312 f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exe"C:\Users\Admin\AppData\Local\Temp\f909ae906f46a0e498a50cf17dec5feb4549e4e6e9f2d3b019364cc1eea55c92.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1312-115-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-116-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-117-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-118-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-119-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-120-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-121-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-122-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-123-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-124-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-125-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-126-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-127-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-128-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-129-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-131-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-132-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-133-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-134-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-135-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-136-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-138-0x0000000000BC0000-0x0000000000D0A000-memory.dmpFilesize
1.3MB
-
memory/1312-137-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-139-0x0000000000BC0000-0x0000000000D0A000-memory.dmpFilesize
1.3MB
-
memory/1312-140-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-141-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-142-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-143-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-144-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-145-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-146-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-147-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-148-0x0000000000400000-0x0000000000A9D000-memory.dmpFilesize
6.6MB
-
memory/1312-149-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-150-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-151-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-152-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-153-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-154-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-155-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-156-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-157-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-158-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-159-0x0000000002AD0000-0x0000000002B00000-memory.dmpFilesize
192KB
-
memory/1312-160-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-161-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-162-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-163-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-164-0x0000000005240000-0x000000000573E000-memory.dmpFilesize
5.0MB
-
memory/1312-165-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-166-0x0000000002BC0000-0x0000000002BF0000-memory.dmpFilesize
192KB
-
memory/1312-167-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-168-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-169-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-170-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-171-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-172-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-173-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-174-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-175-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-176-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-177-0x0000000005740000-0x0000000005D46000-memory.dmpFilesize
6.0MB
-
memory/1312-178-0x0000000005DA0000-0x0000000005DB2000-memory.dmpFilesize
72KB
-
memory/1312-179-0x0000000005DD0000-0x0000000005EDA000-memory.dmpFilesize
1.0MB
-
memory/1312-180-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-181-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-182-0x0000000005F00000-0x0000000005F3E000-memory.dmpFilesize
248KB
-
memory/1312-183-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-184-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-185-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-186-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-187-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-188-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-189-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-190-0x0000000005F70000-0x0000000005FBB000-memory.dmpFilesize
300KB
-
memory/1312-205-0x0000000000BC0000-0x0000000000D0A000-memory.dmpFilesize
1.3MB
-
memory/1312-206-0x0000000000BC0000-0x0000000000D0A000-memory.dmpFilesize
1.3MB
-
memory/1312-216-0x0000000000400000-0x0000000000A9D000-memory.dmpFilesize
6.6MB
-
memory/1312-217-0x0000000006CD0000-0x0000000006D36000-memory.dmpFilesize
408KB
-
memory/1312-225-0x0000000007010000-0x0000000007086000-memory.dmpFilesize
472KB
-
memory/1312-226-0x00000000070B0000-0x0000000007142000-memory.dmpFilesize
584KB
-
memory/1312-229-0x00000000072C0000-0x00000000072DE000-memory.dmpFilesize
120KB
-
memory/1312-230-0x0000000007370000-0x0000000007532000-memory.dmpFilesize
1.8MB
-
memory/1312-231-0x0000000007550000-0x0000000007A7C000-memory.dmpFilesize
5.2MB
-
memory/1312-234-0x0000000007BF0000-0x0000000007C40000-memory.dmpFilesize
320KB
-
memory/1312-240-0x0000000000400000-0x0000000000A9D000-memory.dmpFilesize
6.6MB