Analysis
-
max time kernel
72s -
max time network
77s -
platform
windows10_x64 -
resource
win10-20220414-en -
submitted
07-07-2022 04:00
Static task
static1
Behavioral task
behavioral1
Sample
1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe
Resource
win10-20220414-en
General
-
Target
1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe
-
Size
333KB
-
MD5
d4c309055638a93ff96bd22a6ff908d2
-
SHA1
eb596771a007b4ce4b7705843dbde58fe05a6dc2
-
SHA256
1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44
-
SHA512
2a95ef22bc3927fcae11970892342b522845a8242f62eb1056b02784d111f0153a8b215cedf3b8e1a2bda20d949cfa110e7a29a2ca566fd338ece945c6cbb3d7
Malware Config
Extracted
redline
levelcupsecurity.eu:80
-
auth_value
7c1b2032b7b3b6267ca05854dc6f71f1
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exepid process 3932 1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe 3932 1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exedescription pid process Token: SeDebugPrivilege 3932 1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe"C:\Users\Admin\AppData\Local\Temp\1dd320aff87679f64a455ee7f7ff74a94e8d3d9da079abaaa5dc931a44bbed44.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3932-116-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-117-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-118-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-119-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-121-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-120-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-122-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-123-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-124-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-125-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-126-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-127-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-128-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-129-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-130-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-131-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-132-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-134-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-133-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-135-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-136-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-138-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-139-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-140-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-141-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-142-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-143-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-144-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-146-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-147-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-145-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-148-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-150-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/3932-153-0x0000000000400000-0x0000000000650000-memory.dmpFilesize
2.3MB
-
memory/3932-154-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-152-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-151-0x0000000002390000-0x00000000023C8000-memory.dmpFilesize
224KB
-
memory/3932-149-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-155-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-156-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-159-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-160-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-158-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-161-0x00000000025A0000-0x00000000025D0000-memory.dmpFilesize
192KB
-
memory/3932-163-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-164-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-162-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-157-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-165-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-167-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-166-0x0000000005070000-0x000000000556E000-memory.dmpFilesize
5.0MB
-
memory/3932-168-0x0000000002770000-0x00000000027A0000-memory.dmpFilesize
192KB
-
memory/3932-169-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-170-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-171-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-172-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-173-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-174-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-175-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-176-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-177-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-178-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-179-0x0000000005570000-0x0000000005B76000-memory.dmpFilesize
6.0MB
-
memory/3932-180-0x00000000029E0000-0x00000000029F2000-memory.dmpFilesize
72KB
-
memory/3932-181-0x0000000004EB0000-0x0000000004FBA000-memory.dmpFilesize
1.0MB
-
memory/3932-182-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-183-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-184-0x0000000004FC0000-0x0000000004FFE000-memory.dmpFilesize
248KB
-
memory/3932-185-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-186-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-187-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-189-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-190-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-188-0x00000000772B0000-0x000000007743E000-memory.dmpFilesize
1.6MB
-
memory/3932-192-0x0000000005000000-0x000000000504B000-memory.dmpFilesize
300KB
-
memory/3932-215-0x0000000006870000-0x00000000068E6000-memory.dmpFilesize
472KB
-
memory/3932-216-0x00000000069C0000-0x0000000006A52000-memory.dmpFilesize
584KB
-
memory/3932-219-0x0000000006980000-0x000000000699E000-memory.dmpFilesize
120KB
-
memory/3932-220-0x0000000006C00000-0x0000000006C66000-memory.dmpFilesize
408KB
-
memory/3932-228-0x0000000000650000-0x000000000079A000-memory.dmpFilesize
1.3MB
-
memory/3932-229-0x0000000007050000-0x0000000007212000-memory.dmpFilesize
1.8MB
-
memory/3932-230-0x0000000007220000-0x000000000774C000-memory.dmpFilesize
5.2MB
-
memory/3932-233-0x0000000007A60000-0x0000000007AB0000-memory.dmpFilesize
320KB
-
memory/3932-239-0x0000000000400000-0x0000000000650000-memory.dmpFilesize
2.3MB