Analysis
-
max time kernel
49s -
max time network
53s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2022 15:10
Static task
static1
General
-
Target
35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exe
-
Size
286KB
-
MD5
5444bb6ecd7a6a7cf116727b040dce76
-
SHA1
a6b4491e2725856660d813d6d584dab208ac4107
-
SHA256
35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133
-
SHA512
03d11c8eeb016a3ee418383b440b670e6e75c565874a22e4201063e7ba9ed73bd0d9b4d4aeb3a57843516c532f7aab9b130142f516df30c9e5237d224c92b620
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exepid process 4708 35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exe 4708 35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exedescription pid process Token: SeDebugPrivilege 4708 35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exe"C:\Users\Admin\AppData\Local\Temp\35e6c3107e12e99a041a0d5a1d467b9c985463d1c04ecef5b02a70ea52974133.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4708-127-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-128-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-129-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-130-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-131-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-132-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-133-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-134-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-135-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-136-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-137-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-138-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-139-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-140-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-141-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-142-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-143-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-144-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-145-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-146-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-147-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-149-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-148-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-151-0x00000000027E6000-0x0000000002811000-memory.dmpFilesize
172KB
-
memory/4708-150-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-152-0x0000000002620000-0x000000000276A000-memory.dmpFilesize
1.3MB
-
memory/4708-153-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-154-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-155-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-156-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-157-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-158-0x0000000000400000-0x00000000024CA000-memory.dmpFilesize
32.8MB
-
memory/4708-159-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-160-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-161-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-162-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-163-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-164-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-165-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-166-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-167-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-168-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-169-0x0000000004650000-0x0000000004680000-memory.dmpFilesize
192KB
-
memory/4708-170-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-171-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-172-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-173-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-174-0x0000000006D30000-0x000000000722E000-memory.dmpFilesize
5.0MB
-
memory/4708-175-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-176-0x0000000004700000-0x0000000004730000-memory.dmpFilesize
192KB
-
memory/4708-177-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-178-0x00000000027E6000-0x0000000002811000-memory.dmpFilesize
172KB
-
memory/4708-179-0x0000000002620000-0x000000000276A000-memory.dmpFilesize
1.3MB
-
memory/4708-180-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-181-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-182-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-183-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-184-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-185-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-186-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-187-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-188-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-189-0x0000000007230000-0x0000000007836000-memory.dmpFilesize
6.0MB
-
memory/4708-190-0x0000000006C40000-0x0000000006C52000-memory.dmpFilesize
72KB
-
memory/4708-191-0x0000000007840000-0x000000000794A000-memory.dmpFilesize
1.0MB
-
memory/4708-192-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-193-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-194-0x0000000006CB0000-0x0000000006CEE000-memory.dmpFilesize
248KB
-
memory/4708-195-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-196-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-197-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-198-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-199-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-200-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-201-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-202-0x0000000007A50000-0x0000000007A9B000-memory.dmpFilesize
300KB
-
memory/4708-203-0x0000000077980000-0x0000000077B0E000-memory.dmpFilesize
1.6MB
-
memory/4708-226-0x0000000008690000-0x00000000086F6000-memory.dmpFilesize
408KB
-
memory/4708-234-0x00000000089D0000-0x0000000008A46000-memory.dmpFilesize
472KB
-
memory/4708-235-0x0000000008A70000-0x0000000008B02000-memory.dmpFilesize
584KB
-
memory/4708-238-0x0000000008CA0000-0x0000000008CBE000-memory.dmpFilesize
120KB
-
memory/4708-239-0x0000000008D50000-0x0000000008F12000-memory.dmpFilesize
1.8MB
-
memory/4708-240-0x0000000008F20000-0x000000000944C000-memory.dmpFilesize
5.2MB
-
memory/4708-243-0x00000000098C0000-0x0000000009910000-memory.dmpFilesize
320KB
-
memory/4708-248-0x00000000027E6000-0x0000000002811000-memory.dmpFilesize
172KB
-
memory/4708-249-0x0000000000400000-0x00000000024CA000-memory.dmpFilesize
32.8MB