Analysis
-
max time kernel
53s -
max time network
72s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
03-08-2022 16:40
Static task
static1
General
-
Target
4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exe
-
Size
285KB
-
MD5
d5ce66cff745e42bd0ee76c24ea2f0ec
-
SHA1
b0f858aecc8a0ec781ecc7565cd03018ee280554
-
SHA256
4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98
-
SHA512
893618498b2857a4ca3fa4a817d41e2fee260174ade4a6551c15f4c1aa7638f4338882778ab0a0f5a2334e61321f97ae9d67200ed424e223969d3ca375fe8088
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exepid process 2548 4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exe 2548 4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exedescription pid process Token: SeDebugPrivilege 2548 4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exe"C:\Users\Admin\AppData\Local\Temp\4902d6ab6b50397f94adabc09ad7117449cbef260583cfae1accfcb48ec62e98.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2548-118-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-119-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-120-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-121-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-122-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-123-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-124-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-125-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-126-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-127-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-128-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-129-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-130-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-131-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-132-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-133-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-134-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-135-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-136-0x00000000026B6000-0x00000000026E0000-memory.dmpFilesize
168KB
-
memory/2548-137-0x0000000002620000-0x0000000002658000-memory.dmpFilesize
224KB
-
memory/2548-138-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-139-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-140-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-141-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-142-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-143-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-144-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-145-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-146-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-147-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-149-0x0000000000400000-0x00000000024CA000-memory.dmpFilesize
32.8MB
-
memory/2548-148-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-150-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-151-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-152-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-153-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-154-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-155-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-156-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-157-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-158-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-159-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-160-0x0000000004340000-0x0000000004370000-memory.dmpFilesize
192KB
-
memory/2548-161-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-162-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-163-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-164-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-165-0x0000000006D40000-0x000000000723E000-memory.dmpFilesize
5.0MB
-
memory/2548-166-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-167-0x00000000044B0000-0x00000000044E0000-memory.dmpFilesize
192KB
-
memory/2548-168-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-169-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-170-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-171-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-172-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-173-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-174-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-175-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-176-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-177-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-178-0x0000000007240000-0x0000000007846000-memory.dmpFilesize
6.0MB
-
memory/2548-179-0x00000000046B0000-0x00000000046C2000-memory.dmpFilesize
72KB
-
memory/2548-180-0x0000000006B80000-0x0000000006C8A000-memory.dmpFilesize
1.0MB
-
memory/2548-181-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-182-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-183-0x0000000006C90000-0x0000000006CCE000-memory.dmpFilesize
248KB
-
memory/2548-184-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-185-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-186-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-187-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-188-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-189-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-190-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-191-0x0000000006CD0000-0x0000000006D1B000-memory.dmpFilesize
300KB
-
memory/2548-192-0x0000000077BD0000-0x0000000077D5E000-memory.dmpFilesize
1.6MB
-
memory/2548-193-0x00000000026B6000-0x00000000026E0000-memory.dmpFilesize
168KB
-
memory/2548-194-0x0000000002620000-0x0000000002658000-memory.dmpFilesize
224KB
-
memory/2548-202-0x0000000000400000-0x00000000024CA000-memory.dmpFilesize
32.8MB
-
memory/2548-218-0x0000000008550000-0x00000000085B6000-memory.dmpFilesize
408KB
-
memory/2548-226-0x0000000008890000-0x0000000008906000-memory.dmpFilesize
472KB
-
memory/2548-227-0x0000000008930000-0x00000000089C2000-memory.dmpFilesize
584KB
-
memory/2548-230-0x0000000008A40000-0x0000000008A5E000-memory.dmpFilesize
120KB
-
memory/2548-231-0x0000000008D30000-0x0000000008EF2000-memory.dmpFilesize
1.8MB
-
memory/2548-232-0x0000000008F00000-0x000000000942C000-memory.dmpFilesize
5.2MB
-
memory/2548-235-0x0000000009550000-0x00000000095A0000-memory.dmpFilesize
320KB
-
memory/2548-240-0x00000000026B6000-0x00000000026E0000-memory.dmpFilesize
168KB
-
memory/2548-241-0x0000000000400000-0x00000000024CA000-memory.dmpFilesize
32.8MB