Analysis

  • max time kernel
    55s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10-20220414-en
  • resource tags

    arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system
  • submitted
    05-08-2022 10:20

General

  • Target

    a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe

  • Size

    323KB

  • MD5

    63dc25e61df8c3bac54d49bb7bd688fa

  • SHA1

    a8cbbdcf347b6099157540478920663af9b1641a

  • SHA256

    a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80

  • SHA512

    0834d4a7ccd380d768cc00e373d515a6f6e054be2da51915d125386d84d171397793abc9017774d60e56766b3d512b30b1170de53d339f933618827ad74f3611

Malware Config

Extracted

Family

redline

Botnet

AF2

C2

stcontact.top:80

Attributes
  • auth_value

    4d729a2faecb406a0eb1d6fcf30432fa

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe
    "C:\Users\Admin\AppData\Local\Temp\a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2188

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2188-118-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-119-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-120-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-121-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-122-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-123-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-124-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-125-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-126-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-127-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-128-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-129-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-130-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-131-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-132-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-134-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-135-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-136-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-137-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-138-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-140-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-141-0x00000000041F0000-0x0000000004228000-memory.dmp
    Filesize

    224KB

  • memory/2188-139-0x0000000002530000-0x00000000025DE000-memory.dmp
    Filesize

    696KB

  • memory/2188-142-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-143-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-144-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-145-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-146-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-147-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-148-0x0000000000400000-0x00000000024D7000-memory.dmp
    Filesize

    32.8MB

  • memory/2188-149-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-150-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-151-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-152-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-154-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-153-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-155-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-156-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-157-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-158-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-159-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-160-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-161-0x0000000004350000-0x0000000004380000-memory.dmp
    Filesize

    192KB

  • memory/2188-162-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-163-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-164-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-165-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-166-0x0000000006DB0000-0x00000000072AE000-memory.dmp
    Filesize

    5.0MB

  • memory/2188-167-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-168-0x0000000004720000-0x0000000004750000-memory.dmp
    Filesize

    192KB

  • memory/2188-169-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-170-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-171-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-172-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-173-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-174-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-175-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-176-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-177-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-178-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-179-0x00000000072B0000-0x00000000078B6000-memory.dmp
    Filesize

    6.0MB

  • memory/2188-180-0x0000000006C50000-0x0000000006C62000-memory.dmp
    Filesize

    72KB

  • memory/2188-181-0x0000000006C80000-0x0000000006D8A000-memory.dmp
    Filesize

    1.0MB

  • memory/2188-182-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-183-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-184-0x00000000078F0000-0x000000000792E000-memory.dmp
    Filesize

    248KB

  • memory/2188-185-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-186-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-187-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-188-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-189-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-190-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-191-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-192-0x0000000007A40000-0x0000000007A8B000-memory.dmp
    Filesize

    300KB

  • memory/2188-193-0x0000000077B50000-0x0000000077CDE000-memory.dmp
    Filesize

    1.6MB

  • memory/2188-194-0x00000000041F0000-0x0000000004228000-memory.dmp
    Filesize

    224KB

  • memory/2188-202-0x0000000000400000-0x00000000024D7000-memory.dmp
    Filesize

    32.8MB

  • memory/2188-218-0x0000000008690000-0x00000000086F6000-memory.dmp
    Filesize

    408KB

  • memory/2188-226-0x0000000008A20000-0x0000000008A96000-memory.dmp
    Filesize

    472KB

  • memory/2188-227-0x0000000008AE0000-0x0000000008B72000-memory.dmp
    Filesize

    584KB

  • memory/2188-230-0x0000000008CC0000-0x0000000008CDE000-memory.dmp
    Filesize

    120KB

  • memory/2188-231-0x0000000008D50000-0x0000000008DA0000-memory.dmp
    Filesize

    320KB

  • memory/2188-232-0x00000000091E0000-0x00000000093A2000-memory.dmp
    Filesize

    1.8MB

  • memory/2188-233-0x00000000095B0000-0x0000000009ADC000-memory.dmp
    Filesize

    5.2MB

  • memory/2188-240-0x0000000000400000-0x00000000024D7000-memory.dmp
    Filesize

    32.8MB