Analysis
-
max time kernel
55s -
max time network
148s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
05-08-2022 10:20
Static task
static1
General
-
Target
a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe
-
Size
323KB
-
MD5
63dc25e61df8c3bac54d49bb7bd688fa
-
SHA1
a8cbbdcf347b6099157540478920663af9b1641a
-
SHA256
a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80
-
SHA512
0834d4a7ccd380d768cc00e373d515a6f6e054be2da51915d125386d84d171397793abc9017774d60e56766b3d512b30b1170de53d339f933618827ad74f3611
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exepid process 2188 a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe 2188 a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exedescription pid process Token: SeDebugPrivilege 2188 a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe"C:\Users\Admin\AppData\Local\Temp\a5f8856f7fc0db48c0f3d7087f9ba8927a4537c08ef8cdebe317a886d9ed4f80.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2188-118-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-119-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-120-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-121-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-122-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-123-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-124-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-125-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-126-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-127-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-128-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-129-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-130-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-131-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-132-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-134-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-135-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-136-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-137-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-138-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-140-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-141-0x00000000041F0000-0x0000000004228000-memory.dmpFilesize
224KB
-
memory/2188-139-0x0000000002530000-0x00000000025DE000-memory.dmpFilesize
696KB
-
memory/2188-142-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-143-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-144-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-145-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-146-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-147-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-148-0x0000000000400000-0x00000000024D7000-memory.dmpFilesize
32.8MB
-
memory/2188-149-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-150-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-151-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-152-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-154-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-153-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-155-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-156-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-157-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-158-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-159-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-160-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-161-0x0000000004350000-0x0000000004380000-memory.dmpFilesize
192KB
-
memory/2188-162-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-163-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-164-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-165-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-166-0x0000000006DB0000-0x00000000072AE000-memory.dmpFilesize
5.0MB
-
memory/2188-167-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-168-0x0000000004720000-0x0000000004750000-memory.dmpFilesize
192KB
-
memory/2188-169-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-170-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-171-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-172-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-173-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-174-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-175-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-176-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-177-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-178-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-179-0x00000000072B0000-0x00000000078B6000-memory.dmpFilesize
6.0MB
-
memory/2188-180-0x0000000006C50000-0x0000000006C62000-memory.dmpFilesize
72KB
-
memory/2188-181-0x0000000006C80000-0x0000000006D8A000-memory.dmpFilesize
1.0MB
-
memory/2188-182-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-183-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-184-0x00000000078F0000-0x000000000792E000-memory.dmpFilesize
248KB
-
memory/2188-185-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-186-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-187-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-188-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-189-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-190-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-191-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-192-0x0000000007A40000-0x0000000007A8B000-memory.dmpFilesize
300KB
-
memory/2188-193-0x0000000077B50000-0x0000000077CDE000-memory.dmpFilesize
1.6MB
-
memory/2188-194-0x00000000041F0000-0x0000000004228000-memory.dmpFilesize
224KB
-
memory/2188-202-0x0000000000400000-0x00000000024D7000-memory.dmpFilesize
32.8MB
-
memory/2188-218-0x0000000008690000-0x00000000086F6000-memory.dmpFilesize
408KB
-
memory/2188-226-0x0000000008A20000-0x0000000008A96000-memory.dmpFilesize
472KB
-
memory/2188-227-0x0000000008AE0000-0x0000000008B72000-memory.dmpFilesize
584KB
-
memory/2188-230-0x0000000008CC0000-0x0000000008CDE000-memory.dmpFilesize
120KB
-
memory/2188-231-0x0000000008D50000-0x0000000008DA0000-memory.dmpFilesize
320KB
-
memory/2188-232-0x00000000091E0000-0x00000000093A2000-memory.dmpFilesize
1.8MB
-
memory/2188-233-0x00000000095B0000-0x0000000009ADC000-memory.dmpFilesize
5.2MB
-
memory/2188-240-0x0000000000400000-0x00000000024D7000-memory.dmpFilesize
32.8MB