Analysis
-
max time kernel
55s -
max time network
63s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
05-08-2022 15:20
Static task
static1
General
-
Target
2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exe
-
Size
323KB
-
MD5
9d9effc866e7d77cfb116b9f500b71d3
-
SHA1
f85f776eabb2029acbc99f0255ab355810a32220
-
SHA256
2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e
-
SHA512
c87cf80f47fecbec70f628ed08e1dc119074dcdb8f8028b75f4043828d62e4c17aa3a8955c36c269875723bf642385ff700281a3bcc6e02e4f8b99a2cd595a23
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exepid process 1848 2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exe 1848 2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exedescription pid process Token: SeDebugPrivilege 1848 2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exe"C:\Users\Admin\AppData\Local\Temp\2d1131f95a57ab5c3e20f4b6aac7b0850c6890b9b8ee3cdbf749b4309170382e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1848-117-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-118-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-119-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-120-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-121-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-122-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-123-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-124-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-125-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-126-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-127-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-128-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-129-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-130-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-131-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-133-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-134-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-135-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-136-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-137-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-138-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-139-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-140-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-141-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-142-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-143-0x0000000002630000-0x000000000277A000-memory.dmpFilesize
1.3MB
-
memory/1848-144-0x0000000002630000-0x000000000277A000-memory.dmpFilesize
1.3MB
-
memory/1848-145-0x0000000000400000-0x00000000024D7000-memory.dmpFilesize
32.8MB
-
memory/1848-146-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-147-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-148-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-149-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-150-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-151-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-152-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-153-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-154-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-155-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-156-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-157-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-158-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-159-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-160-0x0000000004540000-0x0000000004570000-memory.dmpFilesize
192KB
-
memory/1848-161-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-162-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-163-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-164-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-165-0x0000000006D60000-0x000000000725E000-memory.dmpFilesize
5.0MB
-
memory/1848-166-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-167-0x00000000046F0000-0x0000000004720000-memory.dmpFilesize
192KB
-
memory/1848-168-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-169-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-170-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-171-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-172-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-173-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-174-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-175-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-176-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-177-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-178-0x0000000007870000-0x0000000007E76000-memory.dmpFilesize
6.0MB
-
memory/1848-179-0x0000000002630000-0x000000000277A000-memory.dmpFilesize
1.3MB
-
memory/1848-180-0x0000000006C50000-0x0000000006C62000-memory.dmpFilesize
72KB
-
memory/1848-181-0x0000000002630000-0x000000000277A000-memory.dmpFilesize
1.3MB
-
memory/1848-182-0x0000000007260000-0x000000000736A000-memory.dmpFilesize
1.0MB
-
memory/1848-183-0x0000000000400000-0x00000000024D7000-memory.dmpFilesize
32.8MB
-
memory/1848-184-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-185-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-186-0x0000000006CC0000-0x0000000006CFE000-memory.dmpFilesize
248KB
-
memory/1848-187-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-188-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-189-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-190-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-191-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-192-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-193-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-194-0x0000000007470000-0x00000000074BB000-memory.dmpFilesize
300KB
-
memory/1848-195-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/1848-212-0x0000000008870000-0x00000000088E6000-memory.dmpFilesize
472KB
-
memory/1848-213-0x0000000008900000-0x0000000008992000-memory.dmpFilesize
584KB
-
memory/1848-216-0x0000000008B20000-0x0000000008B3E000-memory.dmpFilesize
120KB
-
memory/1848-218-0x0000000008B90000-0x0000000008BF6000-memory.dmpFilesize
408KB
-
memory/1848-226-0x00000000091D0000-0x0000000009392000-memory.dmpFilesize
1.8MB
-
memory/1848-227-0x00000000093A0000-0x00000000098CC000-memory.dmpFilesize
5.2MB
-
memory/1848-230-0x0000000009950000-0x00000000099A0000-memory.dmpFilesize
320KB
-
memory/1848-235-0x0000000000400000-0x00000000024D7000-memory.dmpFilesize
32.8MB