Analysis
-
max time kernel
50s -
max time network
52s -
platform
windows10-1703_x64 -
resource
win10-20220722-en -
resource tags
arch:x64arch:x86image:win10-20220722-enlocale:en-usos:windows10-1703-x64system -
submitted
05-08-2022 17:40
Static task
static1
General
-
Target
4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exe
-
Size
321KB
-
MD5
2953b3aadd3041be3157ab5775ad5c8b
-
SHA1
8b1c59e8cc06bf5e70ce9d9b617f03d5f249e522
-
SHA256
4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d
-
SHA512
2ab6a5ff7858b577e2ad3c36733596ab0e182115f2c818534db6b64e0848c969ae11a3b7fbeed9900ecf37bb101232e08667c665b61745bb33104af675c8856e
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exepid process 4772 4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exe 4772 4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exedescription pid process Token: SeDebugPrivilege 4772 4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exe"C:\Users\Admin\AppData\Local\Temp\4f29634990e43c53d2bdb4d36a28478fd63d5b029c38ca76c6cd6019a4f7648d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4772-127-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-128-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-129-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-130-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-131-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-132-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-133-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-134-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-135-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-136-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-137-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-138-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-139-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-140-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-141-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-142-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-143-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-144-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-145-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-146-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-147-0x0000000002726000-0x0000000002750000-memory.dmpFilesize
168KB
-
memory/4772-148-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-150-0x00000000025B0000-0x00000000026FA000-memory.dmpFilesize
1.3MB
-
memory/4772-149-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-151-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-152-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-153-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-154-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-155-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-156-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-157-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-158-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-159-0x0000000000400000-0x00000000024D6000-memory.dmpFilesize
32.8MB
-
memory/4772-160-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-161-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-162-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-163-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-164-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-165-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-166-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-167-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-168-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-169-0x0000000004570000-0x00000000045A0000-memory.dmpFilesize
192KB
-
memory/4772-170-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-171-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-172-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-173-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-174-0x0000000006CC0000-0x00000000071BE000-memory.dmpFilesize
5.0MB
-
memory/4772-175-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-176-0x00000000045F0000-0x0000000004620000-memory.dmpFilesize
192KB
-
memory/4772-177-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-178-0x0000000002726000-0x0000000002750000-memory.dmpFilesize
168KB
-
memory/4772-179-0x00000000025B0000-0x00000000026FA000-memory.dmpFilesize
1.3MB
-
memory/4772-180-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-181-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-182-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-183-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-184-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-185-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-186-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-187-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-188-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-189-0x00000000071C0000-0x00000000077C6000-memory.dmpFilesize
6.0MB
-
memory/4772-190-0x0000000006C50000-0x0000000006C62000-memory.dmpFilesize
72KB
-
memory/4772-191-0x00000000077D0000-0x00000000078DA000-memory.dmpFilesize
1.0MB
-
memory/4772-192-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-193-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-194-0x0000000007930000-0x000000000796E000-memory.dmpFilesize
248KB
-
memory/4772-195-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-196-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-197-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-198-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-199-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-200-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-201-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-202-0x0000000007970000-0x00000000079BB000-memory.dmpFilesize
300KB
-
memory/4772-203-0x0000000077180000-0x000000007730E000-memory.dmpFilesize
1.6MB
-
memory/4772-226-0x00000000086A0000-0x0000000008716000-memory.dmpFilesize
472KB
-
memory/4772-227-0x0000000008750000-0x00000000087E2000-memory.dmpFilesize
584KB
-
memory/4772-230-0x0000000008950000-0x000000000896E000-memory.dmpFilesize
120KB
-
memory/4772-231-0x00000000089E0000-0x0000000008A46000-memory.dmpFilesize
408KB
-
memory/4772-239-0x0000000008D70000-0x0000000008F32000-memory.dmpFilesize
1.8MB
-
memory/4772-240-0x0000000008F40000-0x000000000946C000-memory.dmpFilesize
5.2MB
-
memory/4772-243-0x0000000009570000-0x00000000095C0000-memory.dmpFilesize
320KB
-
memory/4772-248-0x0000000002726000-0x0000000002750000-memory.dmpFilesize
168KB
-
memory/4772-249-0x0000000000400000-0x00000000024D6000-memory.dmpFilesize
32.8MB