Analysis
-
max time kernel
91s -
max time network
95s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
05-08-2022 19:10
Static task
static1
General
-
Target
317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exe
-
Size
319KB
-
MD5
3465301e727019f253f5e50dbffc175b
-
SHA1
f11e6b891a5d65bd0c2e47212bdb25404960a7a3
-
SHA256
317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe
-
SHA512
45eaa960cd68c45dac3b8930b74047c7ba2697aa5c632e8a9464365447a4b1a4c8f18d371078c4114b5677d9ce856a7686bad7dba8583aadde2e422f8dae349c
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exepid process 2676 317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exe 2676 317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exedescription pid process Token: SeDebugPrivilege 2676 317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exe"C:\Users\Admin\AppData\Local\Temp\317523649267143894dc16bb1eb584497fcecf5114ac16e847145686a804c7fe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2676-114-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-115-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-116-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-117-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-118-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-119-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-120-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-122-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-121-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-124-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-123-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-126-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-127-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-128-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-125-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-129-0x0000000002696000-0x00000000026C0000-memory.dmpFilesize
168KB
-
memory/2676-130-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-131-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-133-0x0000000002550000-0x000000000269A000-memory.dmpFilesize
1.3MB
-
memory/2676-132-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-134-0x0000000004260000-0x0000000004298000-memory.dmpFilesize
224KB
-
memory/2676-135-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-136-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-137-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-138-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-139-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-140-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-141-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-142-0x0000000000400000-0x00000000024D6000-memory.dmpFilesize
32.8MB
-
memory/2676-143-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-144-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-145-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-146-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-147-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-148-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-149-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-150-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-151-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-152-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-153-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-154-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-155-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-156-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-157-0x0000000004430000-0x0000000004460000-memory.dmpFilesize
192KB
-
memory/2676-158-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-159-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-160-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-161-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-162-0x0000000006CE0000-0x00000000071DE000-memory.dmpFilesize
5.0MB
-
memory/2676-163-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-164-0x0000000004720000-0x0000000004750000-memory.dmpFilesize
192KB
-
memory/2676-165-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-166-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-167-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-168-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-169-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-170-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-171-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-172-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-173-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-174-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-175-0x00000000077F0000-0x0000000007DF6000-memory.dmpFilesize
6.0MB
-
memory/2676-176-0x0000000006C50000-0x0000000006C62000-memory.dmpFilesize
72KB
-
memory/2676-177-0x00000000071E0000-0x00000000072EA000-memory.dmpFilesize
1.0MB
-
memory/2676-178-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-179-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-180-0x00000000072F0000-0x000000000732E000-memory.dmpFilesize
248KB
-
memory/2676-181-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-182-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-183-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-184-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-185-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-186-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-187-0x0000000076F30000-0x00000000770BE000-memory.dmpFilesize
1.6MB
-
memory/2676-188-0x0000000002550000-0x000000000269A000-memory.dmpFilesize
1.3MB
-
memory/2676-189-0x0000000004260000-0x0000000004298000-memory.dmpFilesize
224KB
-
memory/2676-190-0x0000000007430000-0x000000000747B000-memory.dmpFilesize
300KB
-
memory/2676-192-0x0000000000400000-0x00000000024D6000-memory.dmpFilesize
32.8MB
-
memory/2676-216-0x00000000085F0000-0x0000000008656000-memory.dmpFilesize
408KB
-
memory/2676-224-0x0000000008900000-0x0000000008976000-memory.dmpFilesize
472KB
-
memory/2676-225-0x00000000089F0000-0x0000000008A82000-memory.dmpFilesize
584KB
-
memory/2676-228-0x00000000089C0000-0x00000000089DE000-memory.dmpFilesize
120KB
-
memory/2676-229-0x0000000008BF0000-0x0000000008C40000-memory.dmpFilesize
320KB
-
memory/2676-230-0x0000000009140000-0x0000000009302000-memory.dmpFilesize
1.8MB
-
memory/2676-231-0x0000000009310000-0x000000000983C000-memory.dmpFilesize
5.2MB
-
memory/2676-238-0x0000000000400000-0x00000000024D6000-memory.dmpFilesize
32.8MB