Analysis
-
max time kernel
51s -
max time network
55s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 02:40
Static task
static1
General
-
Target
b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exe
-
Size
416KB
-
MD5
ff451612548cfd7c3faba95922220963
-
SHA1
aea7f869b8ce58cdeda596c98632ac16bcabc5ea
-
SHA256
b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea
-
SHA512
9dde4f0311fd06cd37bc7ff516bd614d98dccd3b4adca6fd42acc494175016a993398c5eddde18d95139c027588f5ddf660a31df63b3288682ee105c9067f751
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exepid process 1312 b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exe 1312 b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exedescription pid process Token: SeDebugPrivilege 1312 b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exe"C:\Users\Admin\AppData\Local\Temp\b0ad131b9eefb94f0ef96e7c7a1b3a2f5ad274d2ed699652253eaa5e6fec88ea.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1312-115-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-116-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-117-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-119-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-118-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-121-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-120-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-122-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-123-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-124-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-125-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-126-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-127-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-128-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-129-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-131-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-132-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-134-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-135-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-136-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-133-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-130-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-138-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-139-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-140-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-141-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-142-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-143-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-144-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-145-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-146-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-147-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/1312-148-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/1312-149-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/1312-150-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-151-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-152-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-153-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-154-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-155-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-156-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-158-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-157-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-159-0x0000000002230000-0x0000000002260000-memory.dmpFilesize
192KB
-
memory/1312-160-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-161-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-162-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-163-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-164-0x0000000004E10000-0x000000000530E000-memory.dmpFilesize
5.0MB
-
memory/1312-165-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-166-0x0000000002500000-0x0000000002530000-memory.dmpFilesize
192KB
-
memory/1312-167-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-168-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-169-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-170-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-171-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-172-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-173-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-174-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-175-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-176-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-177-0x0000000005310000-0x0000000005916000-memory.dmpFilesize
6.0MB
-
memory/1312-178-0x00000000026B0000-0x00000000026C2000-memory.dmpFilesize
72KB
-
memory/1312-179-0x0000000004C80000-0x0000000004D8A000-memory.dmpFilesize
1.0MB
-
memory/1312-180-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-181-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-182-0x0000000004D90000-0x0000000004DCE000-memory.dmpFilesize
248KB
-
memory/1312-183-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-184-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-185-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-186-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-187-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-188-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-189-0x0000000077050000-0x00000000771DE000-memory.dmpFilesize
1.6MB
-
memory/1312-190-0x0000000005920000-0x000000000596B000-memory.dmpFilesize
300KB
-
memory/1312-214-0x0000000006640000-0x00000000066A6000-memory.dmpFilesize
408KB
-
memory/1312-222-0x00000000069A0000-0x0000000006A16000-memory.dmpFilesize
472KB
-
memory/1312-223-0x0000000006A30000-0x0000000006AC2000-memory.dmpFilesize
584KB
-
memory/1312-226-0x0000000006B40000-0x0000000006B5E000-memory.dmpFilesize
120KB
-
memory/1312-227-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/1312-228-0x0000000006E10000-0x0000000006FD2000-memory.dmpFilesize
1.8MB
-
memory/1312-229-0x0000000006FE0000-0x000000000750C000-memory.dmpFilesize
5.2MB
-
memory/1312-232-0x00000000078E0000-0x0000000007930000-memory.dmpFilesize
320KB
-
memory/1312-237-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB