Analysis
-
max time kernel
51s -
max time network
73s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
06-08-2022 08:50
Static task
static1
General
-
Target
94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exe
-
Size
413KB
-
MD5
436533dac4c5ade1dfc6b44c7101fece
-
SHA1
9e57ba6c41fbbccc19a85122f846d03d61f414bd
-
SHA256
94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9
-
SHA512
4b20731f2e02f6c8e89720820088375bd99cccbeec4061debff37027fb6e0006d24e97736c77bb6ae14eaa3e90450d8e04d626eae844bdc688d31160750314a5
Malware Config
Extracted
redline
AF2
stcontact.top:80
-
auth_value
4d729a2faecb406a0eb1d6fcf30432fa
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exepid process 3000 94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exe 3000 94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exedescription pid process Token: SeDebugPrivilege 3000 94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exe"C:\Users\Admin\AppData\Local\Temp\94d505ded067e27099b877571a04ef3178264abf78d6ada7c16d3e1cc4d275b9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3000-118-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-119-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-120-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-121-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-122-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-123-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-124-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-125-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-127-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-126-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-128-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-129-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-130-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-131-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-132-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-133-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-134-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-135-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-136-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-137-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-138-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-139-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-141-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-142-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-143-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-144-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-145-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-146-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/3000-147-0x0000000002230000-0x0000000002268000-memory.dmpFilesize
224KB
-
memory/3000-148-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-149-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-150-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-151-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-152-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-153-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-154-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-155-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB
-
memory/3000-156-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-157-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-158-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-159-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-160-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-161-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-162-0x0000000002490000-0x00000000024C0000-memory.dmpFilesize
192KB
-
memory/3000-163-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-164-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-165-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-166-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-167-0x0000000004B40000-0x000000000503E000-memory.dmpFilesize
5.0MB
-
memory/3000-168-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-169-0x0000000005040000-0x0000000005070000-memory.dmpFilesize
192KB
-
memory/3000-170-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-171-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-172-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-173-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-174-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-175-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-176-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-177-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-178-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-179-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-180-0x0000000005090000-0x0000000005696000-memory.dmpFilesize
6.0MB
-
memory/3000-181-0x0000000005720000-0x0000000005732000-memory.dmpFilesize
72KB
-
memory/3000-182-0x0000000005750000-0x000000000585A000-memory.dmpFilesize
1.0MB
-
memory/3000-183-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-184-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-185-0x00000000058A0000-0x00000000058DE000-memory.dmpFilesize
248KB
-
memory/3000-186-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-187-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-188-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-189-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-190-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-191-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-192-0x0000000077230000-0x00000000773BE000-memory.dmpFilesize
1.6MB
-
memory/3000-193-0x00000000058F0000-0x000000000593B000-memory.dmpFilesize
300KB
-
memory/3000-208-0x0000000002230000-0x0000000002268000-memory.dmpFilesize
224KB
-
memory/3000-218-0x0000000006640000-0x00000000066B6000-memory.dmpFilesize
472KB
-
memory/3000-219-0x00000000066F0000-0x0000000006782000-memory.dmpFilesize
584KB
-
memory/3000-222-0x00000000067C0000-0x00000000067DE000-memory.dmpFilesize
120KB
-
memory/3000-224-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/3000-223-0x0000000006980000-0x00000000069E6000-memory.dmpFilesize
408KB
-
memory/3000-232-0x0000000006BC0000-0x0000000006C10000-memory.dmpFilesize
320KB
-
memory/3000-233-0x0000000006EC0000-0x0000000007082000-memory.dmpFilesize
1.8MB
-
memory/3000-234-0x0000000007090000-0x00000000075BC000-memory.dmpFilesize
5.2MB
-
memory/3000-241-0x0000000000400000-0x0000000000484000-memory.dmpFilesize
528KB