Analysis
-
max time kernel
61s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
10-08-2022 18:52
Static task
static1
General
-
Target
e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exe
-
Size
442KB
-
MD5
45632922b184c5e1604b321a57ec5747
-
SHA1
6ecb49bae4765dfbfc81dd0233a8fd85014bc9c6
-
SHA256
e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4
-
SHA512
be7f1630f72c30ff87c2da9551f4556984de1f3fe35aea683ad24032aa68bf9c7d46e637359dc377c0dd2cff3c5ec0171797680f8eea7a09a5b8c4f64cabb841
Malware Config
Extracted
redline
ruzki
193.106.191.165:39482
-
auth_value
71a0558c0eea274a5bd617ea85786884
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exepid process 1884 e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exe 1884 e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exedescription pid process Token: SeDebugPrivilege 1884 e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exe"C:\Users\Admin\AppData\Local\Temp\e26e33cf43282ee619fb42dda11d2dc9891240c5d3c86de383dbc07ac4270bb4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1884-114-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-115-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-116-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-117-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-118-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-119-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-120-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-121-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-122-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-123-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-124-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-125-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-126-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-127-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-128-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-129-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-130-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-131-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-132-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-133-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-134-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-135-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-137-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-138-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-139-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-140-0x0000000000520000-0x000000000066A000-memory.dmpFilesize
1.3MB
-
memory/1884-141-0x0000000000520000-0x00000000005CE000-memory.dmpFilesize
696KB
-
memory/1884-142-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-143-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-144-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-145-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-146-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-147-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-148-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-149-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-150-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-151-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB
-
memory/1884-152-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-153-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-154-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-155-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-156-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-157-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-159-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-158-0x0000000002370000-0x00000000023A2000-memory.dmpFilesize
200KB
-
memory/1884-160-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-161-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-162-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-163-0x0000000004EE0000-0x00000000053DE000-memory.dmpFilesize
5.0MB
-
memory/1884-164-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-165-0x00000000025D0000-0x0000000002600000-memory.dmpFilesize
192KB
-
memory/1884-166-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-167-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-168-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-169-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-170-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-171-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-172-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-173-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-174-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-175-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-176-0x00000000053E0000-0x00000000059E6000-memory.dmpFilesize
6.0MB
-
memory/1884-177-0x0000000002810000-0x0000000002822000-memory.dmpFilesize
72KB
-
memory/1884-178-0x0000000004D30000-0x0000000004E3A000-memory.dmpFilesize
1.0MB
-
memory/1884-179-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-180-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-181-0x0000000002970000-0x00000000029AE000-memory.dmpFilesize
248KB
-
memory/1884-182-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-183-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-184-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-185-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-186-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-187-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-188-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1884-189-0x0000000004E40000-0x0000000004E8B000-memory.dmpFilesize
300KB
-
memory/1884-193-0x0000000000520000-0x000000000066A000-memory.dmpFilesize
1.3MB
-
memory/1884-194-0x0000000000520000-0x00000000005CE000-memory.dmpFilesize
696KB
-
memory/1884-197-0x0000000005F70000-0x0000000005FD6000-memory.dmpFilesize
408KB
-
memory/1884-205-0x0000000006390000-0x0000000006406000-memory.dmpFilesize
472KB
-
memory/1884-206-0x0000000006430000-0x00000000064C2000-memory.dmpFilesize
584KB
-
memory/1884-209-0x0000000006550000-0x000000000656E000-memory.dmpFilesize
120KB
-
memory/1884-210-0x0000000006820000-0x00000000069E2000-memory.dmpFilesize
1.8MB
-
memory/1884-211-0x0000000006A00000-0x0000000006F2C000-memory.dmpFilesize
5.2MB
-
memory/1884-218-0x0000000000400000-0x0000000000488000-memory.dmpFilesize
544KB