Analysis
-
max time kernel
76s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
11-08-2022 09:24
Static task
static1
General
-
Target
3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exe
-
Size
355KB
-
MD5
a68a9b83e88030d612753e6777d7c9e9
-
SHA1
fac85f65290396c32bb9eeadbf1abd44d1437022
-
SHA256
3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b
-
SHA512
ac1ef28d411285673efffef0b7b528192694064bfa8c7e22efc87327a917f8d0cdfbe31d5778ab97d9d30efac17932f6cefc368eccfebadf282a71243452185b
Malware Config
Extracted
redline
ruzki
193.106.191.165:39482
-
auth_value
71a0558c0eea274a5bd617ea85786884
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exepid process 2416 3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exe 2416 3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exedescription pid process Token: SeDebugPrivilege 2416 3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exe"C:\Users\Admin\AppData\Local\Temp\3c591943eed225ad674b2f4e345e5e5a8fa9d59f940e7dda9f44e79b1f38071b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2416-114-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-115-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-116-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-117-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-118-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-119-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-120-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-121-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-122-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-123-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-124-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-125-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-126-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-127-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-128-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-130-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-131-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-132-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-133-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-134-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-135-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-136-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-137-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-138-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-139-0x00000000025B0000-0x00000000026FA000-memory.dmpFilesize
1.3MB
-
memory/2416-141-0x00000000024E0000-0x000000000258E000-memory.dmpFilesize
696KB
-
memory/2416-142-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-143-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-140-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-144-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-145-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-146-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-147-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-149-0x0000000000400000-0x00000000024DE000-memory.dmpFilesize
32.9MB
-
memory/2416-148-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-150-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-151-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-152-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-153-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-154-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-155-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-156-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-157-0x0000000004270000-0x00000000042A2000-memory.dmpFilesize
200KB
-
memory/2416-158-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-159-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-160-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-161-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-162-0x0000000006AB0000-0x0000000006FAE000-memory.dmpFilesize
5.0MB
-
memory/2416-163-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-164-0x00000000045F0000-0x0000000004620000-memory.dmpFilesize
192KB
-
memory/2416-165-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-166-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-167-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-168-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-169-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-170-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-171-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-172-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-173-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-174-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-175-0x0000000007770000-0x0000000007D76000-memory.dmpFilesize
6.0MB
-
memory/2416-176-0x00000000071D0000-0x00000000071E2000-memory.dmpFilesize
72KB
-
memory/2416-177-0x0000000007200000-0x000000000730A000-memory.dmpFilesize
1.0MB
-
memory/2416-178-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-179-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-180-0x0000000007330000-0x000000000736E000-memory.dmpFilesize
248KB
-
memory/2416-181-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-182-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-183-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-184-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-185-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-186-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-187-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-188-0x00000000073A0000-0x00000000073EB000-memory.dmpFilesize
300KB
-
memory/2416-189-0x0000000076ED0000-0x000000007705E000-memory.dmpFilesize
1.6MB
-
memory/2416-192-0x00000000025B0000-0x00000000026FA000-memory.dmpFilesize
1.3MB
-
memory/2416-194-0x0000000007640000-0x00000000076A6000-memory.dmpFilesize
408KB
-
memory/2416-202-0x00000000082F0000-0x0000000008366000-memory.dmpFilesize
472KB
-
memory/2416-203-0x00000000083B0000-0x0000000008442000-memory.dmpFilesize
584KB
-
memory/2416-206-0x00000000085B0000-0x00000000085CE000-memory.dmpFilesize
120KB
-
memory/2416-207-0x00000000086E0000-0x00000000088A2000-memory.dmpFilesize
1.8MB
-
memory/2416-208-0x00000000088B0000-0x0000000008DDC000-memory.dmpFilesize
5.2MB
-
memory/2416-211-0x0000000000400000-0x00000000024DE000-memory.dmpFilesize
32.9MB
-
memory/2416-216-0x0000000000400000-0x00000000024DE000-memory.dmpFilesize
32.9MB