Analysis
-
max time kernel
106s -
max time network
108s -
platform
windows10-1703_x64 -
resource
win10-20220718-en -
resource tags
arch:x64arch:x86image:win10-20220718-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2022 04:03
Static task
static1
General
-
Target
439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exe
-
Size
347KB
-
MD5
78cd9003bbfa53a8a140e0a6dea99b72
-
SHA1
3524f15a385af980ffc9f8fd2dd0ca0e7f148467
-
SHA256
439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e
-
SHA512
ec61096f991f0fcfe5e9b0853d574ee798c81c3728f0b1f1b5662aef8d54b48d4e34556a443f424b6345e5c1e8dece7d88e91221eedb24327c7d3ce088af5af4
Malware Config
Extracted
redline
ruzki
193.106.191.165:39482
-
auth_value
71a0558c0eea274a5bd617ea85786884
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exepid process 1932 439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exe 1932 439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exedescription pid process Token: SeDebugPrivilege 1932 439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exe"C:\Users\Admin\AppData\Local\Temp\439ce44fb0b30ef30193e3f867069b13ed265f1da0de418fab831bb3c430f15e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1932-114-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-115-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-116-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-117-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-118-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-119-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-120-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-121-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-122-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-123-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-124-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-125-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-126-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-127-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-128-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-129-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-130-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-131-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-132-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-133-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-134-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-135-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-136-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-137-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-138-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-139-0x00000000007CA000-0x00000000007F4000-memory.dmpFilesize
168KB
-
memory/1932-140-0x00000000006F0000-0x0000000000728000-memory.dmpFilesize
224KB
-
memory/1932-141-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-142-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-143-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-144-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-145-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-146-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-147-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-148-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-149-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-150-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-151-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB
-
memory/1932-152-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-153-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-154-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-155-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-156-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-157-0x0000000002330000-0x0000000002362000-memory.dmpFilesize
200KB
-
memory/1932-158-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-159-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-160-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-161-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-162-0x0000000004BD0000-0x00000000050CE000-memory.dmpFilesize
5.0MB
-
memory/1932-163-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-164-0x00000000024F0000-0x0000000002520000-memory.dmpFilesize
192KB
-
memory/1932-165-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-166-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-167-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-168-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-169-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-170-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-171-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-172-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-173-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-174-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-175-0x00000000050E0000-0x00000000056E6000-memory.dmpFilesize
6.0MB
-
memory/1932-176-0x0000000005770000-0x0000000005782000-memory.dmpFilesize
72KB
-
memory/1932-177-0x00000000057A0000-0x00000000058AA000-memory.dmpFilesize
1.0MB
-
memory/1932-178-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-179-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-180-0x00000000058D0000-0x000000000590E000-memory.dmpFilesize
248KB
-
memory/1932-181-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-182-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-183-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-184-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-185-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-186-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-187-0x0000000077B20000-0x0000000077CAE000-memory.dmpFilesize
1.6MB
-
memory/1932-188-0x0000000005940000-0x000000000598B000-memory.dmpFilesize
300KB
-
memory/1932-192-0x00000000007CA000-0x00000000007F4000-memory.dmpFilesize
168KB
-
memory/1932-193-0x00000000006F0000-0x0000000000728000-memory.dmpFilesize
224KB
-
memory/1932-196-0x00000000005F0000-0x0000000000656000-memory.dmpFilesize
408KB
-
memory/1932-204-0x00000000060F0000-0x0000000006166000-memory.dmpFilesize
472KB
-
memory/1932-205-0x00000000061F0000-0x0000000006282000-memory.dmpFilesize
584KB
-
memory/1932-208-0x00000000061C0000-0x00000000061DE000-memory.dmpFilesize
120KB
-
memory/1932-209-0x00000000064E0000-0x00000000066A2000-memory.dmpFilesize
1.8MB
-
memory/1932-210-0x00000000066B0000-0x0000000006BDC000-memory.dmpFilesize
5.2MB
-
memory/1932-217-0x00000000007CA000-0x00000000007F4000-memory.dmpFilesize
168KB
-
memory/1932-218-0x0000000000400000-0x000000000046F000-memory.dmpFilesize
444KB