Analysis
-
max time kernel
52s -
max time network
73s -
platform
windows10_x64 -
resource
win10-20220414-en -
resource tags
arch:x64arch:x86image:win10-20220414-enlocale:en-usos:windows10-1703-x64system -
submitted
12-08-2022 10:21
Static task
static1
General
-
Target
7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exe
-
Size
367KB
-
MD5
caa5460279013363bbc841934da6728e
-
SHA1
418b72199e8b4f23d4dbed0dfb3c99ba5fa5bd2e
-
SHA256
7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b
-
SHA512
72a2690af79cf2fbadde3521b99838f781f54929a8b01e5382c41b7a783736473b32cbf53176c282ed0333ab64e1ae5000f631cb9a59c000f5ce3cf75bcc2e1e
Malware Config
Extracted
redline
ruzki
193.106.191.165:39482
-
auth_value
71a0558c0eea274a5bd617ea85786884
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exepid process 1020 7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exe 1020 7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exedescription pid process Token: SeDebugPrivilege 1020 7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exe"C:\Users\Admin\AppData\Local\Temp\7a6d3e5c9d4054aa46f782aad2e7652d2059700ecd081dddeec879ac2ccb7b4b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1020-118-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-119-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-120-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-121-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-122-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-123-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-124-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-125-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-126-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-127-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-128-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-129-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-130-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-131-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-132-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-133-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-134-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-135-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-136-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-137-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-138-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-139-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-140-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-141-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-142-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-143-0x00000000006DA000-0x0000000000705000-memory.dmpFilesize
172KB
-
memory/1020-144-0x00000000005F0000-0x0000000000628000-memory.dmpFilesize
224KB
-
memory/1020-145-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-146-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-147-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-148-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-149-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-150-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-151-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-152-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-153-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-154-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB
-
memory/1020-155-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-156-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-157-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-158-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-159-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-160-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-161-0x0000000002530000-0x0000000002562000-memory.dmpFilesize
200KB
-
memory/1020-162-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-163-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-164-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-165-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-166-0x0000000004C40000-0x000000000513E000-memory.dmpFilesize
5.0MB
-
memory/1020-167-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-168-0x0000000004B20000-0x0000000004B50000-memory.dmpFilesize
192KB
-
memory/1020-169-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-170-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-171-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-172-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-173-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-174-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-175-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-176-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-177-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-178-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-179-0x0000000005140000-0x0000000005746000-memory.dmpFilesize
6.0MB
-
memory/1020-180-0x0000000005780000-0x0000000005792000-memory.dmpFilesize
72KB
-
memory/1020-181-0x00000000057B0000-0x00000000058BA000-memory.dmpFilesize
1.0MB
-
memory/1020-182-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-183-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-184-0x00000000058E0000-0x000000000591E000-memory.dmpFilesize
248KB
-
memory/1020-185-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-186-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-187-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-188-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-189-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-190-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-191-0x0000000077010000-0x000000007719E000-memory.dmpFilesize
1.6MB
-
memory/1020-192-0x0000000005950000-0x000000000599B000-memory.dmpFilesize
300KB
-
memory/1020-197-0x00000000006DA000-0x0000000000705000-memory.dmpFilesize
172KB
-
memory/1020-198-0x00000000005F0000-0x0000000000628000-memory.dmpFilesize
224KB
-
memory/1020-199-0x0000000005CE0000-0x0000000005D56000-memory.dmpFilesize
472KB
-
memory/1020-200-0x0000000005DD0000-0x0000000005E62000-memory.dmpFilesize
584KB
-
memory/1020-203-0x0000000005CB0000-0x0000000005CCE000-memory.dmpFilesize
120KB
-
memory/1020-205-0x0000000005FE0000-0x0000000006046000-memory.dmpFilesize
408KB
-
memory/1020-213-0x0000000006730000-0x00000000068F2000-memory.dmpFilesize
1.8MB
-
memory/1020-214-0x0000000006900000-0x0000000006E2C000-memory.dmpFilesize
5.2MB
-
memory/1020-221-0x00000000006DA000-0x0000000000705000-memory.dmpFilesize
172KB
-
memory/1020-222-0x0000000000400000-0x0000000000474000-memory.dmpFilesize
464KB