Analysis
-
max time kernel
54s -
max time network
72s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
30-08-2022 04:13
General
-
Target
7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exe
-
Size
114KB
-
MD5
9903088be4e00d4c6020f85c049869dc
-
SHA1
5c7fbf5fbf256f858297bcc38a9df8d597377cb9
-
SHA256
7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86
-
SHA512
6f6f5269a38b1f6147f917b095f0e621860702c283643b3cc486499c8c61a799789e44cf31763b6cf7c2e7af61d09d967d9b9e01250fa2a1949aaa7ee6524c61
-
SSDEEP
1536:rK6DS0wmpHEkMW2nzfPfqQklJXs7MmmwoItEQop08vrLM8buOfMoICLe0wuei6k0:mkvpHEk7SaF2oItrop9P/Godah20
Malware Config
Extracted
redline
Bot
103.173.226.188:19733
-
auth_value
bd44af08de57612871a5de0c3c534b39
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exepid process 864 7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exedescription pid process Token: SeDebugPrivilege 864 7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exe"C:\Users\Admin\AppData\Local\Temp\7e032138b9e7ddc0e4642b3ee42a373fdff575a2a42fef8204c47f0c1a445f86.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/864-120-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-121-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-122-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-123-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-124-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-125-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-126-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-127-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-128-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-129-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-130-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-131-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-132-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-133-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-134-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-135-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-136-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-137-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-138-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-139-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-140-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-141-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-142-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-143-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-144-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-145-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-146-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-147-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-148-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-149-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-150-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-151-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-152-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-153-0x0000000000D80000-0x0000000000DA2000-memory.dmpFilesize
136KB
-
memory/864-154-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-155-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-156-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-157-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-158-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-159-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-160-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-161-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-162-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-163-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-164-0x00000000059F0000-0x0000000005EEE000-memory.dmpFilesize
5.0MB
-
memory/864-165-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-166-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-167-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-168-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-169-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-170-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-171-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-172-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-173-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-174-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-175-0x0000000006500000-0x0000000006B06000-memory.dmpFilesize
6.0MB
-
memory/864-176-0x0000000005600000-0x0000000005612000-memory.dmpFilesize
72KB
-
memory/864-177-0x0000000005730000-0x000000000583A000-memory.dmpFilesize
1.0MB
-
memory/864-178-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-179-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-180-0x0000000005660000-0x000000000569E000-memory.dmpFilesize
248KB
-
memory/864-181-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-182-0x00000000056A0000-0x00000000056EB000-memory.dmpFilesize
300KB
-
memory/864-183-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-184-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-185-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-186-0x0000000005EF0000-0x0000000005F66000-memory.dmpFilesize
472KB
-
memory/864-187-0x0000000006010000-0x00000000060A2000-memory.dmpFilesize
584KB
-
memory/864-188-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-189-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-190-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-191-0x0000000005F70000-0x0000000005F8E000-memory.dmpFilesize
120KB
-
memory/864-192-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-193-0x0000000006220000-0x0000000006286000-memory.dmpFilesize
408KB
-
memory/864-194-0x0000000077B60000-0x0000000077CEE000-memory.dmpFilesize
1.6MB
-
memory/864-202-0x0000000007B50000-0x0000000007BA0000-memory.dmpFilesize
320KB
-
memory/864-203-0x0000000007D70000-0x0000000007F32000-memory.dmpFilesize
1.8MB
-
memory/864-204-0x0000000008470000-0x000000000899C000-memory.dmpFilesize
5.2MB