Analysis
-
max time kernel
91s -
max time network
94s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
11-09-2022 20:07
Static task
static1
Behavioral task
behavioral1
Sample
26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe
Resource
win10-20220812-en
General
-
Target
26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe
-
Size
7.5MB
-
MD5
698f860a3387c43630ce6db9ed23186c
-
SHA1
7c7ef967c36b7be7f3ddfd4a17983e7d87f5abf0
-
SHA256
26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236
-
SHA512
626917073db8c105c1ec5230eb8870e62212613cd8002a6ae10e3ed2ca23f26deb891aaded8f727ba37d8cfc98926d7f5c01f6d7623ac08b1bfe58864ed2dada
-
SSDEEP
196608:MK5w/YJIYf/0jjquBMakyrDQf8UBGo6p1sKKtYnA:MeIYJZ0fbMgQ0U8omsFtYnA
Malware Config
Extracted
redline
3108_RUZKI
213.219.247.199:9452
-
auth_value
f71fed1cd094e4e1eb7ad1c53e542bca
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2308-201-0x000000000041ADD2-mapping.dmp family_redline behavioral1/memory/2308-267-0x0000000000400000-0x0000000000420000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exedescription pid process target process PID 2708 set thread context of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
Processes:
ipconfig.exeipconfig.exepid process 64 ipconfig.exe 3568 ipconfig.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
RegAsm.exepid process 2308 RegAsm.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exeRegAsm.exedescription pid process Token: SeDebugPrivilege 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe Token: SeDebugPrivilege 2308 RegAsm.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exedescription pid process target process PID 2708 wrote to memory of 64 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe ipconfig.exe PID 2708 wrote to memory of 64 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe ipconfig.exe PID 2708 wrote to memory of 64 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe ipconfig.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 2308 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe RegAsm.exe PID 2708 wrote to memory of 3568 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe ipconfig.exe PID 2708 wrote to memory of 3568 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe ipconfig.exe PID 2708 wrote to memory of 3568 2708 26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe ipconfig.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe"C:\Users\Admin\AppData\Local\Temp\26cdbe0f7546a9e3468ce796f238e0eef396ff81b1490953bdc58aba76d88236.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /release2⤵
- Gathers network information
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\\Windows\\Microsoft.NET\\Framework\\v4.0.30319\\RegAsm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\ipconfig.exe"C:\Windows\System32\ipconfig.exe" /renew2⤵
- Gathers network information
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/64-183-0x0000000000000000-mapping.dmp
-
memory/64-184-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/64-185-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2308-201-0x000000000041ADD2-mapping.dmp
-
memory/2308-267-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/2308-305-0x0000000006B00000-0x0000000006CC2000-memory.dmpFilesize
1.8MB
-
memory/2308-297-0x0000000006020000-0x0000000006086000-memory.dmpFilesize
408KB
-
memory/2308-295-0x0000000005620000-0x000000000563E000-memory.dmpFilesize
120KB
-
memory/2308-291-0x0000000005440000-0x00000000054B6000-memory.dmpFilesize
472KB
-
memory/2308-287-0x0000000005170000-0x00000000051BB000-memory.dmpFilesize
300KB
-
memory/2308-285-0x0000000005130000-0x000000000516E000-memory.dmpFilesize
248KB
-
memory/2308-282-0x00000000051D0000-0x00000000052DA000-memory.dmpFilesize
1.0MB
-
memory/2308-281-0x0000000002C30000-0x0000000002C42000-memory.dmpFilesize
72KB
-
memory/2308-280-0x00000000056D0000-0x0000000005CD6000-memory.dmpFilesize
6.0MB
-
memory/2708-150-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-159-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-126-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-127-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-128-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-129-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-131-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-132-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-133-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-134-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-135-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-136-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-138-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-139-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-140-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-141-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-143-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-142-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-137-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-130-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-144-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-145-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-146-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-147-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-148-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-149-0x0000000000B50000-0x00000000012DA000-memory.dmpFilesize
7.5MB
-
memory/2708-125-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-151-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-152-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-153-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-154-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-155-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-156-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-157-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-158-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-124-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-160-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-161-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-162-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-163-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-164-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-165-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-166-0x0000000006490000-0x00000000069BC000-memory.dmpFilesize
5.2MB
-
memory/2708-167-0x0000000006000000-0x0000000006092000-memory.dmpFilesize
584KB
-
memory/2708-168-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-169-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-170-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-171-0x0000000005F60000-0x0000000005FCA000-memory.dmpFilesize
424KB
-
memory/2708-172-0x0000000006EC0000-0x00000000073BE000-memory.dmpFilesize
5.0MB
-
memory/2708-173-0x00000000062D0000-0x000000000636C000-memory.dmpFilesize
624KB
-
memory/2708-174-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-175-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-176-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-177-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-178-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-179-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-180-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-181-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-123-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-122-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-121-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-120-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-119-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-118-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-117-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-116-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-115-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/2708-182-0x0000000077AD0000-0x0000000077C5E000-memory.dmpFilesize
1.6MB
-
memory/3568-203-0x0000000000000000-mapping.dmp