Analysis

  • max time kernel
    71s
  • max time network
    133s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    24/09/2022, 20:53

General

  • Target

    3a587e284489c0f8be8d1ea87f507d6dd6da8992e14590cfb25c513ec7007606.exe

  • Size

    360KB

  • MD5

    3484cf1ab61564ade7b0c112525a1e72

  • SHA1

    d2747fe4c1cb2ad2057404cf883a71d883db7c34

  • SHA256

    3a587e284489c0f8be8d1ea87f507d6dd6da8992e14590cfb25c513ec7007606

  • SHA512

    16aad70658631c4f0b549e7238f1796ae8aff0f0754fe2a93d998b90e7db8c3282acd9844b05408427298bf8338e9d10b630e753333e875e6e91e08c34646ea9

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\3a587e284489c0f8be8d1ea87f507d6dd6da8992e14590cfb25c513ec7007606.exe
    "C:\Users\Admin\AppData\Local\Temp\3a587e284489c0f8be8d1ea87f507d6dd6da8992e14590cfb25c513ec7007606.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2244

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2244-116-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-117-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-118-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-119-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-120-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-121-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-122-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-123-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-124-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-125-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-126-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-127-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-129-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-128-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-130-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-131-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-132-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-133-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-134-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-135-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-136-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-137-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-138-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-139-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-140-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-141-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-142-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-143-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-144-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-145-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-146-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-147-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-148-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-149-0x0000000000AC0000-0x0000000000B20000-memory.dmp

    Filesize

    384KB

  • memory/2244-150-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-151-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-152-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-153-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-154-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-155-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-156-0x0000000001360000-0x0000000001366000-memory.dmp

    Filesize

    24KB

  • memory/2244-157-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-158-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-159-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-160-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-161-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-162-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-163-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-164-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-165-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-166-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-167-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-168-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-169-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-170-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-171-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-172-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-173-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-174-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-175-0x000000000AFE0000-0x000000000B5E6000-memory.dmp

    Filesize

    6.0MB

  • memory/2244-176-0x000000000AB60000-0x000000000AC6A000-memory.dmp

    Filesize

    1.0MB

  • memory/2244-177-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-178-0x000000000AA90000-0x000000000AAA2000-memory.dmp

    Filesize

    72KB

  • memory/2244-179-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-180-0x000000000AAF0000-0x000000000AB2E000-memory.dmp

    Filesize

    248KB

  • memory/2244-181-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-182-0x000000000AC70000-0x000000000ACBB000-memory.dmp

    Filesize

    300KB

  • memory/2244-183-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-184-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-185-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-186-0x0000000077470000-0x00000000775FE000-memory.dmp

    Filesize

    1.6MB

  • memory/2244-187-0x000000000AE10000-0x000000000AE76000-memory.dmp

    Filesize

    408KB

  • memory/2244-195-0x000000000B990000-0x000000000BA22000-memory.dmp

    Filesize

    584KB

  • memory/2244-196-0x000000000BF30000-0x000000000C42E000-memory.dmp

    Filesize

    5.0MB

  • memory/2244-198-0x000000000C430000-0x000000000C5F2000-memory.dmp

    Filesize

    1.8MB

  • memory/2244-199-0x000000000CB30000-0x000000000D05C000-memory.dmp

    Filesize

    5.2MB

  • memory/2244-203-0x000000000BD30000-0x000000000BDA6000-memory.dmp

    Filesize

    472KB

  • memory/2244-204-0x000000000BCB0000-0x000000000BD00000-memory.dmp

    Filesize

    320KB