Analysis
-
max time kernel
54s -
max time network
61s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 03:41
General
-
Target
6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exe
-
Size
361KB
-
MD5
21742befe771d05d034d3abc6155b999
-
SHA1
0e7eb61938a8abf23b58f6ed6dacc03673a16dfb
-
SHA256
6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2
-
SHA512
735dad23becd488779cdf6086a02615d3f4c59fd4418e53eeaecbee990c48851d876f1b49a72bc0b915bcea9b94099101a5b901d4eacf7c88c796c8b6fee8608
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2668-151-0x0000000000F30000-0x0000000000F90000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exepid process 2668 6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exe 2668 6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exedescription pid process Token: SeDebugPrivilege 2668 6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exe"C:\Users\Admin\AppData\Local\Temp\6b1463daf93cecba339c7abb5a90ebe5380a9311d04a0feb9543bb062e7407d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2668-118-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-119-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-120-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-121-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-122-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-123-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-124-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-125-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-126-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-127-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-128-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-129-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-130-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-131-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-132-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-133-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-134-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-135-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-137-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-139-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-141-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-140-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-138-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-136-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-142-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-143-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-144-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-145-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-147-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-146-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-148-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-149-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-150-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-151-0x0000000000F30000-0x0000000000F90000-memory.dmpFilesize
384KB
-
memory/2668-153-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-152-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-154-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-155-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-156-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-157-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-158-0x0000000003090000-0x0000000003096000-memory.dmpFilesize
24KB
-
memory/2668-159-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-160-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-161-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-162-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-164-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-163-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-165-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-166-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-167-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-168-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-170-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-169-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-173-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-176-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-175-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-174-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-172-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-171-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-177-0x000000000B460000-0x000000000BA66000-memory.dmpFilesize
6.0MB
-
memory/2668-178-0x000000000AFD0000-0x000000000B0DA000-memory.dmpFilesize
1.0MB
-
memory/2668-179-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-180-0x000000000AF00000-0x000000000AF12000-memory.dmpFilesize
72KB
-
memory/2668-181-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-182-0x000000000AF60000-0x000000000AF9E000-memory.dmpFilesize
248KB
-
memory/2668-183-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-185-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-184-0x000000000B0E0000-0x000000000B12B000-memory.dmpFilesize
300KB
-
memory/2668-187-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-186-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-188-0x000000000B2B0000-0x000000000B342000-memory.dmpFilesize
584KB
-
memory/2668-189-0x000000000BF70000-0x000000000C46E000-memory.dmpFilesize
5.0MB
-
memory/2668-190-0x00000000776D0000-0x000000007785E000-memory.dmpFilesize
1.6MB
-
memory/2668-192-0x000000000B350000-0x000000000B3B6000-memory.dmpFilesize
408KB
-
memory/2668-200-0x000000000C640000-0x000000000C802000-memory.dmpFilesize
1.8MB
-
memory/2668-201-0x000000000CD40000-0x000000000D26C000-memory.dmpFilesize
5.2MB
-
memory/2668-205-0x000000000C810000-0x000000000C886000-memory.dmpFilesize
472KB
-
memory/2668-206-0x000000000C890000-0x000000000C8E0000-memory.dmpFilesize
320KB