Analysis
-
max time kernel
52s -
max time network
149s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 04:39
General
-
Target
e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exe
-
Size
361KB
-
MD5
e558bd7386cd6b28745b0c447a761b46
-
SHA1
1c2db66253b25668fb21fa28bc5e18555ff203bd
-
SHA256
e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979
-
SHA512
fa00a4f60380d3b360ff128ee19a8353d1415802f0adfde6a4b951d3e8765b0b2a4662d571967e0d2d3fec65f94b547fedcfb8cf4f49f2c10556561e1f4abeb1
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5004-148-0x0000000000530000-0x0000000000590000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exepid process 5004 e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exe 5004 e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exedescription pid process Token: SeDebugPrivilege 5004 e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exe"C:\Users\Admin\AppData\Local\Temp\e65aabd2655f0eb850c033b53558efe7b1af63d0b807834719d7eeada5ae7979.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5004-115-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-116-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-117-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-118-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-119-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-120-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-121-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-122-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-123-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-124-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-125-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-126-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-127-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-128-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-129-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-130-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-131-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-132-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-133-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-134-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-135-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-136-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-137-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-138-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-139-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-140-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-141-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-142-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-143-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-144-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-145-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-146-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-147-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-148-0x0000000000530000-0x0000000000590000-memory.dmpFilesize
384KB
-
memory/5004-149-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-150-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-151-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-152-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-153-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-154-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-155-0x0000000002760000-0x0000000002766000-memory.dmpFilesize
24KB
-
memory/5004-156-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-157-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-158-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-159-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-160-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-161-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-162-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-163-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-164-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-165-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-166-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-167-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-168-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-169-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-170-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-171-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-172-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-173-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-174-0x000000000AA60000-0x000000000B066000-memory.dmpFilesize
6.0MB
-
memory/5004-175-0x000000000A5D0000-0x000000000A6DA000-memory.dmpFilesize
1.0MB
-
memory/5004-176-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-177-0x000000000A500000-0x000000000A512000-memory.dmpFilesize
72KB
-
memory/5004-178-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-179-0x000000000A560000-0x000000000A59E000-memory.dmpFilesize
248KB
-
memory/5004-180-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-181-0x000000000A6E0000-0x000000000A72B000-memory.dmpFilesize
300KB
-
memory/5004-182-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-183-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-184-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-185-0x000000000B570000-0x000000000BA6E000-memory.dmpFilesize
5.0MB
-
memory/5004-186-0x0000000077BE0000-0x0000000077D6E000-memory.dmpFilesize
1.6MB
-
memory/5004-187-0x000000000A990000-0x000000000A9F6000-memory.dmpFilesize
408KB
-
memory/5004-195-0x000000000B480000-0x000000000B512000-memory.dmpFilesize
584KB
-
memory/5004-197-0x000000000BD70000-0x000000000BF32000-memory.dmpFilesize
1.8MB
-
memory/5004-198-0x000000000C470000-0x000000000C99C000-memory.dmpFilesize
5.2MB
-
memory/5004-202-0x000000000BC60000-0x000000000BCD6000-memory.dmpFilesize
472KB
-
memory/5004-203-0x000000000BBE0000-0x000000000BC30000-memory.dmpFilesize
320KB