Analysis
-
max time kernel
102s -
max time network
104s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 03:54
General
-
Target
a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exe
-
Size
361KB
-
MD5
879f63362705b6a66a86671da1b516ff
-
SHA1
4c152a51172bd9903ac05acdf8e0e3faf973e881
-
SHA256
a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2
-
SHA512
77d35f8476acaea9208fb4f9255ec7003e70eacf158cb753e77a97c9446f60d78974e376ad94a2b10d68aa191c36fb0495c459c81b92fcb824e097450bb06b04
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3516-149-0x00000000008A0000-0x0000000000900000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exepid process 3516 a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exe 3516 a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exedescription pid process Token: SeDebugPrivilege 3516 a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exe"C:\Users\Admin\AppData\Local\Temp\a6e215152c914c064aece64ad3c5b0b8ec31e44820c79d8e985e23976bb920d2.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-124-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-125-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-127-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-128-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-126-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-129-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-130-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-131-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-132-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-133-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-134-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-135-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-136-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-137-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-138-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-139-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-140-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-141-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-142-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-143-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-144-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-145-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-146-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-147-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-148-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-149-0x00000000008A0000-0x0000000000900000-memory.dmpFilesize
384KB
-
memory/3516-150-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-151-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-152-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-153-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-154-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-155-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-156-0x0000000005070000-0x0000000005076000-memory.dmpFilesize
24KB
-
memory/3516-157-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-158-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-159-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-160-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-161-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-162-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-163-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-164-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-165-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-166-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-167-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-168-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-169-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-170-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-171-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-172-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-173-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-174-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-175-0x000000000ADD0000-0x000000000B3D6000-memory.dmpFilesize
6.0MB
-
memory/3516-176-0x000000000A940000-0x000000000AA4A000-memory.dmpFilesize
1.0MB
-
memory/3516-177-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-178-0x000000000A870000-0x000000000A882000-memory.dmpFilesize
72KB
-
memory/3516-179-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-180-0x000000000A8D0000-0x000000000A90E000-memory.dmpFilesize
248KB
-
memory/3516-181-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-182-0x000000000AA50000-0x000000000AA9B000-memory.dmpFilesize
300KB
-
memory/3516-183-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-184-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-185-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-186-0x000000000B8E0000-0x000000000BDDE000-memory.dmpFilesize
5.0MB
-
memory/3516-187-0x000000000AD30000-0x000000000ADC2000-memory.dmpFilesize
584KB
-
memory/3516-188-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-190-0x000000000B3E0000-0x000000000B446000-memory.dmpFilesize
408KB
-
memory/3516-198-0x000000000C0B0000-0x000000000C272000-memory.dmpFilesize
1.8MB
-
memory/3516-199-0x000000000C7B0000-0x000000000CCDC000-memory.dmpFilesize
5.2MB
-
memory/3516-203-0x000000000C300000-0x000000000C376000-memory.dmpFilesize
472KB
-
memory/3516-204-0x000000000C380000-0x000000000C3D0000-memory.dmpFilesize
320KB