Analysis
-
max time kernel
53s -
max time network
68s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 03:57
General
-
Target
cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exe
-
Size
361KB
-
MD5
e46fef55f8736eb44942857db88d3004
-
SHA1
12a1c90b631b294c1bff7c113ec45cae4d2f9d2d
-
SHA256
cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a
-
SHA512
04cd69a1d7bbb32109adc159a314eca9fbbc323e0363cd587e09fa701e1e585c3d71de7b911d128bef9705771b17574b27cd099037bfd423a7811b8cf180e910
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/5012-153-0x0000000000B40000-0x0000000000BA0000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exepid process 5012 cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exe 5012 cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exedescription pid process Token: SeDebugPrivilege 5012 cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exe"C:\Users\Admin\AppData\Local\Temp\cac9ea95a5f88ee9199c34ff9fa046781db81d4efebbf28a7c4897e551b7047a.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5012-120-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-121-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-122-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-123-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-124-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-125-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-126-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-127-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-128-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-129-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-130-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-131-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-132-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-133-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-134-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-135-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-136-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-137-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-138-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-139-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-140-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-141-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-142-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-143-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-144-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-145-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-146-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-147-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-148-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-149-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-150-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-151-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-152-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-153-0x0000000000B40000-0x0000000000BA0000-memory.dmpFilesize
384KB
-
memory/5012-154-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-155-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-156-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-157-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-158-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-159-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-160-0x0000000005410000-0x0000000005416000-memory.dmpFilesize
24KB
-
memory/5012-161-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-162-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-163-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-164-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-165-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-166-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-167-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-168-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-169-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-170-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-171-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-172-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-173-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-174-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-175-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-176-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-177-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-178-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-179-0x0000000005A60000-0x0000000006066000-memory.dmpFilesize
6.0MB
-
memory/5012-180-0x00000000055C0000-0x00000000056CA000-memory.dmpFilesize
1.0MB
-
memory/5012-181-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-182-0x00000000054F0000-0x0000000005502000-memory.dmpFilesize
72KB
-
memory/5012-183-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-184-0x0000000005550000-0x000000000558E000-memory.dmpFilesize
248KB
-
memory/5012-185-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-186-0x00000000056D0000-0x000000000571B000-memory.dmpFilesize
300KB
-
memory/5012-187-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-188-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-189-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-190-0x00000000058A0000-0x0000000005932000-memory.dmpFilesize
584KB
-
memory/5012-191-0x0000000006A80000-0x0000000006F7E000-memory.dmpFilesize
5.0MB
-
memory/5012-192-0x00000000779E0000-0x0000000077B6E000-memory.dmpFilesize
1.6MB
-
memory/5012-194-0x0000000006070000-0x00000000060D6000-memory.dmpFilesize
408KB
-
memory/5012-202-0x0000000006630000-0x00000000066A6000-memory.dmpFilesize
472KB
-
memory/5012-203-0x00000000066B0000-0x0000000006700000-memory.dmpFilesize
320KB
-
memory/5012-204-0x0000000006F80000-0x0000000007142000-memory.dmpFilesize
1.8MB
-
memory/5012-205-0x0000000007D00000-0x000000000822C000-memory.dmpFilesize
5.2MB