Analysis
-
max time kernel
102s -
max time network
103s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 03:58
General
-
Target
fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exe
-
Size
361KB
-
MD5
04dde39196c9d65369ee4dcedf943775
-
SHA1
4615c64941feafdacfea52f1091158d9c1121685
-
SHA256
fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028
-
SHA512
defb44fd1aa2464f518040c29503162654782039abd1afee181e6bdf0dba7d4686a881c164448df6686e96b5bffd893fa0fff41f58a42c594c2123fd5207f223
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3516-149-0x0000000000BF0000-0x0000000000C50000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exepid process 3516 fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exe 3516 fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exedescription pid process Token: SeDebugPrivilege 3516 fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exe"C:\Users\Admin\AppData\Local\Temp\fadbafc35e6be9d5d56833504d96a9fcc05ac5c8251f5e85ccc0281d6b1f2028.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-124-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-125-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-127-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-126-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-128-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-129-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-130-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-131-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-132-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-133-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-134-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-135-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-136-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-137-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-138-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-139-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-140-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-141-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-142-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-143-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-144-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-145-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-146-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-147-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-148-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-149-0x0000000000BF0000-0x0000000000C50000-memory.dmpFilesize
384KB
-
memory/3516-150-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-151-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-152-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-153-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-154-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-155-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-156-0x00000000053C0000-0x00000000053C6000-memory.dmpFilesize
24KB
-
memory/3516-157-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-158-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-159-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-160-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-161-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-162-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-163-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-164-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-165-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-166-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-167-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-168-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-169-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-170-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-171-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-172-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-173-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-174-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-175-0x000000000B100000-0x000000000B706000-memory.dmpFilesize
6.0MB
-
memory/3516-176-0x000000000AC90000-0x000000000AD9A000-memory.dmpFilesize
1.0MB
-
memory/3516-177-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-178-0x000000000ABC0000-0x000000000ABD2000-memory.dmpFilesize
72KB
-
memory/3516-179-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-180-0x000000000AC20000-0x000000000AC5E000-memory.dmpFilesize
248KB
-
memory/3516-181-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-182-0x000000000ADA0000-0x000000000ADEB000-memory.dmpFilesize
300KB
-
memory/3516-183-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-184-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-185-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-186-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-187-0x000000000AF40000-0x000000000AFA6000-memory.dmpFilesize
408KB
-
memory/3516-195-0x000000000BAB0000-0x000000000BB42000-memory.dmpFilesize
584KB
-
memory/3516-196-0x000000000C050000-0x000000000C54E000-memory.dmpFilesize
5.0MB
-
memory/3516-198-0x000000000BE20000-0x000000000BFE2000-memory.dmpFilesize
1.8MB
-
memory/3516-199-0x000000000CA80000-0x000000000CFAC000-memory.dmpFilesize
5.2MB
-
memory/3516-203-0x000000000C550000-0x000000000C5C6000-memory.dmpFilesize
472KB
-
memory/3516-204-0x000000000BD60000-0x000000000BDB0000-memory.dmpFilesize
320KB