Analysis
-
max time kernel
72s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 03:59
General
-
Target
684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exe
-
Size
361KB
-
MD5
762effd9ff28193cd8e3f28ed4b1c677
-
SHA1
88483e0d63466ae4510de82c759499903c1a3c55
-
SHA256
684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9
-
SHA512
68662f34b6e0318615ebd10b652a5638b7788e570881de579857bfd2837bda45984f6559ce061c0174fc1fa4237131cbc1737697faecec2a4646690a0c2d59d0
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/4456-132-0x00000000000C0000-0x0000000000120000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exepid process 4456 684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exe 4456 684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exedescription pid process Token: SeDebugPrivilege 4456 684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exe"C:\Users\Admin\AppData\Local\Temp\684ebc86bb3615d5e89944e9f0cdeedf6c03fee99f57c4c1490034e124a801c9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4456-132-0x00000000000C0000-0x0000000000120000-memory.dmpFilesize
384KB
-
memory/4456-133-0x000000000A750000-0x000000000AD68000-memory.dmpFilesize
6.1MB
-
memory/4456-134-0x000000000A2D0000-0x000000000A3DA000-memory.dmpFilesize
1.0MB
-
memory/4456-135-0x000000000A200000-0x000000000A212000-memory.dmpFilesize
72KB
-
memory/4456-136-0x000000000A260000-0x000000000A29C000-memory.dmpFilesize
240KB
-
memory/4456-137-0x000000000B320000-0x000000000B8C4000-memory.dmpFilesize
5.6MB
-
memory/4456-138-0x000000000AD70000-0x000000000AE02000-memory.dmpFilesize
584KB
-
memory/4456-139-0x000000000A6A0000-0x000000000A706000-memory.dmpFilesize
408KB
-
memory/4456-140-0x000000000B950000-0x000000000B9C6000-memory.dmpFilesize
472KB
-
memory/4456-141-0x000000000B8D0000-0x000000000B920000-memory.dmpFilesize
320KB
-
memory/4456-142-0x000000000BC60000-0x000000000BE22000-memory.dmpFilesize
1.8MB
-
memory/4456-143-0x000000000C360000-0x000000000C88C000-memory.dmpFilesize
5.2MB