Analysis
-
max time kernel
41s -
max time network
61s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:06
General
-
Target
3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exe
-
Size
361KB
-
MD5
48446408ba5b6e329831afd65d070bb1
-
SHA1
7cca7b626ef155c7672ebcc02454e895e422a31a
-
SHA256
3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d
-
SHA512
966945e7720c9d3c88281a63d63318f501a7565725404a8132b93039c27e1cc7dce852e05578aeafd6399123e097be184bd2ed681f56acde5c6dd3f85c0c987e
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2572-151-0x00000000000B0000-0x0000000000110000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exepid process 2572 3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exe 2572 3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exedescription pid process Token: SeDebugPrivilege 2572 3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exe"C:\Users\Admin\AppData\Local\Temp\3fad376327b11e6a4e180b2a40760591656e3429505b073ad4a7503c7a3e1c2d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2572-118-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-119-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-120-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-121-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-122-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-123-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-124-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-125-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-126-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-127-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-128-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-130-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-129-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-131-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-132-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-133-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-134-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-135-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-136-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-137-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-138-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-139-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-140-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-141-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-142-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-143-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-144-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-145-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-146-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-147-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-148-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-149-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-150-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-151-0x00000000000B0000-0x0000000000110000-memory.dmpFilesize
384KB
-
memory/2572-152-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-153-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-154-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-155-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-156-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-157-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-158-0x0000000000910000-0x0000000000916000-memory.dmpFilesize
24KB
-
memory/2572-159-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-160-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-161-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-162-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-163-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-164-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-165-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-166-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-167-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-168-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-169-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-170-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-171-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-172-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-173-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-174-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-175-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-176-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-177-0x0000000005000000-0x0000000005606000-memory.dmpFilesize
6.0MB
-
memory/2572-178-0x0000000004B30000-0x0000000004C3A000-memory.dmpFilesize
1.0MB
-
memory/2572-179-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-180-0x0000000004A60000-0x0000000004A72000-memory.dmpFilesize
72KB
-
memory/2572-181-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-182-0x0000000004AC0000-0x0000000004AFE000-memory.dmpFilesize
248KB
-
memory/2572-183-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-184-0x0000000004C40000-0x0000000004C8B000-memory.dmpFilesize
300KB
-
memory/2572-185-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-186-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-187-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-188-0x0000000004E10000-0x0000000004EA2000-memory.dmpFilesize
584KB
-
memory/2572-189-0x0000000006020000-0x000000000651E000-memory.dmpFilesize
5.0MB
-
memory/2572-190-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2572-192-0x0000000004EB0000-0x0000000004F16000-memory.dmpFilesize
408KB
-
memory/2572-200-0x0000000005C20000-0x0000000005C96000-memory.dmpFilesize
472KB
-
memory/2572-201-0x0000000005960000-0x00000000059B0000-memory.dmpFilesize
320KB
-
memory/2572-202-0x0000000006520000-0x00000000066E2000-memory.dmpFilesize
1.8MB
-
memory/2572-203-0x00000000082A0000-0x00000000087CC000-memory.dmpFilesize
5.2MB