Analysis
-
max time kernel
52s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:08
General
-
Target
57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exe
-
Size
361KB
-
MD5
4e731540f802f6c590f762b1fe1e665e
-
SHA1
5f18c44409cf5d2a908c12e72fe41b78f779e235
-
SHA256
57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1
-
SHA512
31fa8368dfc6f7f53ae5bc990a81918a4e0d390ceaa4ccef6635cb9d44cdc579213ee96a37ee7b903ea9e4777d3826766adbbc00d44e2f74ad75abcb1741216a
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2896-149-0x00000000003B0000-0x0000000000410000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exepid process 2896 57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exe 2896 57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exedescription pid process Token: SeDebugPrivilege 2896 57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exe"C:\Users\Admin\AppData\Local\Temp\57ec944101448099734be182a3485a372cbb928af6f232584ab0bab5211a70d1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2896-116-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-117-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-118-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-119-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-120-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-121-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-122-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-123-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-124-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-125-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-126-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-127-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-128-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-129-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-130-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-131-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-132-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-133-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-134-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-135-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-137-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-139-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-138-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-136-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-140-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-141-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-142-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-143-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-144-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-145-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-146-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-147-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-148-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-149-0x00000000003B0000-0x0000000000410000-memory.dmpFilesize
384KB
-
memory/2896-150-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-151-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-152-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-153-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-154-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-155-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-156-0x0000000000DE0000-0x0000000000DE6000-memory.dmpFilesize
24KB
-
memory/2896-157-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-158-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-159-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-160-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-161-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-162-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-163-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-164-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-165-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-166-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-167-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-168-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-169-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-170-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-171-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-172-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-173-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-174-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-175-0x000000000A910000-0x000000000AF16000-memory.dmpFilesize
6.0MB
-
memory/2896-176-0x000000000A450000-0x000000000A55A000-memory.dmpFilesize
1.0MB
-
memory/2896-177-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-178-0x000000000A380000-0x000000000A392000-memory.dmpFilesize
72KB
-
memory/2896-179-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-180-0x000000000A3E0000-0x000000000A41E000-memory.dmpFilesize
248KB
-
memory/2896-181-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-182-0x000000000A560000-0x000000000A5AB000-memory.dmpFilesize
300KB
-
memory/2896-183-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-184-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-185-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-186-0x00000000779D0000-0x0000000077B5E000-memory.dmpFilesize
1.6MB
-
memory/2896-187-0x000000000A700000-0x000000000A766000-memory.dmpFilesize
408KB
-
memory/2896-195-0x000000000B2C0000-0x000000000B352000-memory.dmpFilesize
584KB
-
memory/2896-196-0x000000000B860000-0x000000000BD5E000-memory.dmpFilesize
5.0MB
-
memory/2896-198-0x000000000B530000-0x000000000B6F2000-memory.dmpFilesize
1.8MB
-
memory/2896-199-0x000000000C290000-0x000000000C7BC000-memory.dmpFilesize
5.2MB
-
memory/2896-203-0x000000000BD60000-0x000000000BDD6000-memory.dmpFilesize
472KB
-
memory/2896-204-0x000000000B470000-0x000000000B4C0000-memory.dmpFilesize
320KB