Analysis
-
max time kernel
91s -
max time network
110s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2022 05:11
General
-
Target
eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exe
-
Size
361KB
-
MD5
837bc1f01c9f6b8b05016d9624714fbf
-
SHA1
0b578c195c6d0fc8adacb136a4e3a6e380bc5fda
-
SHA256
eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd
-
SHA512
ed7a9e1b8d41132fd59493ad998855dbbf76cf6fffa9e6d706388ab96b834c0befc536ecabed2a063a325358d3f9c22351dbb9f86cc2201599c91771cb4afeff
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/3916-133-0x00000000005A0000-0x0000000000600000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exepid process 3916 eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exe 3916 eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exedescription pid process Token: SeDebugPrivilege 3916 eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exe"C:\Users\Admin\AppData\Local\Temp\eea691e393bf19f8191df02d99f08bcab4ed95ca606a67baa0ae712a39ea19cd.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3916-133-0x00000000005A0000-0x0000000000600000-memory.dmpFilesize
384KB
-
memory/3916-134-0x000000000AC30000-0x000000000B248000-memory.dmpFilesize
6.1MB
-
memory/3916-135-0x000000000A7B0000-0x000000000A8BA000-memory.dmpFilesize
1.0MB
-
memory/3916-136-0x000000000A6E0000-0x000000000A6F2000-memory.dmpFilesize
72KB
-
memory/3916-137-0x000000000A740000-0x000000000A77C000-memory.dmpFilesize
240KB
-
memory/3916-138-0x000000000AA50000-0x000000000AAB6000-memory.dmpFilesize
408KB
-
memory/3916-139-0x000000000B5F0000-0x000000000B682000-memory.dmpFilesize
584KB
-
memory/3916-140-0x000000000BC40000-0x000000000C1E4000-memory.dmpFilesize
5.6MB
-
memory/3916-141-0x000000000B740000-0x000000000B7B6000-memory.dmpFilesize
472KB
-
memory/3916-142-0x000000000B6E0000-0x000000000B730000-memory.dmpFilesize
320KB
-
memory/3916-143-0x000000000C1F0000-0x000000000C3B2000-memory.dmpFilesize
1.8MB
-
memory/3916-144-0x000000000C8F0000-0x000000000CE1C000-memory.dmpFilesize
5.2MB