Analysis
-
max time kernel
51s -
max time network
54s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 06:25
General
-
Target
c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exe
-
Size
361KB
-
MD5
9e680cebc7058e3121b03a2121f6943b
-
SHA1
84139f3826155687a3ada6df40dc4fbb0952d6f1
-
SHA256
c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f
-
SHA512
f05c8f2258174732e9bd9205be49f0f1119e8e7b731d48000e0766163ac3037ad276070a921824a98db0111b4fea786824fa2283282f43f9d1abce68433f585e
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2672-153-0x0000000000E00000-0x0000000000E60000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exepid process 2672 c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exe 2672 c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exedescription pid process Token: SeDebugPrivilege 2672 c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exe"C:\Users\Admin\AppData\Local\Temp\c82762660861158a9b98352d92d8c212d2e44343d0e7c3bc723cf4ac4a6b7e2f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2672-120-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-121-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-122-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-123-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-124-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-125-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-126-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-127-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-128-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-129-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-130-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-131-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-132-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-133-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-134-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-135-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-136-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-137-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-138-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-139-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-140-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-141-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-142-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-143-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-145-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-144-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-146-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-147-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-148-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-149-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-150-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-151-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-152-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-153-0x0000000000E00000-0x0000000000E60000-memory.dmpFilesize
384KB
-
memory/2672-154-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-155-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-156-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-157-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-158-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-159-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-160-0x00000000017B0000-0x00000000017B6000-memory.dmpFilesize
24KB
-
memory/2672-161-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-162-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-163-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-164-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-165-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-166-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-167-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-168-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-169-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-170-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-171-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-172-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-173-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-174-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-176-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-175-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-177-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-178-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-179-0x0000000005E00000-0x0000000006406000-memory.dmpFilesize
6.0MB
-
memory/2672-180-0x0000000005900000-0x0000000005A0A000-memory.dmpFilesize
1.0MB
-
memory/2672-181-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-182-0x00000000056A0000-0x00000000056B2000-memory.dmpFilesize
72KB
-
memory/2672-183-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-184-0x0000000005830000-0x000000000586E000-memory.dmpFilesize
248KB
-
memory/2672-185-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-186-0x0000000005870000-0x00000000058BB000-memory.dmpFilesize
300KB
-
memory/2672-187-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-188-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-189-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-190-0x0000000005B60000-0x0000000005BF2000-memory.dmpFilesize
584KB
-
memory/2672-191-0x0000000006E20000-0x000000000731E000-memory.dmpFilesize
5.0MB
-
memory/2672-192-0x0000000077560000-0x00000000776EE000-memory.dmpFilesize
1.6MB
-
memory/2672-194-0x0000000005C00000-0x0000000005C66000-memory.dmpFilesize
408KB
-
memory/2672-202-0x0000000006920000-0x0000000006996000-memory.dmpFilesize
472KB
-
memory/2672-203-0x00000000069A0000-0x00000000069F0000-memory.dmpFilesize
320KB
-
memory/2672-204-0x0000000007320000-0x00000000074E2000-memory.dmpFilesize
1.8MB
-
memory/2672-205-0x00000000090A0000-0x00000000095CC000-memory.dmpFilesize
5.2MB