Analysis
-
max time kernel
52s -
max time network
73s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:38
General
-
Target
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe
-
Size
361KB
-
MD5
ba3d4d18dfc614e8a88d5f0d33c4cb97
-
SHA1
131fd718c4a59ca415db7bdd613f70972e3f3611
-
SHA256
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b
-
SHA512
1d45a6a777cface5fb95f57df4620b0a0ebf515047ca4d70ca94a3300b5de7903c66a5fcd22110b77085967f0d059f5ebce751136ae680e73287ed3422922247
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2576-148-0x0000000000450000-0x00000000004B0000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exepid process 2576 964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe 2576 964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exedescription pid process Token: SeDebugPrivilege 2576 964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe"C:\Users\Admin\AppData\Local\Temp\964d1ec82085349a5d1a6a5c8c53b3f11bd14ccc3da60f42e8f9339645e76a9b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2576-115-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-116-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-117-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-118-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-119-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-120-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-121-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-122-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-123-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-124-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-125-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-126-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-127-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-128-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-129-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-130-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-131-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-132-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-133-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-134-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-135-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-136-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-137-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-138-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-139-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-140-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-141-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-142-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-143-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-144-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-145-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-146-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-147-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-148-0x0000000000450000-0x00000000004B0000-memory.dmpFilesize
384KB
-
memory/2576-149-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-150-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-151-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-152-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-153-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-154-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-155-0x0000000000E40000-0x0000000000E46000-memory.dmpFilesize
24KB
-
memory/2576-156-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-157-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-159-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-158-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-160-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-161-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-162-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-163-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-164-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-165-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-166-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-167-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-168-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-169-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-170-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-171-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-172-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-173-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-174-0x000000000A980000-0x000000000AF86000-memory.dmpFilesize
6.0MB
-
memory/2576-175-0x000000000A4F0000-0x000000000A5FA000-memory.dmpFilesize
1.0MB
-
memory/2576-176-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-177-0x000000000A420000-0x000000000A432000-memory.dmpFilesize
72KB
-
memory/2576-178-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-179-0x000000000A480000-0x000000000A4BE000-memory.dmpFilesize
248KB
-
memory/2576-180-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-181-0x000000000A600000-0x000000000A64B000-memory.dmpFilesize
300KB
-
memory/2576-182-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-183-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-184-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-185-0x00000000775B0000-0x000000007773E000-memory.dmpFilesize
1.6MB
-
memory/2576-186-0x000000000A8A0000-0x000000000A906000-memory.dmpFilesize
408KB
-
memory/2576-194-0x000000000B330000-0x000000000B3C2000-memory.dmpFilesize
584KB
-
memory/2576-195-0x000000000B8D0000-0x000000000BDCE000-memory.dmpFilesize
5.0MB
-
memory/2576-197-0x000000000B450000-0x000000000B4C6000-memory.dmpFilesize
472KB
-
memory/2576-198-0x000000000B4F0000-0x000000000B540000-memory.dmpFilesize
320KB
-
memory/2576-199-0x000000000BDD0000-0x000000000BF92000-memory.dmpFilesize
1.8MB
-
memory/2576-200-0x000000000C4D0000-0x000000000C9FC000-memory.dmpFilesize
5.2MB