Analysis
-
max time kernel
55s -
max time network
59s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:47
General
-
Target
1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exe
-
Size
361KB
-
MD5
8ee9dceef3f645def0453a3e5d8f609a
-
SHA1
bd8128df223aa9c9c91a91a2416c104fe28d7cf5
-
SHA256
1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92
-
SHA512
7af42c97addab7755670ecb08ef26d43e608b6811db3d9625101b72bdace8e18e5b9c606e751c21c0997cf3b912146cae74ef34854cebb065d41ba5f4ccad7be
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2580-153-0x00000000006B0000-0x0000000000710000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exepid process 2580 1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exe 2580 1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exedescription pid process Token: SeDebugPrivilege 2580 1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exe"C:\Users\Admin\AppData\Local\Temp\1cee9e22c3077d9d090d6d6edfb623d41368561197d08314386f83f06c086c92.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2580-120-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-121-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-123-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-122-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-124-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-125-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-126-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-127-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-128-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-129-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-130-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-131-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-132-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-133-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-134-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-135-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-136-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-137-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-138-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-139-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-140-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-141-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-142-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-143-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-144-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-145-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-146-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-147-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-149-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-148-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-150-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-151-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-152-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-154-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-155-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-153-0x00000000006B0000-0x0000000000710000-memory.dmpFilesize
384KB
-
memory/2580-156-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-157-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-159-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-160-0x0000000002900000-0x0000000002906000-memory.dmpFilesize
24KB
-
memory/2580-158-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-161-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-162-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-163-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-164-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-165-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-166-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-167-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-168-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-169-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-170-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-171-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-172-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-174-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-175-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-176-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-178-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-177-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-173-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-179-0x0000000005740000-0x0000000005D46000-memory.dmpFilesize
6.0MB
-
memory/2580-180-0x0000000005240000-0x000000000534A000-memory.dmpFilesize
1.0MB
-
memory/2580-181-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-182-0x0000000005060000-0x0000000005072000-memory.dmpFilesize
72KB
-
memory/2580-183-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-184-0x00000000050C0000-0x00000000050FE000-memory.dmpFilesize
248KB
-
memory/2580-185-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-186-0x0000000005130000-0x000000000517B000-memory.dmpFilesize
300KB
-
memory/2580-187-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-188-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-189-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-190-0x0000000005510000-0x00000000055A2000-memory.dmpFilesize
584KB
-
memory/2580-191-0x0000000006760000-0x0000000006C5E000-memory.dmpFilesize
5.0MB
-
memory/2580-192-0x0000000077710000-0x000000007789E000-memory.dmpFilesize
1.6MB
-
memory/2580-194-0x0000000005620000-0x0000000005686000-memory.dmpFilesize
408KB
-
memory/2580-202-0x0000000006360000-0x00000000063D6000-memory.dmpFilesize
472KB
-
memory/2580-203-0x00000000060A0000-0x00000000060F0000-memory.dmpFilesize
320KB
-
memory/2580-204-0x0000000006C60000-0x0000000006E22000-memory.dmpFilesize
1.8MB
-
memory/2580-205-0x00000000089E0000-0x0000000008F0C000-memory.dmpFilesize
5.2MB