Analysis
-
max time kernel
52s -
max time network
58s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:49
General
-
Target
e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exe
-
Size
361KB
-
MD5
19bd33402424627f19cf88423a5fde6c
-
SHA1
975fee0f33631b5f487af8cd46d9c9cdcab1d2c7
-
SHA256
e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8
-
SHA512
c37eb94a3ffa3a249d97d2fabe78ea36d61395bc8067c40b487026d63071ffcd6545604b59cad18f6d63a3f61c50db8528c7406f49e15a7d00e58d469e50742d
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2652-153-0x0000000000F90000-0x0000000000FF0000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exepid process 2652 e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exe 2652 e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exedescription pid process Token: SeDebugPrivilege 2652 e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exe"C:\Users\Admin\AppData\Local\Temp\e92aa200500f054d3a71a8364fa0b7173367af297c91391eb41f34ee134779e8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2652-120-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-121-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-122-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-123-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-124-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-125-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-126-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-127-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-128-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-129-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-130-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-132-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-131-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-133-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-134-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-135-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-136-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-137-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-139-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-138-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-140-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-141-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-142-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-143-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-144-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-145-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-146-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-147-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-148-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-149-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-150-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-151-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-152-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-153-0x0000000000F90000-0x0000000000FF0000-memory.dmpFilesize
384KB
-
memory/2652-154-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-155-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-156-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-157-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-158-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-159-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-160-0x0000000003130000-0x0000000003136000-memory.dmpFilesize
24KB
-
memory/2652-161-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-162-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-163-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-164-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-165-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-166-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-167-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-168-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-169-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-170-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-171-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-172-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-173-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-174-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-175-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-176-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-177-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-178-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-179-0x000000000B4C0000-0x000000000BAC6000-memory.dmpFilesize
6.0MB
-
memory/2652-180-0x000000000B030000-0x000000000B13A000-memory.dmpFilesize
1.0MB
-
memory/2652-181-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-182-0x000000000AF60000-0x000000000AF72000-memory.dmpFilesize
72KB
-
memory/2652-183-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-184-0x000000000AFC0000-0x000000000AFFE000-memory.dmpFilesize
248KB
-
memory/2652-185-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-186-0x000000000B140000-0x000000000B18B000-memory.dmpFilesize
300KB
-
memory/2652-187-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-188-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-189-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-190-0x0000000077BA0000-0x0000000077D2E000-memory.dmpFilesize
1.6MB
-
memory/2652-191-0x000000000B2E0000-0x000000000B346000-memory.dmpFilesize
408KB
-
memory/2652-199-0x000000000C2D0000-0x000000000C7CE000-memory.dmpFilesize
5.0MB
-
memory/2652-200-0x000000000BEB0000-0x000000000BF42000-memory.dmpFilesize
584KB
-
memory/2652-202-0x000000000C7D0000-0x000000000C992000-memory.dmpFilesize
1.8MB
-
memory/2652-203-0x000000000CED0000-0x000000000D3FC000-memory.dmpFilesize
5.2MB
-
memory/2652-207-0x000000000C1F0000-0x000000000C266000-memory.dmpFilesize
472KB
-
memory/2652-208-0x000000000C030000-0x000000000C080000-memory.dmpFilesize
320KB