Analysis
-
max time kernel
41s -
max time network
62s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
25-09-2022 05:53
General
-
Target
ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exe
-
Size
361KB
-
MD5
b66ffacc665b33fe113d77152067acd5
-
SHA1
6fb7030fc716b9470c480119e8bd5dd4538c58bc
-
SHA256
ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8
-
SHA512
aadb9305153fbc8c797ebfcffe42b50d2742737a9cc1dfd0339ddff33df7734482d79f21d78bd978e8aec6b0362980707a524ae6fc621d6187e01430162c60d6
-
SSDEEP
6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv
Malware Config
Extracted
redline
0002
13.72.81.58:13413
-
auth_value
866ce0ed8cfe2be77fb43a4912677698
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral1/memory/2972-151-0x0000000000790000-0x00000000007F0000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exepid process 2972 ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exe 2972 ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exedescription pid process Token: SeDebugPrivilege 2972 ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exe"C:\Users\Admin\AppData\Local\Temp\ed1471b1e0e34d3d5ee2e4064fc57b051032dd888c24f6e7e1792e6811e137d8.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2972-118-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-119-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-120-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-121-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-122-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-123-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-124-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-125-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-126-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-127-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-128-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-130-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-131-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-129-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-132-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-133-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-134-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-136-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-137-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-135-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-138-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-139-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-140-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-141-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-142-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-143-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-144-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-145-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-146-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-147-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-148-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-149-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-150-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-151-0x0000000000790000-0x00000000007F0000-memory.dmpFilesize
384KB
-
memory/2972-152-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-153-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-154-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-155-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-156-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-157-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-158-0x0000000002B10000-0x0000000002B16000-memory.dmpFilesize
24KB
-
memory/2972-159-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-160-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-161-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-162-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-163-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-164-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-165-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-166-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-167-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-168-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-169-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-170-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-171-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-172-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-173-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-174-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-175-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-176-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-177-0x00000000057A0000-0x0000000005DA6000-memory.dmpFilesize
6.0MB
-
memory/2972-178-0x00000000052A0000-0x00000000053AA000-memory.dmpFilesize
1.0MB
-
memory/2972-179-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-180-0x0000000005130000-0x0000000005142000-memory.dmpFilesize
72KB
-
memory/2972-181-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-182-0x00000000051D0000-0x000000000520E000-memory.dmpFilesize
248KB
-
memory/2972-183-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-184-0x0000000005210000-0x000000000525B000-memory.dmpFilesize
300KB
-
memory/2972-185-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-186-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-187-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-188-0x00000000067C0000-0x0000000006CBE000-memory.dmpFilesize
5.0MB
-
memory/2972-189-0x0000000077220000-0x00000000773AE000-memory.dmpFilesize
1.6MB
-
memory/2972-190-0x00000000055D0000-0x0000000005636000-memory.dmpFilesize
408KB
-
memory/2972-198-0x00000000060C0000-0x0000000006152000-memory.dmpFilesize
584KB
-
memory/2972-200-0x0000000006590000-0x0000000006752000-memory.dmpFilesize
1.8MB
-
memory/2972-201-0x0000000008510000-0x0000000008A3C000-memory.dmpFilesize
5.2MB
-
memory/2972-205-0x00000000064F0000-0x0000000006566000-memory.dmpFilesize
472KB
-
memory/2972-206-0x0000000006760000-0x00000000067B0000-memory.dmpFilesize
320KB