Analysis

  • max time kernel
    76s
  • max time network
    124s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-09-2022 17:43

General

  • Target

    b31c5ee753a675034b04d3099ef9b1edc06da7f7ec09ed0bd1a7deefc3f22de8.exe

  • Size

    362KB

  • MD5

    a3af49f20726ea5913b2fc249dd51d46

  • SHA1

    4635d15fb77826907121ddf6daf8a883b72e63ed

  • SHA256

    b31c5ee753a675034b04d3099ef9b1edc06da7f7ec09ed0bd1a7deefc3f22de8

  • SHA512

    7518f4e241a32ddb3854157a204bb96cc0a3f9508b9d6668078835c12b90eb1ad05af64f7bf4ff34da3ed033995e4c0656481f628a6f18d90a6878ceb6ade244

  • SSDEEP

    6144:eEaXBUcN2BRrn1fH0N6GkBut5adsSEK69yDPhSjYlakxjTLVqoARRSTZAPdg+:/aRDNoVJKRtUdsSEK69yDPhSjYlakxjv

Malware Config

Extracted

Family

redline

Botnet

0002

C2

13.72.81.58:13413

Attributes
  • auth_value

    866ce0ed8cfe2be77fb43a4912677698

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b31c5ee753a675034b04d3099ef9b1edc06da7f7ec09ed0bd1a7deefc3f22de8.exe
    "C:\Users\Admin\AppData\Local\Temp\b31c5ee753a675034b04d3099ef9b1edc06da7f7ec09ed0bd1a7deefc3f22de8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:384

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/384-132-0x0000000000570000-0x00000000005D0000-memory.dmp

    Filesize

    384KB

  • memory/384-133-0x00000000055E0000-0x0000000005BF8000-memory.dmp

    Filesize

    6.1MB

  • memory/384-134-0x0000000005150000-0x000000000525A000-memory.dmp

    Filesize

    1.0MB

  • memory/384-135-0x0000000005080000-0x0000000005092000-memory.dmp

    Filesize

    72KB

  • memory/384-136-0x00000000050E0000-0x000000000511C000-memory.dmp

    Filesize

    240KB

  • memory/384-137-0x00000000053F0000-0x0000000005456000-memory.dmp

    Filesize

    408KB

  • memory/384-138-0x00000000060F0000-0x0000000006182000-memory.dmp

    Filesize

    584KB

  • memory/384-139-0x0000000006740000-0x0000000006CE4000-memory.dmp

    Filesize

    5.6MB

  • memory/384-140-0x0000000006210000-0x0000000006286000-memory.dmp

    Filesize

    472KB

  • memory/384-141-0x0000000006290000-0x00000000062E0000-memory.dmp

    Filesize

    320KB

  • memory/384-142-0x00000000064B0000-0x0000000006672000-memory.dmp

    Filesize

    1.8MB

  • memory/384-143-0x0000000008880000-0x0000000008DAC000-memory.dmp

    Filesize

    5.2MB