Analysis
-
max time kernel
53s -
max time network
183s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
02-10-2022 22:17
Behavioral task
behavioral1
Sample
4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe
Resource
win10-20220901-en
General
-
Target
4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe
-
Size
90KB
-
MD5
1f578271456459d3de2ab6a79af12533
-
SHA1
f13e880e4c2ae52b36e173556cbb88199e89cd23
-
SHA256
4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b
-
SHA512
1261aac563862d627c5a182ca36ff05f67bc0f83e935104b06523332fc8074e7628e19824b87bc135e43dd77ae4af02020d56e0a237ab8e0e44a139da7d21d2d
-
SSDEEP
1536:KPqUPY5RyWjddJg3JqQbDFX+jtDNjDNUNDQDNJiugjyCaDN1JvvDNPXlJ7mVcvPb:N3ksjigjHiVWWc59G7mnboiIK
Malware Config
Extracted
redline
80.66.87.22:80
-
auth_value
5b663effac3b92fe687f0181631eeff2
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exepid process 2748 4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe 2748 4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exedescription pid process Token: SeDebugPrivilege 2748 4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe"C:\Users\Admin\AppData\Local\Temp\4fe6f1177349a62e07c8622e08c9fd6981cb84b397c4491b80a68985daa04d9b.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2748-120-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-121-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-122-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-124-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-123-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-125-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-126-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-127-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-128-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-129-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-130-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-131-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-132-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-133-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-134-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-135-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-136-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-137-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-138-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-139-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-140-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-141-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-142-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-143-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-144-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-145-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-146-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-147-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-148-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-149-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-150-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-151-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-152-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-153-0x00000000004D0000-0x00000000004EC000-memory.dmpFilesize
112KB
-
memory/2748-154-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-155-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-156-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-157-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-158-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-159-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-160-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-161-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-162-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-163-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-164-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-165-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-166-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-167-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-168-0x0000000005230000-0x0000000005836000-memory.dmpFilesize
6.0MB
-
memory/2748-169-0x0000000004CD0000-0x0000000004CE2000-memory.dmpFilesize
72KB
-
memory/2748-170-0x0000000004E00000-0x0000000004F0A000-memory.dmpFilesize
1.0MB
-
memory/2748-171-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-172-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-173-0x0000000004D30000-0x0000000004D6E000-memory.dmpFilesize
248KB
-
memory/2748-174-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-175-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-176-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-177-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-178-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-179-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-180-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-181-0x0000000004D70000-0x0000000004DBB000-memory.dmpFilesize
300KB
-
memory/2748-182-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-183-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-184-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-185-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-186-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-187-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-188-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-189-0x0000000077660000-0x00000000777EE000-memory.dmpFilesize
1.6MB
-
memory/2748-208-0x00000000065F0000-0x0000000006AEE000-memory.dmpFilesize
5.0MB
-
memory/2748-209-0x00000000061D0000-0x0000000006262000-memory.dmpFilesize
584KB
-
memory/2748-211-0x0000000006270000-0x00000000062D6000-memory.dmpFilesize
408KB
-
memory/2748-219-0x0000000006430000-0x0000000006480000-memory.dmpFilesize
320KB
-
memory/2748-220-0x0000000006500000-0x0000000006576000-memory.dmpFilesize
472KB
-
memory/2748-224-0x00000000065A0000-0x00000000065BE000-memory.dmpFilesize
120KB
-
memory/2748-225-0x0000000006DF0000-0x0000000006FB2000-memory.dmpFilesize
1.8MB
-
memory/2748-226-0x0000000007E10000-0x000000000833C000-memory.dmpFilesize
5.2MB