Analysis
-
max time kernel
49s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
05-11-2022 04:00
Static task
static1
Behavioral task
behavioral1
Sample
efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe
Resource
win7-20220812-en
General
-
Target
efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe
-
Size
311KB
-
MD5
80eba6fba683560bb8a1296911c9a530
-
SHA1
d9c3fcf909681db6f83a23e46999a5bc4f23d1b3
-
SHA256
efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de
-
SHA512
be12f3cdacefa9c215a73effe0f51b9d9a897a8d44120266fff25d99a79f7f06f96f429ecb5f3bdef2754fb5eee240a7ce6e3c14a08e9f761826e195a2f3a1ae
-
SSDEEP
6144:xh5ZRBLEQJFM15cBR69scAmM/y7szDUnbmaLOnK:TpBl8158cLc6SVnK
Malware Config
Extracted
redline
1
164.90.146.32:41698
-
auth_value
9b64659ae8aca5a45aee2af90a3cdeac
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/1112-163-0x0000000004BD0000-0x0000000004C0E000-memory.dmp family_redline behavioral2/memory/1112-170-0x0000000005150000-0x000000000518C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exepid process 1112 efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe 1112 efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exedescription pid process Token: SeDebugPrivilege 1112 efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe"C:\Users\Admin\AppData\Local\Temp\efce2f63f699ace5119a260bf75471f818d81e948a903ed4ac4657a16b89f9de.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1112-120-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-121-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-122-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-123-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-124-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-125-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-126-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-127-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-128-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-129-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-130-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-131-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-132-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-133-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-134-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-135-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-136-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-137-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-139-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-138-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-140-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-141-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-142-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-143-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-144-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-145-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-146-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-147-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-148-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-149-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-150-0x000000000090A000-0x000000000093B000-memory.dmpFilesize
196KB
-
memory/1112-151-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/1112-152-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-153-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB
-
memory/1112-154-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-155-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-156-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-157-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-158-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-159-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-160-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-161-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-162-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-163-0x0000000004BD0000-0x0000000004C0E000-memory.dmpFilesize
248KB
-
memory/1112-164-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-165-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-166-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-167-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-168-0x0000000004C10000-0x000000000510E000-memory.dmpFilesize
5.0MB
-
memory/1112-169-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-170-0x0000000005150000-0x000000000518C000-memory.dmpFilesize
240KB
-
memory/1112-171-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-172-0x00000000051A0000-0x0000000005232000-memory.dmpFilesize
584KB
-
memory/1112-173-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-174-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-175-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-176-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-177-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-178-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-179-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-180-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-181-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-182-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-183-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-184-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-185-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-186-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-187-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-188-0x0000000005510000-0x0000000005B16000-memory.dmpFilesize
6.0MB
-
memory/1112-189-0x0000000005320000-0x000000000542A000-memory.dmpFilesize
1.0MB
-
memory/1112-190-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-191-0x0000000005460000-0x0000000005472000-memory.dmpFilesize
72KB
-
memory/1112-192-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-193-0x0000000005480000-0x00000000054BE000-memory.dmpFilesize
248KB
-
memory/1112-194-0x0000000076FB0000-0x000000007713E000-memory.dmpFilesize
1.6MB
-
memory/1112-195-0x0000000005C20000-0x0000000005C6B000-memory.dmpFilesize
300KB
-
memory/1112-199-0x000000000090A000-0x000000000093B000-memory.dmpFilesize
196KB
-
memory/1112-200-0x00000000005B0000-0x00000000006FA000-memory.dmpFilesize
1.3MB
-
memory/1112-202-0x0000000005D80000-0x0000000005DE6000-memory.dmpFilesize
408KB
-
memory/1112-210-0x0000000006520000-0x00000000066E2000-memory.dmpFilesize
1.8MB
-
memory/1112-211-0x00000000066F0000-0x0000000006C1C000-memory.dmpFilesize
5.2MB
-
memory/1112-214-0x0000000007F70000-0x0000000007FE6000-memory.dmpFilesize
472KB
-
memory/1112-215-0x0000000008000000-0x0000000008050000-memory.dmpFilesize
320KB
-
memory/1112-223-0x000000000090A000-0x000000000093B000-memory.dmpFilesize
196KB
-
memory/1112-224-0x0000000000400000-0x00000000005A9000-memory.dmpFilesize
1.7MB