Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
11-11-2022 05:31
Static task
static1
General
-
Target
8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe
-
Size
543KB
-
MD5
a9f9190f0b9cdb660dbac86a547c9855
-
SHA1
1823c364af98da9f2e2809e60c7e087b1908ce58
-
SHA256
8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7
-
SHA512
b0bba6dd0e88aa52e4c488d519939f07546fdf07a1fb4df7190aa426edf0c7dc58ad399dde97d06bf7ed72fd6da561d1d35cd88b42fed908ba052aec7837843a
-
SSDEEP
12288:fmBU3VZYBJqPltfU5oApQx9KkcbFoWygfEi40sJnR1V87:z3VZYiCSx91c5Vy2yN9R
Malware Config
Extracted
redline
neruzki
193.106.191.22:47242
-
auth_value
be14ae67c6dd227f622680a27ea42452
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exedescription pid process target process PID 3876 set thread context of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exepid process 3976 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 3976 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exedescription pid process Token: SeDebugPrivilege 3976 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exedescription pid process target process PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe PID 3876 wrote to memory of 3976 3876 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe 8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe"C:\Users\Admin\AppData\Local\Temp\8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exeC:\Users\Admin\AppData\Local\Temp\8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\8b695ab5bc7a0211cf2a2fc98445ce164ab30f637fad547fc3f130bd9f510da7.exe.logFilesize
789B
MD5db5ef8d7c51bad129d9097bf953e4913
SHA18439db960aa2d431bf5ec3c37af775b45eb07e06
SHA2561248e67f10b47b397af3c8cbe342bad4be75c68b8e10f4ec6341195cc3138bd9
SHA51204572485790b25e1751347e43b47174051cd153dd75fd55ee5590d25a2579f344cd96cf86cf45bdb7759e3e6d0f734d0ff717148ca70f501b9869e964e036fee
-
memory/3876-115-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-116-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-117-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-118-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-119-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-120-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-121-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-122-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-123-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-124-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-125-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-126-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-127-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-128-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-129-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-130-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-131-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-132-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-133-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-134-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-135-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-136-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-137-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-138-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-139-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-140-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-141-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-142-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-143-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-144-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-145-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-146-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-147-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-148-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-149-0x0000000000C20000-0x0000000000CAE000-memory.dmpFilesize
568KB
-
memory/3876-150-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-151-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-152-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-153-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-154-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-155-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-156-0x0000000007B00000-0x0000000007C4A000-memory.dmpFilesize
1.3MB
-
memory/3876-157-0x0000000008150000-0x000000000864E000-memory.dmpFilesize
5.0MB
-
memory/3876-158-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-159-0x0000000007C50000-0x0000000007CE2000-memory.dmpFilesize
584KB
-
memory/3876-160-0x0000000002F50000-0x0000000002F56000-memory.dmpFilesize
24KB
-
memory/3876-161-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-162-0x0000000007EF0000-0x0000000007F66000-memory.dmpFilesize
472KB
-
memory/3876-163-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-164-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-165-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-166-0x0000000002FA0000-0x0000000002FBE000-memory.dmpFilesize
120KB
-
memory/3876-167-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-168-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-169-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-170-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-171-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-172-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3876-179-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-173-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/3976-174-0x0000000000416CA2-mapping.dmp
-
memory/3976-176-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-175-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-177-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-178-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-180-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-181-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-182-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-183-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-184-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-186-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-185-0x0000000076EC0000-0x000000007704E000-memory.dmpFilesize
1.6MB
-
memory/3976-210-0x0000000005720000-0x0000000005D26000-memory.dmpFilesize
6.0MB
-
memory/3976-212-0x0000000005140000-0x0000000005152000-memory.dmpFilesize
72KB
-
memory/3976-216-0x0000000005270000-0x000000000537A000-memory.dmpFilesize
1.0MB
-
memory/3976-219-0x00000000051A0000-0x00000000051DE000-memory.dmpFilesize
248KB
-
memory/3976-228-0x00000000051E0000-0x000000000522B000-memory.dmpFilesize
300KB
-
memory/3976-234-0x0000000005620000-0x0000000005686000-memory.dmpFilesize
408KB
-
memory/3976-242-0x0000000006730000-0x00000000068F2000-memory.dmpFilesize
1.8MB
-
memory/3976-243-0x0000000006E30000-0x000000000735C000-memory.dmpFilesize
5.2MB