Analysis
-
max time kernel
50s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
12-11-2022 22:32
Behavioral task
behavioral1
Sample
a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe
Resource
win7-20220812-en
General
-
Target
a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe
-
Size
137KB
-
MD5
e63d74cec6926b2d04e474b889d08af4
-
SHA1
a64a888ccfb4e82ade71f1a00a7ae681d29c7bcb
-
SHA256
a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33
-
SHA512
fd59c0a1c613611002e52a309ee4baad626df8fbbd8c0c230bcb8e6fed4a3059296ab11b88a1d25a0f54c65f730a027f876629298120f7b4c251bf6d2aaed148
-
SSDEEP
3072:dYO/ZMTFVx+2I3rG1fVLZncHzWF7cRPehvSSYn:dYMZMBVxFISn+zjpeh
Malware Config
Extracted
redline
boy
77.73.134.241:4691
-
auth_value
a91fa8cc2cfaefc42a23c03faef44bd3
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral2/memory/1680-153-0x0000000000900000-0x0000000000928000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exepid process 1680 a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe 1680 a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exedescription pid process Token: SeDebugPrivilege 1680 a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe"C:\Users\Admin\AppData\Local\Temp\a9ffffff38aca59d7d2f041fbdb253ca612c7ba2d597782b2e6a59a914f49b33.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1680-120-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-121-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-122-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-123-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-124-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-125-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-126-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-127-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-128-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-129-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-130-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-132-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-133-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-131-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-134-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-135-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-136-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-137-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-138-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-139-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-140-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-141-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-142-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-143-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-144-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-145-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-146-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-147-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-148-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-149-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-150-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-151-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-152-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-153-0x0000000000900000-0x0000000000928000-memory.dmpFilesize
160KB
-
memory/1680-154-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-155-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-156-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-157-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-158-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-159-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-160-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-161-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-162-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-163-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-164-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-165-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-166-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-167-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-168-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-169-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-170-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-171-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-172-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-173-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-174-0x00000000056F0000-0x0000000005CF6000-memory.dmpFilesize
6.0MB
-
memory/1680-175-0x0000000005210000-0x000000000531A000-memory.dmpFilesize
1.0MB
-
memory/1680-176-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-177-0x0000000005150000-0x0000000005162000-memory.dmpFilesize
72KB
-
memory/1680-178-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-179-0x00000000051B0000-0x00000000051EE000-memory.dmpFilesize
248KB
-
memory/1680-180-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-181-0x0000000005320000-0x000000000536B000-memory.dmpFilesize
300KB
-
memory/1680-182-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-183-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-184-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-185-0x00000000054F0000-0x0000000005582000-memory.dmpFilesize
584KB
-
memory/1680-186-0x0000000006200000-0x00000000066FE000-memory.dmpFilesize
5.0MB
-
memory/1680-187-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-188-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-189-0x0000000005590000-0x00000000055F6000-memory.dmpFilesize
408KB
-
memory/1680-190-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-191-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-192-0x0000000077390000-0x000000007751E000-memory.dmpFilesize
1.6MB
-
memory/1680-197-0x0000000006900000-0x0000000006976000-memory.dmpFilesize
472KB
-
memory/1680-198-0x0000000006980000-0x00000000069D0000-memory.dmpFilesize
320KB
-
memory/1680-199-0x0000000006BA0000-0x0000000006D62000-memory.dmpFilesize
1.8MB
-
memory/1680-200-0x00000000072A0000-0x00000000077CC000-memory.dmpFilesize
5.2MB