Analysis
-
max time kernel
50s -
max time network
148s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
23-11-2022 06:33
Static task
static1
General
-
Target
da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe
-
Size
373KB
-
MD5
73f0454eeff132af49334030e6594d2c
-
SHA1
985457da649112cd1c383921bfef6ec2beb591c6
-
SHA256
da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752
-
SHA512
88a887a08c68c542b763d887bce5d0bae4eb0499b0db1d86a81b2d2ddab456f41d92ff6fd2951cee875a18a5fbbc82644ddf69d4ae6c32f6cd5ad5ef1fdfea97
-
SSDEEP
6144:Sxd7iGM7stZ4OeDsA7v+eascXRcHMTfHr71V6gHWKNLPfGRrrdV7dJTbDOJN:aRSvXw5TfL710gHWIPfG1rDTbDOX
Malware Config
Extracted
redline
top2
chardhesha.xyz:81
jalocliche.xyz:81
-
auth_value
706cbcaf3ac7dba064257646e57776cd
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/4800-162-0x00000000052D0000-0x00000000052FA000-memory.dmp family_redline C:\Windows\Temp\top2.exe family_redline C:\Windows\Temp\top2.exe family_redline behavioral1/memory/3680-216-0x0000000000080000-0x00000000000A8000-memory.dmp family_redline -
Executes dropped EXE 1 IoCs
Processes:
top2.exepid process 3680 top2.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
top2.exepid process 3680 top2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exetop2.exedescription pid process Token: SeDebugPrivilege 4800 da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe Token: SeDebugPrivilege 3680 top2.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exedescription pid process target process PID 4800 wrote to memory of 3680 4800 da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe top2.exe PID 4800 wrote to memory of 3680 4800 da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe top2.exe PID 4800 wrote to memory of 3680 4800 da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe top2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe"C:\Users\Admin\AppData\Local\Temp\da1cfb4d3956709d2220beb9bd9c9cfeb43450d8821045d0b88ad82edf19c752.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Temp\top2.exe"C:\Windows\Temp\top2.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\Temp\top2.exeFilesize
137KB
MD5acf056d8de0cda2acdd12e036f3eec99
SHA17333b641c92b5c6ff5f5af32c1954e3c7566877d
SHA2562027dedfec9e09c58388ab769027118602b6f7b28cda697a18280483babc2705
SHA51224fec5b1d995a7b5d7209daab96e5b112d76e6d9e176060f87f21581923966743c239e89bbb6c690f3b076f4a4a689fca380d0d3313628679139ef0f6ffac1af
-
C:\Windows\Temp\top2.exeFilesize
137KB
MD5acf056d8de0cda2acdd12e036f3eec99
SHA17333b641c92b5c6ff5f5af32c1954e3c7566877d
SHA2562027dedfec9e09c58388ab769027118602b6f7b28cda697a18280483babc2705
SHA51224fec5b1d995a7b5d7209daab96e5b112d76e6d9e176060f87f21581923966743c239e89bbb6c690f3b076f4a4a689fca380d0d3313628679139ef0f6ffac1af
-
memory/3680-237-0x0000000004E70000-0x0000000005476000-memory.dmpFilesize
6.0MB
-
memory/3680-216-0x0000000000080000-0x00000000000A8000-memory.dmpFilesize
160KB
-
memory/3680-279-0x0000000006390000-0x000000000688E000-memory.dmpFilesize
5.0MB
-
memory/3680-271-0x0000000005D20000-0x0000000005D86000-memory.dmpFilesize
408KB
-
memory/3680-244-0x0000000004AA0000-0x0000000004AEB000-memory.dmpFilesize
300KB
-
memory/3680-242-0x0000000004920000-0x000000000495E000-memory.dmpFilesize
248KB
-
memory/3680-240-0x00000000048C0000-0x00000000048D2000-memory.dmpFilesize
72KB
-
memory/3680-238-0x0000000004990000-0x0000000004A9A000-memory.dmpFilesize
1.0MB
-
memory/3680-181-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/3680-280-0x0000000005F70000-0x0000000006002000-memory.dmpFilesize
584KB
-
memory/3680-282-0x0000000006A60000-0x0000000006C22000-memory.dmpFilesize
1.8MB
-
memory/3680-178-0x0000000000000000-mapping.dmp
-
memory/3680-283-0x0000000007160000-0x000000000768C000-memory.dmpFilesize
5.2MB
-
memory/3680-183-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/3680-187-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/3680-186-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/3680-184-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/3680-180-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-140-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-169-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-142-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-143-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-144-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-145-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-146-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-147-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-148-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-149-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-150-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-151-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-152-0x0000000000AA0000-0x0000000000B04000-memory.dmpFilesize
400KB
-
memory/4800-154-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-153-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-155-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-156-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-157-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-159-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-158-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-160-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-161-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-162-0x00000000052D0000-0x00000000052FA000-memory.dmpFilesize
168KB
-
memory/4800-163-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-164-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-165-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-166-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-167-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-168-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-141-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-170-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-171-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-172-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-173-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-174-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-176-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-175-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-177-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-182-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-120-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-138-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-139-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-137-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-136-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-185-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-135-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-134-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-133-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-132-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-131-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-130-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-129-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-128-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-127-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-126-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-125-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-124-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-123-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-122-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB
-
memory/4800-121-0x0000000077530000-0x00000000776BE000-memory.dmpFilesize
1.6MB