Analysis
-
max time kernel
78s -
max time network
93s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
23-11-2022 10:38
Static task
static1
Behavioral task
behavioral1
Sample
0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe
Resource
win10-20220812-en
General
-
Target
0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe
-
Size
412KB
-
MD5
ab5e612769f8b7b6e03871af002d09df
-
SHA1
7b4aba3079b6fa4d6f04a018615f7c70a3ef7ff2
-
SHA256
0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848
-
SHA512
7fbf22032f92e4508eaba3e74d8e9cbaa03c623e71a88b687bb26a023c177e02ccc70e7c60d3aa0e1416cb368910dc49c7ac0e98f7b510e933958eeab4d2c80d
-
SSDEEP
6144:GBrqpaL2WoEQW6uJcVVaLI37OBtbdW9xjrX4lO6fE6Nn:waaL2WoSpJkaLIylUtrDJ6N
Malware Config
Extracted
redline
NanoID2022
185.106.92.111:2510
-
auth_value
d5913c276c6c8b5735246051bef9a412
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3516-158-0x0000000002350000-0x000000000238E000-memory.dmp family_redline behavioral1/memory/3516-165-0x00000000024F0000-0x000000000252C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exepid process 3516 0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe 3516 0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exedescription pid process Token: SeDebugPrivilege 3516 0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe"C:\Users\Admin\AppData\Local\Temp\0241045ab5912d9b68c02df8f703c7dd8cc62b7f4013b76d06d3c1faf9d03848.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3516-116-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-117-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-118-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-119-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-120-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-121-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-122-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-123-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-124-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-125-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-126-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-127-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-128-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-129-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-130-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-131-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-132-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-133-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-134-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-135-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-136-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-137-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-138-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-139-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-141-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-140-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-142-0x000000000073B000-0x000000000076C000-memory.dmpFilesize
196KB
-
memory/3516-143-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3516-144-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/3516-145-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-146-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-147-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-148-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-149-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-151-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-150-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-152-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-153-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-154-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-155-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-156-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-157-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-158-0x0000000002350000-0x000000000238E000-memory.dmpFilesize
248KB
-
memory/3516-159-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-160-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-161-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-162-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-163-0x0000000004CE0000-0x00000000051DE000-memory.dmpFilesize
5.0MB
-
memory/3516-164-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-165-0x00000000024F0000-0x000000000252C000-memory.dmpFilesize
240KB
-
memory/3516-166-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-167-0x0000000004B80000-0x0000000004C12000-memory.dmpFilesize
584KB
-
memory/3516-168-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-169-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-170-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-171-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-172-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-173-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-174-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-175-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-176-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-177-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-178-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-179-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-180-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-181-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-182-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-183-0x00000000053D0000-0x00000000059D6000-memory.dmpFilesize
6.0MB
-
memory/3516-184-0x00000000051E0000-0x00000000052EA000-memory.dmpFilesize
1.0MB
-
memory/3516-185-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-186-0x0000000005320000-0x0000000005332000-memory.dmpFilesize
72KB
-
memory/3516-187-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-188-0x0000000005340000-0x000000000537E000-memory.dmpFilesize
248KB
-
memory/3516-189-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-190-0x0000000005AE0000-0x0000000005B2B000-memory.dmpFilesize
300KB
-
memory/3516-191-0x0000000077C90000-0x0000000077E1E000-memory.dmpFilesize
1.6MB
-
memory/3516-194-0x000000000073B000-0x000000000076C000-memory.dmpFilesize
196KB
-
memory/3516-195-0x0000000000470000-0x00000000005BA000-memory.dmpFilesize
1.3MB
-
memory/3516-196-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB
-
memory/3516-199-0x0000000000640000-0x00000000006A6000-memory.dmpFilesize
408KB
-
memory/3516-207-0x00000000062D0000-0x0000000006492000-memory.dmpFilesize
1.8MB
-
memory/3516-208-0x00000000064A0000-0x00000000069CC000-memory.dmpFilesize
5.2MB
-
memory/3516-218-0x000000000073B000-0x000000000076C000-memory.dmpFilesize
196KB
-
memory/3516-219-0x0000000000400000-0x000000000046C000-memory.dmpFilesize
432KB