Analysis
-
max time kernel
46s -
max time network
55s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
28-11-2022 19:14
Static task
static1
Behavioral task
behavioral1
Sample
60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe
Resource
win10-20220901-en
General
-
Target
60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe
-
Size
385KB
-
MD5
ec6dddac0acdd89e00127c8273842054
-
SHA1
de4e8c38b79f1c17fa15e4d08e1b5377629f4d7a
-
SHA256
60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c
-
SHA512
85ef01ff1a295c6bed21fc2aa8290fb1d3a6fb0a8ebee3ab2f8fe1f5bebb62799b3b12db8fa061701b4772b3e02bca7d726a6f8bbd90cd7b060c738f2fa0d867
-
SSDEEP
6144:PvFOkNl2WlcZXRK4BcblFW5caYfxUjoBUp/ykXPd4oVFvg4/FQF:1rNl8FLavpXkXPKoDgSm
Malware Config
Extracted
redline
NewDef2023
185.106.92.214:2510
-
auth_value
048f34b18865578890538db10b2e9edf
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/4888-160-0x0000000002550000-0x000000000258E000-memory.dmp family_redline behavioral1/memory/4888-167-0x0000000002710000-0x000000000274C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exepid process 4888 60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe 4888 60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exedescription pid process Token: SeDebugPrivilege 4888 60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe"C:\Users\Admin\AppData\Local\Temp\60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4888-117-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-118-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-119-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-120-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-121-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-122-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-123-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-124-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-125-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-126-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-127-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-128-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-129-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-130-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-131-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-132-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-134-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-133-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-135-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-136-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-137-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-138-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-139-0x00000000006BA000-0x00000000006EB000-memory.dmpFilesize
196KB
-
memory/4888-140-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-141-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-142-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-143-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-144-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-145-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-146-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/4888-147-0x0000000002080000-0x00000000020BE000-memory.dmpFilesize
248KB
-
memory/4888-149-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4888-148-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-150-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-151-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-152-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-153-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-154-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-155-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-157-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-158-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-159-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-156-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-160-0x0000000002550000-0x000000000258E000-memory.dmpFilesize
248KB
-
memory/4888-161-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-162-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-163-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-164-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-165-0x0000000004C30000-0x000000000512E000-memory.dmpFilesize
5.0MB
-
memory/4888-166-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-167-0x0000000002710000-0x000000000274C000-memory.dmpFilesize
240KB
-
memory/4888-168-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-169-0x0000000005130000-0x00000000051C2000-memory.dmpFilesize
584KB
-
memory/4888-170-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-171-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-172-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-173-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-174-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-175-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-176-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-177-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-178-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-179-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-181-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-180-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-182-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-184-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-183-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-185-0x00000000053D0000-0x00000000059D6000-memory.dmpFilesize
6.0MB
-
memory/4888-186-0x00000000051E0000-0x00000000052EA000-memory.dmpFilesize
1.0MB
-
memory/4888-187-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-188-0x0000000005320000-0x0000000005332000-memory.dmpFilesize
72KB
-
memory/4888-189-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-190-0x0000000005340000-0x000000000537E000-memory.dmpFilesize
248KB
-
memory/4888-191-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/4888-192-0x0000000005AE0000-0x0000000005B2B000-memory.dmpFilesize
300KB
-
memory/4888-197-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB
-
memory/4888-196-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/4888-199-0x0000000005C40000-0x0000000005CA6000-memory.dmpFilesize
408KB
-
memory/4888-207-0x0000000006320000-0x00000000064E2000-memory.dmpFilesize
1.8MB
-
memory/4888-208-0x0000000006500000-0x0000000006A2C000-memory.dmpFilesize
5.2MB
-
memory/4888-218-0x0000000000400000-0x0000000000466000-memory.dmpFilesize
408KB