Analysis

  • max time kernel
    46s
  • max time network
    55s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    28-11-2022 19:14

General

  • Target

    60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe

  • Size

    385KB

  • MD5

    ec6dddac0acdd89e00127c8273842054

  • SHA1

    de4e8c38b79f1c17fa15e4d08e1b5377629f4d7a

  • SHA256

    60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c

  • SHA512

    85ef01ff1a295c6bed21fc2aa8290fb1d3a6fb0a8ebee3ab2f8fe1f5bebb62799b3b12db8fa061701b4772b3e02bca7d726a6f8bbd90cd7b060c738f2fa0d867

  • SSDEEP

    6144:PvFOkNl2WlcZXRK4BcblFW5caYfxUjoBUp/ykXPd4oVFvg4/FQF:1rNl8FLavpXkXPKoDgSm

Malware Config

Extracted

Family

redline

Botnet

NewDef2023

C2

185.106.92.214:2510

Attributes
  • auth_value

    048f34b18865578890538db10b2e9edf

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe
    "C:\Users\Admin\AppData\Local\Temp\60f595f639e14976c97c5448e03a32c9fca980eabc3796afa0b97c84c35f067c.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4888

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4888-117-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-118-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-119-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-120-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-121-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-122-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-123-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-124-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-125-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-126-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-127-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-128-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-129-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-130-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-131-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-132-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-134-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-133-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-135-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-136-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-137-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-138-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-139-0x00000000006BA000-0x00000000006EB000-memory.dmp
    Filesize

    196KB

  • memory/4888-140-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-141-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-142-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-143-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-144-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-145-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-146-0x00000000005A0000-0x00000000006EA000-memory.dmp
    Filesize

    1.3MB

  • memory/4888-147-0x0000000002080000-0x00000000020BE000-memory.dmp
    Filesize

    248KB

  • memory/4888-149-0x0000000000400000-0x0000000000466000-memory.dmp
    Filesize

    408KB

  • memory/4888-148-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-150-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-151-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-152-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-153-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-154-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-155-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-157-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-158-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-159-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-156-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-160-0x0000000002550000-0x000000000258E000-memory.dmp
    Filesize

    248KB

  • memory/4888-161-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-162-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-163-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-164-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-165-0x0000000004C30000-0x000000000512E000-memory.dmp
    Filesize

    5.0MB

  • memory/4888-166-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-167-0x0000000002710000-0x000000000274C000-memory.dmp
    Filesize

    240KB

  • memory/4888-168-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-169-0x0000000005130000-0x00000000051C2000-memory.dmp
    Filesize

    584KB

  • memory/4888-170-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-171-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-172-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-173-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-174-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-175-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-176-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-177-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-178-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-179-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-181-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-180-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-182-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-184-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-183-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-185-0x00000000053D0000-0x00000000059D6000-memory.dmp
    Filesize

    6.0MB

  • memory/4888-186-0x00000000051E0000-0x00000000052EA000-memory.dmp
    Filesize

    1.0MB

  • memory/4888-187-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-188-0x0000000005320000-0x0000000005332000-memory.dmp
    Filesize

    72KB

  • memory/4888-189-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-190-0x0000000005340000-0x000000000537E000-memory.dmp
    Filesize

    248KB

  • memory/4888-191-0x0000000077B00000-0x0000000077C8E000-memory.dmp
    Filesize

    1.6MB

  • memory/4888-192-0x0000000005AE0000-0x0000000005B2B000-memory.dmp
    Filesize

    300KB

  • memory/4888-197-0x0000000000400000-0x0000000000466000-memory.dmp
    Filesize

    408KB

  • memory/4888-196-0x00000000005A0000-0x00000000006EA000-memory.dmp
    Filesize

    1.3MB

  • memory/4888-199-0x0000000005C40000-0x0000000005CA6000-memory.dmp
    Filesize

    408KB

  • memory/4888-207-0x0000000006320000-0x00000000064E2000-memory.dmp
    Filesize

    1.8MB

  • memory/4888-208-0x0000000006500000-0x0000000006A2C000-memory.dmp
    Filesize

    5.2MB

  • memory/4888-218-0x0000000000400000-0x0000000000466000-memory.dmp
    Filesize

    408KB