Analysis
-
max time kernel
49s -
max time network
182s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
01-12-2022 23:01
Static task
static1
Behavioral task
behavioral1
Sample
5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe
Resource
win10-20220901-en
General
-
Target
5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe
-
Size
322KB
-
MD5
1425bbb2526bff0820a2e27ab03bf83a
-
SHA1
1a76231027d363fed456c822485b6c80ec54caa2
-
SHA256
5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e
-
SHA512
dc333d973315fba725ddbb426e3aff1b4bdac593f4af2c99192085a8ff256f11b3e7a4646d96c8c6249d7185bf4afcbbb0220fe7f5b734fcaaea5e1d5d799482
-
SSDEEP
6144:gvbwyOBdv8TKCQ17VxWq9XsEHeYTnYgLo0BhpGt2NEaO:gvdOBdvoKCUDfTtkgLrBh4yE
Malware Config
Extracted
redline
NewDef2023
185.106.92.214:2510
-
auth_value
048f34b18865578890538db10b2e9edf
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/3512-161-0x0000000002210000-0x000000000224E000-memory.dmp family_redline behavioral2/memory/3512-168-0x00000000023D0000-0x000000000240C000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exepid process 3512 5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe 3512 5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exedescription pid process Token: SeDebugPrivilege 3512 5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe"C:\Users\Admin\AppData\Local\Temp\5a75f8cd1da26629a59ad97b7f0bca98d5f3e3c2310fa2a94ef03d0e11bf3b1e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3512-117-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-118-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-119-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-120-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-121-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-122-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-123-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-124-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-125-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-126-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-127-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-128-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-129-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-130-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-131-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-132-0x0000000000666000-0x0000000000697000-memory.dmpFilesize
196KB
-
memory/3512-133-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-134-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-135-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-136-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-137-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-139-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-138-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-140-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-141-0x0000000000530000-0x000000000067A000-memory.dmpFilesize
1.3MB
-
memory/3512-143-0x00000000004E0000-0x000000000051E000-memory.dmpFilesize
248KB
-
memory/3512-142-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-144-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-145-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-146-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-147-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-148-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-149-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-150-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-151-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-153-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-154-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB
-
memory/3512-152-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-155-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-156-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-157-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-158-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-159-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-160-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-161-0x0000000002210000-0x000000000224E000-memory.dmpFilesize
248KB
-
memory/3512-162-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-164-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-163-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-165-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-166-0x0000000004B30000-0x000000000502E000-memory.dmpFilesize
5.0MB
-
memory/3512-167-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-168-0x00000000023D0000-0x000000000240C000-memory.dmpFilesize
240KB
-
memory/3512-169-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-170-0x0000000005030000-0x00000000050C2000-memory.dmpFilesize
584KB
-
memory/3512-171-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-172-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-173-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-174-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-175-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-176-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-178-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-177-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-179-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-180-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-181-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-182-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-184-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-185-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-183-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-186-0x00000000052B0000-0x00000000058B6000-memory.dmpFilesize
6.0MB
-
memory/3512-187-0x00000000058C0000-0x00000000059CA000-memory.dmpFilesize
1.0MB
-
memory/3512-188-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-189-0x0000000005230000-0x0000000005242000-memory.dmpFilesize
72KB
-
memory/3512-190-0x0000000077B00000-0x0000000077C8E000-memory.dmpFilesize
1.6MB
-
memory/3512-191-0x0000000005250000-0x000000000528E000-memory.dmpFilesize
248KB
-
memory/3512-193-0x0000000005AF0000-0x0000000005B3B000-memory.dmpFilesize
300KB
-
memory/3512-197-0x00000000004E0000-0x000000000051E000-memory.dmpFilesize
248KB
-
memory/3512-199-0x0000000005C60000-0x0000000005CC6000-memory.dmpFilesize
408KB
-
memory/3512-207-0x0000000006580000-0x0000000006742000-memory.dmpFilesize
1.8MB
-
memory/3512-208-0x0000000006760000-0x0000000006C8C000-memory.dmpFilesize
5.2MB
-
memory/3512-218-0x0000000000400000-0x0000000000486000-memory.dmpFilesize
536KB