Overview

overview

10

Static

static

winprofile

windows7-x64

10

winprofile

windows10-1703-x64

10

Analysis

  • max time kernel
    48s
  • max time network
    182s
  • platform
    windows10-1703_x64
  • resource
    win10-20220901-en
  • resource tags

    arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system
  • submitted
    02-12-2022 03:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    7a2c85115cf05815623227c0d44a950a6655631331eaa9721f1eb1459cdc9d53.exe

  • Size

    322KB

  • MD5

    9f09b03c972d0c909488f884e65d21eb

  • SHA1

    881a239323b33d61d38904d95376820356b53564

  • SHA256

    7a2c85115cf05815623227c0d44a950a6655631331eaa9721f1eb1459cdc9d53

  • SHA512

    24979be3f014a84635093f9ce0a8b35ac67cfaf86c1716e7aec779f5c0a5d1626d6846856fc8449d8ae5e10ca84798464b88cf836b80730c3064ff8c69fbc701

  • SSDEEP

    6144:uOe7iR9vSXa+8wTIFdfJTgJU7xJid6p4jt/Xf4evprDivpl:uBiR9vSF83jJTTtod6MNX78

Score
10/10
redlinenewdef2023discoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

NewDef2023

C2

185.106.92.214:2510

Attributes
  • auth_value

    048f34b18865578890538db10b2e9edf

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7a2c85115cf05815623227c0d44a950a6655631331eaa9721f1eb1459cdc9d53.exe
    "C:\Users\Admin\AppData\Local\Temp\7a2c85115cf05815623227c0d44a950a6655631331eaa9721f1eb1459cdc9d53.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2796

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Lateral Movement

Collection

Data from Local System

2
T1005

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2796-120-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-121-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-122-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-123-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-124-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-125-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-126-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-127-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-128-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-129-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-130-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-132-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-131-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-133-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-134-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-136-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-137-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-138-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-139-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-140-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-141-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-142-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-143-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-144-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-145-0x0000000000490000-0x000000000053E000-memory.dmp
    Filesize

    696KB

    Download
  • memory/2796-146-0x0000000002060000-0x000000000209E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2796-148-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-147-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-149-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-150-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-151-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-152-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-153-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-154-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-156-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-155-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-157-0x0000000000400000-0x0000000000486000-memory.dmp
    Filesize

    536KB

    Download
  • memory/2796-158-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-159-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-160-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-161-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-162-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-163-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-164-0x00000000023F0000-0x000000000242E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2796-165-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-166-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-167-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-168-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-170-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-171-0x0000000002490000-0x00000000024CC000-memory.dmp
    Filesize

    240KB

    Download
  • memory/2796-169-0x0000000004CA0000-0x000000000519E000-memory.dmp
    Filesize

    5.0MB

    Download
  • memory/2796-172-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-173-0x0000000002620000-0x00000000026B2000-memory.dmp
    Filesize

    584KB

    Download
  • memory/2796-174-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-175-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-176-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-177-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-178-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-179-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-180-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-181-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-182-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-183-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-185-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-186-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-188-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-187-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-184-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-189-0x00000000052B0000-0x00000000058B6000-memory.dmp
    Filesize

    6.0MB

    Download
  • memory/2796-190-0x00000000058C0000-0x00000000059CA000-memory.dmp
    Filesize

    1.0MB

    Download
  • memory/2796-191-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-192-0x0000000004BE0000-0x0000000004BF2000-memory.dmp
    Filesize

    72KB

    Download
  • memory/2796-193-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-194-0x0000000004C00000-0x0000000004C3E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2796-195-0x0000000077570000-0x00000000776FE000-memory.dmp
    Filesize

    1.6MB

    Download
  • memory/2796-196-0x00000000059D0000-0x0000000005A1B000-memory.dmp
    Filesize

    300KB

    Download
  • memory/2796-200-0x0000000002060000-0x000000000209E000-memory.dmp
    Filesize

    248KB

    Download
  • memory/2796-202-0x0000000005B20000-0x0000000005B86000-memory.dmp
    Filesize

    408KB

    Download
  • memory/2796-213-0x0000000006F30000-0x00000000070F2000-memory.dmp
    Filesize

    1.8MB

    Download
  • memory/2796-214-0x0000000007100000-0x000000000762C000-memory.dmp
    Filesize

    5.2MB

    Download
  • memory/2796-221-0x0000000000400000-0x0000000000486000-memory.dmp
    Filesize

    536KB

    Download