Analysis

  • max time kernel
    165s
  • max time network
    182s
  • platform
    windows10-1703_x64
  • resource
    win10-20220812-en
  • resource tags

    arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system
  • submitted
    18/12/2022, 04:48

General

  • Target

    7fcb0b012f523c323de54a242b3b2a409890a51160194dfcb1cbc3543fdf5981.exe

  • Size

    334KB

  • MD5

    c13114c5d107b640e041fa02354f7e71

  • SHA1

    adfcd6041996870d66451f17eb25587b1f8cff7f

  • SHA256

    7fcb0b012f523c323de54a242b3b2a409890a51160194dfcb1cbc3543fdf5981

  • SHA512

    6b885b5748b4eae3e989fbcff5d8434c09de43420a97cce884408579d03d8e417f46485611a19ffe506010145d7494234b7649c873e9005fae0e00dbcd579e95

  • SSDEEP

    6144:rrJiULxVJH+16KNYvB1/JIMSRXIfstBfGhneRCgxrAZg3ChAU0V6:vJblV26QYp1/JBa4EtZMeRxrAuS7O

Malware Config

Extracted

Family

redline

Botnet

nokia

C2

31.41.244.198:4083

Attributes
  • auth_value

    3b38e056d594ae0cf1368e6e1daa3a4e

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 2 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\7fcb0b012f523c323de54a242b3b2a409890a51160194dfcb1cbc3543fdf5981.exe
    "C:\Users\Admin\AppData\Local\Temp\7fcb0b012f523c323de54a242b3b2a409890a51160194dfcb1cbc3543fdf5981.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2640

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2640-115-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-116-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-117-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-118-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-119-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-120-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-121-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-123-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-124-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-125-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-126-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-127-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-128-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-129-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-130-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-131-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-132-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-133-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-134-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-135-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-136-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-137-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-138-0x00000000005D0000-0x000000000071A000-memory.dmp

    Filesize

    1.3MB

  • memory/2640-139-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-140-0x00000000005D0000-0x000000000071A000-memory.dmp

    Filesize

    1.3MB

  • memory/2640-141-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-142-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-143-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-144-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-145-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-146-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-147-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-148-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-149-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB

  • memory/2640-150-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-151-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-152-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-153-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-154-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-155-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-156-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-157-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-158-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-159-0x0000000004AD0000-0x0000000004B16000-memory.dmp

    Filesize

    280KB

  • memory/2640-160-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-161-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-162-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-163-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-164-0x0000000004BF0000-0x00000000050EE000-memory.dmp

    Filesize

    5.0MB

  • memory/2640-165-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-166-0x0000000004B50000-0x0000000004B94000-memory.dmp

    Filesize

    272KB

  • memory/2640-167-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-168-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-169-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-170-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-171-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-172-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-173-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-174-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-175-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-176-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-177-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-178-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-179-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-180-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-181-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-182-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-183-0x00000000050F0000-0x00000000056F6000-memory.dmp

    Filesize

    6.0MB

  • memory/2640-184-0x0000000005760000-0x000000000586A000-memory.dmp

    Filesize

    1.0MB

  • memory/2640-185-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-186-0x00000000058A0000-0x00000000058B2000-memory.dmp

    Filesize

    72KB

  • memory/2640-187-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-188-0x00000000058C0000-0x00000000058FE000-memory.dmp

    Filesize

    248KB

  • memory/2640-189-0x0000000077A00000-0x0000000077B8E000-memory.dmp

    Filesize

    1.6MB

  • memory/2640-190-0x0000000005A10000-0x0000000005A5B000-memory.dmp

    Filesize

    300KB

  • memory/2640-194-0x00000000005D0000-0x000000000071A000-memory.dmp

    Filesize

    1.3MB

  • memory/2640-195-0x00000000005D0000-0x000000000071A000-memory.dmp

    Filesize

    1.3MB

  • memory/2640-197-0x0000000005BA0000-0x0000000005C06000-memory.dmp

    Filesize

    408KB

  • memory/2640-205-0x0000000006290000-0x0000000006322000-memory.dmp

    Filesize

    584KB

  • memory/2640-206-0x0000000006330000-0x00000000064F2000-memory.dmp

    Filesize

    1.8MB

  • memory/2640-207-0x0000000006500000-0x0000000006A2C000-memory.dmp

    Filesize

    5.2MB

  • memory/2640-210-0x0000000006C60000-0x0000000006CD6000-memory.dmp

    Filesize

    472KB

  • memory/2640-211-0x0000000006CF0000-0x0000000006D40000-memory.dmp

    Filesize

    320KB

  • memory/2640-216-0x0000000000400000-0x000000000047D000-memory.dmp

    Filesize

    500KB