Analysis
-
max time kernel
144s -
max time network
179s -
platform
windows10-1703_x64 -
resource
win10-20220901-en -
resource tags
arch:x64arch:x86image:win10-20220901-enlocale:en-usos:windows10-1703-x64system -
submitted
15-01-2023 04:47
Behavioral task
behavioral1
Sample
00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe
Resource
win7-20221111-en
General
-
Target
00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe
-
Size
175KB
-
MD5
1d36c738313c395f30cbedb0a88f5b59
-
SHA1
74897a4eb2fc2270ad87ebb3006bbcd1f2ba1965
-
SHA256
00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1
-
SHA512
bc7635221176c3ed34b5bfe8d7f0774332a3224ca2408b6cd366e2980b5586f660e12528ac7e81805d42d0340008ae8bb3cdec9c009969c3c761b399f43ecf93
-
SSDEEP
3072:SxqZWXragQx+//VjNsdeagFChj/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuu:AqZW/VjWiCh
Malware Config
Extracted
redline
gula
62.204.41.211:4065
-
auth_value
4bef3143c3de8ce351d43c906a88fb8a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exepid process 4740 00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe 4740 00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exedescription pid process Token: SeDebugPrivilege 4740 00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe"C:\Users\Admin\AppData\Local\Temp\00ec750abb7882295efde815b9f50a550d6fe9fdfd8fde581dae4b8ccf83d4d1.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4740-120-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-121-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-122-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-123-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-124-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-125-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-126-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-127-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-129-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-128-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-130-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-131-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-132-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-133-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-134-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-135-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-136-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-137-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-138-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-139-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-140-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-141-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-142-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-143-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-144-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-145-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-146-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-147-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-148-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-149-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-150-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-151-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-152-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-153-0x00000000007B0000-0x00000000007E2000-memory.dmpFilesize
200KB
-
memory/4740-154-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-155-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-156-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-158-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-159-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-161-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-160-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-157-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-162-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-163-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-164-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-166-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-165-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-167-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-168-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-169-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-170-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-171-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-173-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-172-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-174-0x0000000005540000-0x0000000005B46000-memory.dmpFilesize
6.0MB
-
memory/4740-175-0x00000000050D0000-0x00000000051DA000-memory.dmpFilesize
1.0MB
-
memory/4740-176-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-177-0x0000000005000000-0x0000000005012000-memory.dmpFilesize
72KB
-
memory/4740-178-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-179-0x0000000005060000-0x000000000509E000-memory.dmpFilesize
248KB
-
memory/4740-180-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-182-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-181-0x00000000051E0000-0x000000000522B000-memory.dmpFilesize
300KB
-
memory/4740-183-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-184-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-185-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-186-0x00000000053A0000-0x0000000005406000-memory.dmpFilesize
408KB
-
memory/4740-187-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-188-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-189-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-190-0x0000000077850000-0x00000000779DE000-memory.dmpFilesize
1.6MB
-
memory/4740-194-0x0000000006390000-0x000000000688E000-memory.dmpFilesize
5.0MB
-
memory/4740-195-0x0000000005F70000-0x0000000006002000-memory.dmpFilesize
584KB
-
memory/4740-197-0x0000000006890000-0x0000000006A52000-memory.dmpFilesize
1.8MB
-
memory/4740-198-0x0000000006F90000-0x00000000074BC000-memory.dmpFilesize
5.2MB
-
memory/4740-202-0x00000000062F0000-0x0000000006366000-memory.dmpFilesize
472KB
-
memory/4740-203-0x0000000006A60000-0x0000000006AB0000-memory.dmpFilesize
320KB