Analysis
-
max time kernel
53s -
max time network
147s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
31-01-2023 01:15
Static task
static1
General
-
Target
4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exe
-
Size
278KB
-
MD5
2c1a2feac793d5dd3991617a02c0d83b
-
SHA1
6bd2b0cd39104fc99ddc3f448816462caa813d7a
-
SHA256
4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353
-
SHA512
b4201d7a361cd372fd3a11fd967dd7342d017981619750d9ab09bb4fbe42c6caa0fb3e9a6a0dfe6f33d23cf4135621c89dbad8390ec593b04a40c8686901adfc
-
SSDEEP
6144:eFOLzuXUYILEuVtonoiodoVvUfHzoahcHMAkYzY:eM3uXiEvoyv8HruHD
Malware Config
Extracted
redline
fredy
62.204.41.170:4132
-
auth_value
880249eef9593d49a1a3cddf57c5cb35
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2700-160-0x0000000004A40000-0x0000000004A86000-memory.dmp family_redline behavioral1/memory/2700-167-0x0000000004C40000-0x0000000004C84000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exepid process 2700 4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exe 2700 4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exedescription pid process Token: SeDebugPrivilege 2700 4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exe"C:\Users\Admin\AppData\Local\Temp\4bdb16c3227e4615557fe66b51146c9f56403e570afe9ef77ac848e30dfd8353.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2700-116-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-117-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-118-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-119-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-120-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-121-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-122-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-123-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-125-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-126-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-127-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-128-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-129-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-130-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-131-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-132-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-133-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-134-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-135-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-136-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-124-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-137-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-138-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-140-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-141-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-142-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-143-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-145-0x0000000002C90000-0x0000000002DDA000-memory.dmpFilesize
1.3MB
-
memory/2700-144-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-147-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-146-0x00000000048F0000-0x000000000493B000-memory.dmpFilesize
300KB
-
memory/2700-148-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-149-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-150-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-151-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-152-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-153-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-154-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-155-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-157-0x0000000000400000-0x0000000002BAF000-memory.dmpFilesize
39.7MB
-
memory/2700-158-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-156-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-159-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-160-0x0000000004A40000-0x0000000004A86000-memory.dmpFilesize
280KB
-
memory/2700-161-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-162-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-163-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-164-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-165-0x0000000007560000-0x0000000007A5E000-memory.dmpFilesize
5.0MB
-
memory/2700-166-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-167-0x0000000004C40000-0x0000000004C84000-memory.dmpFilesize
272KB
-
memory/2700-168-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-169-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-170-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-171-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-172-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-173-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-174-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-175-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-176-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-177-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-178-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-179-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-180-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-181-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-182-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-183-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-184-0x0000000007A60000-0x0000000008066000-memory.dmpFilesize
6.0MB
-
memory/2700-185-0x0000000005020000-0x000000000512A000-memory.dmpFilesize
1.0MB
-
memory/2700-186-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-187-0x0000000005180000-0x0000000005192000-memory.dmpFilesize
72KB
-
memory/2700-188-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-189-0x00000000051A0000-0x00000000051DE000-memory.dmpFilesize
248KB
-
memory/2700-190-0x0000000077A60000-0x0000000077BEE000-memory.dmpFilesize
1.6MB
-
memory/2700-191-0x0000000008170000-0x00000000081BB000-memory.dmpFilesize
300KB
-
memory/2700-195-0x0000000002C90000-0x0000000002DDA000-memory.dmpFilesize
1.3MB
-
memory/2700-196-0x00000000082D0000-0x0000000008362000-memory.dmpFilesize
584KB
-
memory/2700-198-0x0000000008370000-0x00000000083D6000-memory.dmpFilesize
408KB
-
memory/2700-206-0x0000000008A20000-0x0000000008A96000-memory.dmpFilesize
472KB
-
memory/2700-207-0x0000000008AC0000-0x0000000008B10000-memory.dmpFilesize
320KB
-
memory/2700-208-0x0000000008B40000-0x0000000008D02000-memory.dmpFilesize
1.8MB
-
memory/2700-209-0x0000000008D30000-0x000000000925C000-memory.dmpFilesize
5.2MB
-
memory/2700-216-0x0000000000400000-0x0000000002BAF000-memory.dmpFilesize
39.7MB