Analysis
-
max time kernel
53s -
max time network
54s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
01-02-2023 23:55
Static task
static1
General
-
Target
0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exe
-
Size
335KB
-
MD5
0e2f23e9e9711230ef7d10373a10c635
-
SHA1
9f1f3d5e9cbdb8003f241dd30c27e28fc84df8a4
-
SHA256
0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c
-
SHA512
c56bbb2cbc4831a7d90cca742afb60e756d52503dd2000da339e3bc25f87967d1ba35a71b8554921d8483329d6342fca9718c4ceb4c87f9b21fe0c1832b6881b
-
SSDEEP
6144:13bFCLaAvsdg/MjX6O8APax4kHByIysADFRxLe9sczWGUq:13bA+AvsaMj7aqpRD7xC9TC
Malware Config
Extracted
redline
milaf
193.233.20.5:4136
-
auth_value
68aaee25afe3d0ae7d4db09dea02347c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3040-162-0x0000000004C80000-0x0000000004CC6000-memory.dmp family_redline behavioral1/memory/3040-169-0x0000000007290000-0x00000000072D4000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exepid process 3040 0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exe 3040 0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exedescription pid process Token: SeDebugPrivilege 3040 0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exe"C:\Users\Admin\AppData\Local\Temp\0b7804cb7e24879a4fe9268bc4c427f5200b99b89c4fab051c6e7500bdeb812c.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3040
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3040-118-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-119-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-120-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-121-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-122-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-123-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-124-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-125-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-126-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-127-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-128-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-129-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-130-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-131-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-132-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-133-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-134-0x0000000002C48000-0x0000000002C76000-memory.dmpFilesize
184KB
-
memory/3040-135-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-136-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-137-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-140-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-139-0x00000000048F0000-0x000000000493B000-memory.dmpFilesize
300KB
-
memory/3040-141-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-138-0x0000000002BC0000-0x0000000002C6E000-memory.dmpFilesize
696KB
-
memory/3040-142-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-143-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-144-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-145-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-146-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-147-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-148-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-149-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-150-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-151-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-152-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/3040-153-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-155-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-154-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-156-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-157-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-158-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-159-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-160-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-161-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-162-0x0000000004C80000-0x0000000004CC6000-memory.dmpFilesize
280KB
-
memory/3040-163-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-164-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-165-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-166-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-167-0x0000000007420000-0x000000000791E000-memory.dmpFilesize
5.0MB
-
memory/3040-168-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-169-0x0000000007290000-0x00000000072D4000-memory.dmpFilesize
272KB
-
memory/3040-170-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-171-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-172-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-173-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-174-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-175-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-176-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-177-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-178-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-179-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-180-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-181-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-182-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-183-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-184-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-185-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-186-0x0000000007920000-0x0000000007F26000-memory.dmpFilesize
6.0MB
-
memory/3040-187-0x0000000007F30000-0x000000000803A000-memory.dmpFilesize
1.0MB
-
memory/3040-188-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-189-0x00000000073B0000-0x00000000073C2000-memory.dmpFilesize
72KB
-
memory/3040-190-0x00000000779B0000-0x0000000077B3E000-memory.dmpFilesize
1.6MB
-
memory/3040-191-0x00000000073D0000-0x000000000740E000-memory.dmpFilesize
248KB
-
memory/3040-193-0x0000000008150000-0x000000000819B000-memory.dmpFilesize
300KB
-
memory/3040-197-0x0000000002BC0000-0x0000000002C6E000-memory.dmpFilesize
696KB
-
memory/3040-198-0x00000000048F0000-0x000000000493B000-memory.dmpFilesize
300KB
-
memory/3040-199-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB
-
memory/3040-201-0x0000000008660000-0x00000000086F2000-memory.dmpFilesize
584KB
-
memory/3040-203-0x0000000008700000-0x0000000008766000-memory.dmpFilesize
408KB
-
memory/3040-211-0x0000000008B60000-0x0000000008D22000-memory.dmpFilesize
1.8MB
-
memory/3040-212-0x0000000008D40000-0x000000000926C000-memory.dmpFilesize
5.2MB
-
memory/3040-215-0x00000000094A0000-0x0000000009516000-memory.dmpFilesize
472KB
-
memory/3040-216-0x0000000009530000-0x0000000009580000-memory.dmpFilesize
320KB
-
memory/3040-221-0x0000000000400000-0x0000000002BBD000-memory.dmpFilesize
39.7MB