Analysis
-
max time kernel
61s -
max time network
135s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
-
submitted
01/02/2023, 08:46
General
-
Target
tmp.exe
-
Size
175KB
-
MD5
acf54cfad4852b63202ba4b97effdd9e
-
SHA1
cc7456e4b78957fc2d013cec39b30ea7ed8dbaa2
-
SHA256
f4bfa9f592a953ba496c92d14b1ef1698ada62b9cb547e6a0843ced061fb6e8e
-
SHA512
d9f3d31b55b60f9f09dd7fe26f0f40db21db9b3253fef1c416ced30bab396d161e89375096032311f6c4199fabd156f75670fd6598789868bd8cf1e9f463699b
-
SSDEEP
3072:0xqZWTHaJIppU4LFca4devt9ThVTxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOi:KqZH4LFcxUTh
Malware Config
Extracted
redline
temposs6678
82.115.223.9:15486
-
auth_value
af399e6a2fe66f67025541cf71c64313
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\tmp.exe"C:\Users\Admin\AppData\Local\Temp\tmp.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
5.6MB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
1.8MB
-
Filesize
5.2MB