Analysis
-
max time kernel
53s -
max time network
146s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
02-02-2023 09:50
Static task
static1
General
-
Target
932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exe
-
Size
416KB
-
MD5
edcef5c438b6dcc5577fddda5ed4d3a8
-
SHA1
fe528c9c99f71b5b57135e78e75930709adb00c0
-
SHA256
932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545
-
SHA512
752c18bfabe0ce1f5332c3ad09c796acf506315fe857699fde0ee55d3de042339ba7bebed99f51d588a1711d7baea954540681d8a9d2f45fd58ec78ff9cffcaa
-
SSDEEP
12288:yuOPg6ULiv3/tptEjL6EPybrhc9CJb7d5:RUgBLm3VptEvnj9qb7d5
Malware Config
Extracted
redline
milaf
193.233.20.5:4136
-
auth_value
68aaee25afe3d0ae7d4db09dea02347c
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2432-161-0x0000000002440000-0x0000000002486000-memory.dmp family_redline behavioral1/memory/2432-168-0x0000000002710000-0x0000000002754000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exepid process 2432 932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exe 2432 932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exedescription pid process Token: SeDebugPrivilege 2432 932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exe"C:\Users\Admin\AppData\Local\Temp\932e06ef373d93ea1cde5e4fef13d321e5ce8b3b707be937e87264fb64c3a545.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2432-116-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-117-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-118-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-119-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-120-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-121-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-122-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-124-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-123-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-125-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-126-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-127-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-128-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-129-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-130-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-131-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-132-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-133-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-134-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-135-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-136-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-137-0x00000000006DA000-0x0000000000708000-memory.dmpFilesize
184KB
-
memory/2432-138-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-139-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-140-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-142-0x00000000005A0000-0x00000000006EA000-memory.dmpFilesize
1.3MB
-
memory/2432-141-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-143-0x00000000021E0000-0x000000000222B000-memory.dmpFilesize
300KB
-
memory/2432-144-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-145-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-146-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-147-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-148-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-149-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-150-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-151-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-152-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-153-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-154-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB
-
memory/2432-155-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-156-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-157-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-158-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-159-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-160-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-162-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-161-0x0000000002440000-0x0000000002486000-memory.dmpFilesize
280KB
-
memory/2432-163-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-164-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-165-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-166-0x0000000004CB0000-0x00000000051AE000-memory.dmpFilesize
5.0MB
-
memory/2432-167-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-168-0x0000000002710000-0x0000000002754000-memory.dmpFilesize
272KB
-
memory/2432-169-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-170-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-171-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-172-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-173-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-174-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-175-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-176-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-177-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-178-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-179-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-180-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-181-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-182-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-183-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-184-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-185-0x00000000057C0000-0x0000000005DC6000-memory.dmpFilesize
6.0MB
-
memory/2432-186-0x00000000051B0000-0x00000000052BA000-memory.dmpFilesize
1.0MB
-
memory/2432-187-0x0000000076EF0000-0x000000007707E000-memory.dmpFilesize
1.6MB
-
memory/2432-188-0x0000000002940000-0x0000000002952000-memory.dmpFilesize
72KB
-
memory/2432-190-0x00000000052C0000-0x00000000052FE000-memory.dmpFilesize
248KB
-
memory/2432-192-0x0000000005410000-0x000000000545B000-memory.dmpFilesize
300KB
-
memory/2432-196-0x00000000021E0000-0x000000000222B000-memory.dmpFilesize
300KB
-
memory/2432-198-0x00000000055A0000-0x0000000005606000-memory.dmpFilesize
408KB
-
memory/2432-206-0x0000000006290000-0x0000000006322000-memory.dmpFilesize
584KB
-
memory/2432-207-0x0000000006430000-0x00000000064A6000-memory.dmpFilesize
472KB
-
memory/2432-208-0x00000000064B0000-0x0000000006500000-memory.dmpFilesize
320KB
-
memory/2432-209-0x0000000006520000-0x00000000066E2000-memory.dmpFilesize
1.8MB
-
memory/2432-210-0x0000000006700000-0x0000000006C2C000-memory.dmpFilesize
5.2MB
-
memory/2432-217-0x0000000000400000-0x0000000000483000-memory.dmpFilesize
524KB