Analysis
-
max time kernel
145s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
10/03/2023, 10:27
General
-
Target
10b5194cf72e53e571e1425e022b2989.exe
-
Size
411KB
-
MD5
10b5194cf72e53e571e1425e022b2989
-
SHA1
637f85f536858a9f67f476c8b2c4760fa6674389
-
SHA256
d73cb2647bbcd5fc8f3c5a3f67656c3e9c4f7b057d9a283fa65fa504f9301a32
-
SHA512
da2a40e0e4c51d126d65a2523ba64093bb4ac547021325198cd2da03883cf208851c2c9895e1bda39224c9d0a28046d55e874e65af69ff29cc9eb293603f4305
-
SSDEEP
6144:9ESsLug5b1r2aFNq3YUKGi+AMdoLT1h4LtqMN5ClCIeBGOe:0ig5A0AoUDcth4LgMzClDeBGO
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 6 IoCs
-
Program crash 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\10b5194cf72e53e571e1425e022b2989.exe"C:\Users\Admin\AppData\Local\Temp\10b5194cf72e53e571e1425e022b2989.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4404 -s 12842⤵
- Program crash
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k netsvcs -p1⤵
- Drops file in System32 directory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 460 -p 4404 -ip 44041⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
36KB
MD5761388ca8095173f6963b1d23ad8a68b
SHA141e2693d0efc36cb0b97ea215d554932c46464ab
SHA256369a2323cb569b44970884d5af3d70e38c9cfb59a54d929fabb51ba46593aa06
SHA5122db4576927b4325dc51ce1755d55b00f7153a10424ca79fb7f32f8c92a5dec899c3961b44a15a129f1e5234b53a89c8946192703b88b10e70e86670e5831ebdf
-
Filesize
14KB
MD5c01eaa0bdcd7c30a42bbb35a9acbf574
SHA10aee3e1b873e41d040f1991819d0027b6cc68f54
SHA25632297224427103aa1834dba276bf5d49cd5dd6bda0291422e47ad0d0706c6d40
SHA512d26ff775ad39425933cd3df92209faa53ec5b701e65bfbcccc64ce8dd3e79f619a9bad7cc975a98a95f2006ae89e50551877fc315a3050e48d5ab89e0802e2b7
-
Filesize
29KB
MD51d01497ef835628dc321d81b2464c44a
SHA195a848176634562fdc34ea4e581b0bbd4ed5a2fe
SHA25638b2bb5296844b308a8bf3636712eb3cfb81052f531cd58be165c21533331e8c
SHA5120bf85c4e9c514a075570c66bcd26783183d1138c4f9c46de91439e2cce036f438e68f4c21d300d27b4cc3d2948667b2865fc7e202e4973dd956f82035afeb052
-
Filesize
29KB
MD52412f9489b67e4c5bc8579fbdcf44d86
SHA18b91fb6d3aae44e82e96665a2441d036aa63341c
SHA25631ff863ec72078c6e73cbcfaf04296d166b36c35e3a2ece8dece0e7969414300
SHA5120641eec1140aa5ac1bac21bce2d1142f97fbb9aec3a5f536dca0db3c4cec4c4a90063d895513403c155689e6e97865b8e2b43b2ddd58e871c9986dc009406fa1
-
Filesize
29KB
MD57329649480d9123fb0af549ac5d22863
SHA1eb553ebedddd8d65e78112fc09febb314412c55c
SHA256dce45756ff9cb81a3e00f7d9b1c679505f13a752afaa690fc7ebfadf8f78e664
SHA512ecd5e9a6f7b8120c979a403c8fd8ad6b0613500d0c34f4f70eed5f5e58067ac863767db8f433dedcf5a61354b4cf68df6b39bd2ea06abe51c4f59d252f21cf9f
-
Filesize
29KB
MD5d367c0e0d0df266a951fac6c8b5ab567
SHA1bb58091f7256294f82cb37144d0a4bc99c7b25f9
SHA256db85a01ec01e8e5c44c4d4dcdd2eb9b8124cba7cb2b3126236c5c996e752fde2
SHA5121363eac800123234bcd67ccf346e6eff4284d60c3fc2f043e18f44403d1cdb5958311ad8fe2f7db87cc2e327ca19834f2999c5208f03897425e5f7eb320d493b
-
Filesize
29KB
MD5133a3c1f3e93adb7c9151c2c5dd728f6
SHA1afe73bd1c71f01ce32d776cf2b11f3217a1f3002
SHA2560f6c88c953578c1c1faebd3a556f0bfababd2640f2210d58d2aa141915c69a74
SHA5124d07e4615ae98c51dcc2eed2b632b2b0378a57d316d42a40e9e9461b0f1d30efc4ff32790b63198e8e3a33791a7e382f2b8908541bcc6f376da6ffff4542d93d
-
Filesize
29KB
MD5a4cee04229dd5af79071f32e29180e21
SHA1a12322ff388651854f2ffb7d2f9eed5ee63d5fd6
SHA256cf0f6da76191113cd9215e5bafdb691fce01b2141464e0cb6e13f562c4ed4f91
SHA51239db564e0f776be3823575226b614c8a663656391a380846d2d5a51ac2fa7e5ad09c83db9bcfbe4c658194270d4582d2657ae38b1b503a11c2152a33f5886bab
-
Filesize
29KB
MD589faa051ca3849bafbd5fbfb40be78af
SHA1720e07e9d4d728bc5e813fc2d48b6e4f19e83005
SHA256f36dd75332bc22f7cca668ca2aa4ec7941ef85d550a73aeb16edb9b141642752
SHA512d53641a1016878b54fbcc9066001b679269617067fcfa932448ae7444da9b2fd5d87fa7d861851f0cf72f23fecd51a469bf1ea6aebb4a38fe29efa45b4b3b74c
-
Filesize
29KB
MD50de9b43d0a091d677729f1c91fd02df6
SHA1a5d35d2edae76947d8bcb391972ecdc9ec7cf96a
SHA256470d28e29b0af02c186f663b460e07a8ecddf6a8c5ffabaefc67c732127e5ab2
SHA512b707dbea058bae6f5d4074c083dcbe01c88634e8f46d468ea4a5659b1a9d86e1e6f6fc9319153bd859a4fd06cc746519e58aeb25a629f0a8b84f290c77958cd0
-
Filesize
29KB
MD50db7de419df44e5cab702502caf9aa63
SHA1dd3bb1db131a9819bfebc70d7c2afa99f0053ca3
SHA2563502626ff04768805510b1aa39c79570beb2d4b8325f793ff5c279ac88b35b55
SHA5125c552fad1218e086a73d92f57d562c1885998e0199f5bf373a8890600ffb4c57ee3a9751df5ff3fc2e776820dcf298652d4b28816fd361f5f7beebec5961ee2d
-
Filesize
29KB
MD513fc210bc1727da5122c6334eb3511cd
SHA1349551906ee4a3965230562e785a4dd692ab3244
SHA256c4f034a3138ff4eaccdff1bc1b19a226990b1094d3778a39040b6905179d2d68
SHA512caad7e5eb18be1bfb2a94691693d27c0881a13597079786a8586b725c11af250e2ae0aef3e63655b6bf02fa96401efe7ff99b89dbfc6d56ab23fdcd3d4ce4dec
-
Filesize
29KB
MD5e738650aba18679e592655040e12b553
SHA1ee0c736a2b9c965eb753d2293f2850b8b53f1167
SHA256e2aa77463075221dd2cb1e18a9f23ba5f941b2d12d1a945d3e83b7d9ad1173e6
SHA5122ae2781b1ebf78a7a8927f81adf554c3a9a7f29f771f457df32db187ff2aa072e944413cc03938558be84ef80c3247033b8988b19b4d02a6c17a49576ab54f5b
-
Filesize
29KB
MD5a6b3e2b18585c81d4516de359d367c9f
SHA11a05525be8e70298df04bd20e394c835d125d971
SHA256d49533829f7fe9348dec8663819d59ecef4ce28f09196fa0c73dd5476363f22d
SHA512f5013f2fdc8a1f6166f93c99f4dd4ac58044b686eace4fef3ce3895f2e273020896772600ad115d989244a470b577cb095017ebd56680f72eb0638416434db48
-
Filesize
29KB
MD50d26546e8f978a2dd1c40460a319a8f1
SHA14c4bc2f0a68d74d50268ca0dda60105b3f6620f8
SHA2564d5201e02082cebbd9df316291dae3229509ca0ec29c178b885ebee8e7a595b6
SHA5123e4f1565be7485f986ff6b1cdf441c00c89660eb89b81a689a88ac9f34722ca5d3f820d52f2d62c4f81efa31e072956a4ec0c670424bf82dc6bbeb499ddc9a63
-
Filesize
29KB
MD55c95824ad3329f4754e8bcce9dda2b1f
SHA1d55b4e14ec17b1e29a7aa9501cc749c06dfd1b70
SHA2562f0c64ea0cbb5c82118de79cf0527a60da01dbba82c19b0b03aef9a42e9ff6d7
SHA512779b6531a424820e1f1105b826dc39e4ee78544b6b1605bf678db259297b309d56dce4e3017c0db1dbacdc892074c07de0281c78194f859f45a1feb9d7992361
-
Filesize
29KB
MD5750b8daa9d429e8c263ab6df9988036b
SHA1658ecec93c8239488957820b26b19f656bd7fcba
SHA256ec8bc70a5676c8ff7bda85e7cfe756ff76776248d4f19ef38bc12f35ff0346a7
SHA512ddcd71a9193b2ccca39f566273a000632b0ec9ab435697d6a14ff13ff3fe0a05d8d197a23dcf9207862a391eed98eca5f7ff6311b6c42f8ad4e2d4b7fb0a2291
-
Filesize
29KB
MD504c0d26f2eb9cd7136150dfcd5bfa0ef
SHA1c7fdec631c295c6c85f147dbe44eb08b5ffd6d12
SHA256d78caef2e2680152e4da8eafdef78ee3c508bec4d73b3895a556de76de739aa7
SHA512b4c7e33c44d1aaa6f4d8cfddfe856815b228864f96b7027050e0f22f1c9f1cad704a9ee432752411fc0595d41d4a957c31a5d538796e8a9d7560aed94b21bf2b
-
Filesize
29KB
MD57760ae3a1f561d8ef7fa73cdcafd0d2f
SHA1497f26298c2bd55595cfa2be4071ff378b4663db
SHA256c98e0011cab9ef8f540088963bcb173914b10bbbfc5575948a7dd9396dc57140
SHA5124288ee33f23f23e5967c95b55cd8ea82f394318f7a6f319e24bb5cd7c6947425227debdf459f86bfb35902b0c70fd385a7fd44bad63e1bba9a3b27d1ddf998cf
-
Filesize
29KB
MD5a0fe30b52016f29b1634883fa82d06d7
SHA18ce719bd14bbeebb8fcc43cc0dba300d808164a0
SHA256321249697f11892785218db0c59b95a78f118541f789c177117d4840d01b072f
SHA51284d774a7dde600cc86211db6e20ae85891033b390522b7ebb32de4dacd8d3d279346988131fe7be1f72f6daf09fb41c70b2f1f254802b5b5c8718786753dccf0
-
Filesize
29KB
MD529a66caae95a6b675d88eda66d6ea857
SHA1611e3dccda682633a28f602d20e51dd4af5ee890
SHA2562ceb2f390c59eb155b650aced2013685e57e4058d279261b01be9667d8af461a
SHA512f9595827bf3973e413212df57651ed342be0c4ca14ef4865d252497637c28a4135ab4120cb1c2406408290741676702f3cedf4de7134a048dc326c08e5421bc8
-
Filesize
29KB
MD5953c62ecd43185c7b845b984883237d6
SHA1c3f11acb045bb634c4223f74bad3a7cbd008b1bc
SHA256197431ab368073b7a41c3421e26ed021dd95824d127c96279286ddbe7eb94a5d
SHA512d56b8d1965ab2e43814adbdad4fc4d29c9f87a89d4c8451058543cb495200c1099374752b56b66d3a26282db2ed1a80cef880d698d71e4de0095c5faa9a36f5c
-
Filesize
29KB
MD595a4591126fca395da2731111d41abab
SHA192e080db2844b239f836bf5a12d966d0b0f17933
SHA25684bcdbda7f82c5411f4694296dd23dc8d9291432bd814355c3fc62c84e5f956e
SHA5127ed675980c8e5bdc4278f9742b52270b6d44fe62aaeb721c68278c3978cc1aa0007179c1be08f0a375ccab618ae896340e6f6368c2a46a8d5c58e8862e6468a1
-
Filesize
66KB
MD5533cd78d3a30da50285ac3758577b0d9
SHA12506e2e6448b41eea57729f25351bb40199da364
SHA2565ace83c8558640065e14351e03aef7778a9fe7208d7d7542b5b4f0db07a24710
SHA51269f0f58ef11cf8205d19fc3638415143b9d0499a113d96c568b286b0214ad81118f37316a73b3643ec1c69ea3f81cd5e2cd58b3e2faee21566f73c89228f7c26
-
Filesize
66KB
MD502f94e999b2d23f6cffa5ca053a58321
SHA1298337d175b918aa8cb829f71bf745a1f4bff2db
SHA256b718efe439e3a3dc5600ca2206408136b874f1f9888f507c5106102a8981d6c4
SHA512c6f0d1459a2bb9cce2b5131e2856157aa1ff95558083e8e986bb17ee3090713f87969a27c041d2694d7fdd6853420549a3c88ef8500c3711f2cc8ce5b537b894
-
Filesize
66KB
MD5a5f92345a6e7e0de5202a7ba7fae44bc
SHA16a34b076c443ab06f021965a88417527b9035a4f
SHA25641ec96cbc1cf6aed90a0dc535287a32cec2f5615f27427f2c8dd687b207dc99c
SHA512cca91249757a1da08ba7a53de87df76ede974cf2ec6edf739f8ad6485facdf4656bd550cd24a66480576e818095168be5e1d86509fb2dc9828e7aee5ddb6f8a1
-
Filesize
66KB
MD5c0c29783681590345847b6488aaeb652
SHA10a7cd99a31d28e6bf050d828ead2f83d41a053ed
SHA256fe88445457a92068ecec85c8762dc9d849312b3e122deaf3de0835c337d76342
SHA512a93623f48357e51aef02cb57b406dee1c7d75c90656743db1236015aa6801b710db03cc6703586bbcc4f173220238f175f986d6e38ad9168f0ed919a603ebcde
-
Filesize
66KB
MD5a3286cad168a57fb4a7dac3cdadd3f95
SHA118753edacea7a478aae31f9b396944e06d405e47
SHA2568fc5b9cbfde567afac347cd93f338a24529c6ec9707e3cd5832653922c4c3c53
SHA51245a8f22000da7fdb29bb3b377ad5f4ce6386935e6eb6857e618ba5a61f4f551f18db9eda0f1f2158191d81d1c1a8b46a77327cd1a449d0dfdf6df1f2eeb9d612
-
Filesize
66KB
MD52d274bfef5c4d933ca6f691b69749aa4
SHA199227aa76cd992921682e6f25e3712ee407027ee
SHA2569e33d7383a6b7a1c2e8992db882038458f3d1cd43905ea56d5ecfca2c679aabb
SHA5120d912a159b346e9952fa5f35fb028862a27256f32b119458e0c074840d0ac4be801eedb4dfdf55d9bfef9d93193a9294b3d8e56cda5cae8a23fa9263b5a70f83
-
Filesize
66KB
MD5393982efe00f00cd30e84d3b79e55c9d
SHA11ec9f851e917645bb000d5e37509cc9a52b2552a
SHA256cca6326cc5de65596fa49a48558f5f43c830aae4f69d6b9c199ed33af2aed975
SHA51221f8a053e5c736af3c376a5caa6ca3fe6ab540454debdbeeb2fcfab3c1daffb4718e082fe7ab7cbd7db6beeab072c84adbcada41bbadb3b33821ce4620cff3e1
-
Filesize
66KB
MD53561adf64a3c65732dae27a5c077f422
SHA1d9682b38d9d856a48c51030df1eafb8bd767c21a
SHA256ccddfabe16a057211f8e7eebebe8e46dbfb1c94cd42782f95c432662465e44ba
SHA5125e6d24ae6c247c64d7b9c775cf136bdd6b9f981a592c30238e34b05beea468bc14d4fd23867bf281bc6191d2df4cf8df26d19190daadf103d53de0f0a1661155
-
Filesize
66KB
MD5bea8c6a5b19a93ad9a8f6deab6d20c71
SHA1aff827e63b95d0f0d57736035ba8d15f07d939b5
SHA256bcae7bd70c9ad95e8823b44bae05a6580347bcc2b3cd54944bcfb28313b39f35
SHA5124ede8959c8d68aa38c8bcd1a9a3b29144958db1e3e5d7695c373b8782d1151f9b41202099a8965ea48b059dfc084b5a4d5c8b516de81834b2ad6060cc8d8fe7a
-
Filesize
66KB
MD58a3609d2287f5b3ecc4b4832514a8efb
SHA167f5cc00c547262c4ba0915e772499fd1439ae92
SHA256efe8553ed2474c316744cfbfc3cff6abc34a99c0851a1aa663f46228357517dd
SHA512b4dcc67e4657c3b34cc4c4c874d636b3f667aec59e98444117431aaf5f7e22c6469a5a5b80301b86d64db8f95076e378925c169087bfcecde5a428bf8e7f69fb
-
Filesize
66KB
MD5036d20a63038fd7abb766c700a8e30cd
SHA18800503526366e311fe64d50164d73a4cfd84b75
SHA256f07e045c5c33e04c7d4442ab9565402b4d3ecbf47c67fd4926e165c066993f41
SHA51288e18f5f6e9f06a474cec8ca3eadb700b590b4575709f90282fd4e1ceef59371a67bd93a859565086031e4bfdfa4ede6af96c7dd59fb29456a293f548990cdcf
-
Filesize
66KB
MD5abb7a45184a3c4d3c4390b2e30752a8d
SHA10ee5438286d2ffbf72b0be08aa5385399e98c84f
SHA256b030a10ec553410d5304c4601ef9d7594311cac81bd1c3cb0a770524561aea44
SHA512fd94c04fff758f03ad2432578ecbfcf88adaaf2158196d80d6ffdcdafa70a4f33ecdedcb03235c5f3e97f4d23243f3f9271ff77498b334cb0ad8e5e817a2a681
-
Filesize
66KB
MD5e8b6b55846bd51a242c5ade81d79a542
SHA1e003b9bceb29393c5f0537745eb0461ab84330a2
SHA2561c9d1c136241e32e18da2a36c5fa783d34cff79b37530644008d0838886b283a
SHA512e64a43f608cea500d19f090b02adfdfd18ad05209003e1f5db54bc8e55063acfab50fae472c5a9985899424e1c17febb45cebbd20a765f4e7b7f39eaff93820e
-
Filesize
66KB
MD5720d01a59e48afe23d1c8e7cd9eefae5
SHA1b7f3fddfe1b1df32b16612a577a3e04913912203
SHA256a0930bfa4aa6f1428c55b0f865c23ec454c2b70753d2348063af3483d8d77861
SHA5120126ee0c90863a412619b0499f756be424d3b013f55605df5bcda443e8e227bc29351f3cf566ff0ba0376bd233f7d9bb2c27d7a9578bfac7ee18ff9a906ff755
-
Filesize
66KB
MD5fd9df0029cd3a6251c984ea94a10e7a8
SHA1680817836f6ec70dae7c79c3afca0dd86f1a16fc
SHA256ab84f78cae2c8323369d377e8b0d5e27e327e2d28542b8cfba384ab6bcd23017
SHA51210a58cef012f6620e3da449a924f8666368054edb6c868b69d011ce21b273a9bc489e8dd2924ca4524ec7d725cd43d3946c754eba43013be064681719467e511
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
408KB
-
Filesize
584KB
-
Filesize
472KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
120KB
-
Filesize
320KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
72KB
-
Filesize
6.1MB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
1.0MB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
392KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
328KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
64KB