Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
12/03/2023, 13:42
General
-
Target
0x0006000000015c2b-133.exe
-
Size
175KB
-
MD5
9796505f0e48281006d920d7c01dfe7b
-
SHA1
409d6a3760f682cc6e10c4f63e16755081d1342e
-
SHA256
acf7be67bc04fc3b5f30c386ad0425b3fdbd7350dee6f7ab8b200b2bd9509479
-
SHA512
c0ab3a9eb70564d04500a0e53e429925afdf0268e015ec1ec515ed2e7c9416273be51c9f86cbf99fa1a5ccd6e6f6f5a62fadc6e256fd7a53295295e4008f5d72
-
SSDEEP
3072:pxqZWJBaKULo3YteF5Fih7/xNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuw+cax:bqZIYGih
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
vina
C2
193.233.20.28:4125
Attributes
-
auth_value
7e90e85c9cea0965a2bfd23e1cfc6bc8
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x0006000000015c2b-133.exe"C:\Users\Admin\AppData\Local\Temp\0x0006000000015c2b-133.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
200KB
-
Filesize
256KB