Analysis
-
max time kernel
31s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
19-03-2023 17:46
General
-
Target
3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e.exe
-
Size
301KB
-
MD5
448da7691ae07d60272790296c33328c
-
SHA1
5678220047e78f21b5a48dd92179203455d67e7d
-
SHA256
3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e
-
SHA512
7b6addce20b4c884936810314c3d2b6786749a9eb04351e2767b7aa7d23e5dce52b1f955e7d7d9af354a2e230ac0e9c21f0adf1dfbd10e6b70d25f27676aa146
-
SSDEEP
6144:uqj+2zJgcNDah8dL6Ivyg1rskXlFNHa5CK:LFzJgGA8zxBnN65
Malware Config
Extracted
redline
mango
193.233.20.28:4125
-
auth_value
ecf79d7f5227d998a3501c972d915d23
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e.exe"C:\Users\Admin\AppData\Local\Temp\3c1769ad786efc178640a7f744e02f048707c72b27d781531f64dd16e1822e9e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
280KB
-
Filesize
272KB
-
Filesize
300KB
-
Filesize
256KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
248KB
-
Filesize
256KB