Analysis
-
max time kernel
145s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-03-2023 16:17
Static task
static1
General
-
Target
320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe
-
Size
416KB
-
MD5
f2f07085daf546011773b9e284787d9d
-
SHA1
010293fe5929bb5337d4eda379e34b20e2422afe
-
SHA256
320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6
-
SHA512
960b0c7c473a279f0d8526fd482560add99a4dbc5f5dbbf93fd782af9ff584dd5fc7f0ac6be0962bfdcf1d8a4f388ec8db8b1aeae2a29b5ff29bb110c254abb0
-
SSDEEP
6144:UFcWL9yZ8JopNDa1rorDZ+DeA9aBSriPm3x9He+rJWjUOn:UFcWRy6JsNDa10rD8ymaQr1h9zWjr
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/2420-136-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-137-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-139-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-141-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-145-0x00000000025B0000-0x00000000025C0000-memory.dmp family_redline behavioral1/memory/2420-144-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-150-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-148-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-152-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-154-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-156-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-158-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-160-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-162-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-164-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-166-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-168-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-170-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-172-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-174-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-176-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-178-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-182-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-184-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-180-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-186-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-188-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-190-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-192-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-194-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-196-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-198-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-200-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline behavioral1/memory/2420-202-0x0000000002B40000-0x0000000002B92000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1916 2420 WerFault.exe 320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exepid process 2420 320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe 2420 320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exedescription pid process Token: SeDebugPrivilege 2420 320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe"C:\Users\Admin\AppData\Local\Temp\320ae3b71228a93b5b223a19f0f4c1fa6e95471d0c47a8a892913ef81abdbde6.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2420 -s 12202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 2420 -ip 24201⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2420-134-0x00000000009D0000-0x0000000000A32000-memory.dmpFilesize
392KB
-
memory/2420-135-0x0000000004F50000-0x00000000054F4000-memory.dmpFilesize
5.6MB
-
memory/2420-136-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-137-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-139-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-141-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-145-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/2420-144-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-143-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/2420-147-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/2420-150-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-148-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-152-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-154-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-156-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-158-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-160-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-162-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-164-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-166-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-168-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-170-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-172-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-174-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-176-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-178-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-182-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-184-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-180-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-186-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-188-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-190-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-192-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-194-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-196-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-198-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-200-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-202-0x0000000002B40000-0x0000000002B92000-memory.dmpFilesize
328KB
-
memory/2420-929-0x0000000005500000-0x0000000005B18000-memory.dmpFilesize
6.1MB
-
memory/2420-930-0x0000000005B50000-0x0000000005B62000-memory.dmpFilesize
72KB
-
memory/2420-931-0x0000000005B70000-0x0000000005C7A000-memory.dmpFilesize
1.0MB
-
memory/2420-932-0x0000000005CC0000-0x0000000005CFC000-memory.dmpFilesize
240KB
-
memory/2420-933-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/2420-934-0x0000000005F90000-0x0000000005FF6000-memory.dmpFilesize
408KB
-
memory/2420-935-0x0000000006660000-0x00000000066F2000-memory.dmpFilesize
584KB
-
memory/2420-936-0x0000000006970000-0x00000000069E6000-memory.dmpFilesize
472KB
-
memory/2420-937-0x0000000006A60000-0x0000000006C22000-memory.dmpFilesize
1.8MB
-
memory/2420-938-0x0000000006C30000-0x000000000715C000-memory.dmpFilesize
5.2MB
-
memory/2420-939-0x0000000007250000-0x000000000726E000-memory.dmpFilesize
120KB
-
memory/2420-942-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/2420-943-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB
-
memory/2420-944-0x00000000025B0000-0x00000000025C0000-memory.dmpFilesize
64KB