Analysis
-
max time kernel
81s -
max time network
105s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 23:53
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230220-en
General
-
Target
file.exe
-
Size
355KB
-
MD5
cc57c91249af3c2e1095be3c872f4a86
-
SHA1
bfb2b936a4bc57c19582b3c6071d1bad1c5767ba
-
SHA256
2649d65bd971a74b63f9cc854134599ce6f3829f4f6fc56c105ca7eceea7cf66
-
SHA512
31ea2e1bd4e7ac8b5984f401583f3138b908bf8e9ddf07bc13efd5ddd0ae9dd3f2dacdbfb0a76283696afcff8eecbccd0cdcb32dcdff099dabde3220eec061d6
-
SSDEEP
6144:N7ag2fLXK6WsaAdBLDdfMosjCdqkn0C2VIQv/h1HufmQ4D:Neg2fzK6WsaA7dfMos+4BzP
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral2/memory/2196-137-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-138-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-140-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-142-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-144-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-146-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-150-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-148-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-152-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-154-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-155-0x0000000004ED0000-0x0000000004EE0000-memory.dmp family_redline behavioral2/memory/2196-158-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-160-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-162-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-164-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-166-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-168-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-170-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-172-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-174-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-176-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-178-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-180-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-182-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-184-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-186-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-188-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-190-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-192-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-194-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-196-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-198-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-200-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline behavioral2/memory/2196-202-0x0000000005490000-0x00000000054E2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1668 2196 WerFault.exe file.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exepid process 2196 file.exe 2196 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 2196 file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2196 -s 17402⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 432 -p 2196 -ip 21961⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2196-134-0x0000000002310000-0x0000000002372000-memory.dmpFilesize
392KB
-
memory/2196-135-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/2196-136-0x0000000004EE0000-0x0000000005484000-memory.dmpFilesize
5.6MB
-
memory/2196-137-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-138-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-140-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-142-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-144-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-146-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-150-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-148-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-152-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-154-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-155-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/2196-156-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/2196-158-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-160-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-162-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-164-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-166-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-168-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-170-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-172-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-174-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-176-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-178-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-180-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-182-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-184-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-186-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-188-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-190-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-192-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-194-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-196-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-198-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-200-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-202-0x0000000005490000-0x00000000054E2000-memory.dmpFilesize
328KB
-
memory/2196-929-0x00000000054F0000-0x0000000005B08000-memory.dmpFilesize
6.1MB
-
memory/2196-930-0x0000000005B40000-0x0000000005B52000-memory.dmpFilesize
72KB
-
memory/2196-931-0x0000000005B60000-0x0000000005C6A000-memory.dmpFilesize
1.0MB
-
memory/2196-932-0x0000000005C70000-0x0000000005CAC000-memory.dmpFilesize
240KB
-
memory/2196-933-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/2196-934-0x0000000005F80000-0x0000000005FE6000-memory.dmpFilesize
408KB
-
memory/2196-935-0x0000000006750000-0x00000000067E2000-memory.dmpFilesize
584KB
-
memory/2196-936-0x0000000006800000-0x0000000006876000-memory.dmpFilesize
472KB
-
memory/2196-937-0x00000000068E0000-0x0000000006AA2000-memory.dmpFilesize
1.8MB
-
memory/2196-938-0x0000000006AC0000-0x0000000006FEC000-memory.dmpFilesize
5.2MB
-
memory/2196-939-0x0000000007100000-0x000000000711E000-memory.dmpFilesize
120KB
-
memory/2196-941-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/2196-942-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB
-
memory/2196-943-0x0000000004ED0000-0x0000000004EE0000-memory.dmpFilesize
64KB