Analysis
-
max time kernel
80s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 05:31
Static task
static1
General
-
Target
f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe
-
Size
354KB
-
MD5
568e2f8f08423868ec7eb21d6006c5ab
-
SHA1
8ed9d49a2e8d261d639463858bc2edaacb7131f2
-
SHA256
f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0
-
SHA512
d8b6e7e70db4ded78cbbc93a7e78d879243ba01f3dea6eea6721920f21fe60d0ca69a53bc0a6fc96d8fdba4f5e331cc508742264491b0e348a418a7a5477dc74
-
SSDEEP
6144:KFL3ON9cDuH4yyQmGiGD13Ajmlu6gz7ASm5oQjDN5:GL3ON9XYyyQmGp13Ay86gz7aoQjDN5
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/1524-136-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-137-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-139-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-141-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-143-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-147-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-145-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-149-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-151-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-153-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-156-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-159-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-162-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-164-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-166-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-168-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-170-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-172-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-174-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-176-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-178-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-180-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-182-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-184-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-186-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-188-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-190-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-192-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-194-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-196-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-198-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-200-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline behavioral1/memory/1524-202-0x0000000007890000-0x00000000078E2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 544 1524 WerFault.exe f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exepid process 1524 f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe 1524 f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exedescription pid process Token: SeDebugPrivilege 1524 f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe"C:\Users\Admin\AppData\Local\Temp\f564ddf6b1dfef9e20cb3ecd643f68fdc4500de9518ab943c3c53fb38339d5e0.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1524 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1524 -s 17922⤵
- Program crash
PID:544
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 364 -p 1524 -ip 15241⤵PID:4640
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1524-134-0x00000000048F0000-0x0000000004952000-memory.dmpFilesize
392KB
-
memory/1524-135-0x00000000072E0000-0x0000000007884000-memory.dmpFilesize
5.6MB
-
memory/1524-136-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-137-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-139-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-141-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-143-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-147-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-145-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-149-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-151-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-153-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-156-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-159-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-158-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1524-155-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1524-160-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1524-162-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-164-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-166-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-168-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-170-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-172-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-174-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-176-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-178-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-180-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-182-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-184-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-186-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-188-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-190-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-192-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-194-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-196-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-198-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-200-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-202-0x0000000007890000-0x00000000078E2000-memory.dmpFilesize
328KB
-
memory/1524-929-0x00000000078F0000-0x0000000007F08000-memory.dmpFilesize
6.1MB
-
memory/1524-930-0x0000000007FB0000-0x0000000007FC2000-memory.dmpFilesize
72KB
-
memory/1524-931-0x0000000007FD0000-0x00000000080DA000-memory.dmpFilesize
1.0MB
-
memory/1524-932-0x00000000080E0000-0x000000000811C000-memory.dmpFilesize
240KB
-
memory/1524-933-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1524-934-0x00000000083F0000-0x0000000008456000-memory.dmpFilesize
408KB
-
memory/1524-935-0x0000000008C00000-0x0000000008C92000-memory.dmpFilesize
584KB
-
memory/1524-936-0x0000000008DB0000-0x0000000008E26000-memory.dmpFilesize
472KB
-
memory/1524-937-0x0000000008E90000-0x0000000009052000-memory.dmpFilesize
1.8MB
-
memory/1524-938-0x0000000009070000-0x000000000959C000-memory.dmpFilesize
5.2MB
-
memory/1524-939-0x00000000096B0000-0x00000000096CE000-memory.dmpFilesize
120KB
-
memory/1524-941-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1524-942-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB
-
memory/1524-943-0x0000000004C70000-0x0000000004C80000-memory.dmpFilesize
64KB