Analysis
-
max time kernel
77s -
max time network
142s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 16:55
Static task
static1
General
-
Target
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe
-
Size
311KB
-
MD5
2188d35bad9aef1a71accb133d45c34e
-
SHA1
612f802ef7aa3170ccc6853b38aa57dc243a1e48
-
SHA256
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7
-
SHA512
73bb9ae94ad9bcfd96bf0ca686a780f3d696904aa687414ce5619968656d90ae1b31a1d21a46b337a8f219f565b2831bc91decc20b57e2a53b2c830a76449872
-
SSDEEP
6144:d+8rLSM2xP7Z3wYo6OttfZI8FId2QWtHL2e3ALjBJeTcoD:I8rOM2xP7Z3DoXtRa8MpWFiewLN
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 34 IoCs
Processes:
resource yara_rule behavioral1/memory/1008-136-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-137-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-139-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-142-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-145-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-147-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-149-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-151-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-153-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-155-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-157-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-159-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-161-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-163-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-165-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-167-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-169-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-171-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-173-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-175-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-177-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-179-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-181-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-183-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-185-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-187-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-189-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-191-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-193-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-195-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-197-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-199-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-201-0x00000000028F0000-0x0000000002942000-memory.dmp family_redline behavioral1/memory/1008-942-0x0000000005040000-0x0000000005050000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 5044 1008 WerFault.exe 5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exepid process 1008 5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe 1008 5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exedescription pid process Token: SeDebugPrivilege 1008 5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe"C:\Users\Admin\AppData\Local\Temp\5bd9e5e34af2e8e5b50fa87b1611338636ce5bf4bbacc6b5b5638cfba0be33a7.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1008 -s 19642⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 476 -p 1008 -ip 10081⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1008-134-0x00000000024B0000-0x0000000002512000-memory.dmpFilesize
392KB
-
memory/1008-135-0x0000000005050000-0x00000000055F4000-memory.dmpFilesize
5.6MB
-
memory/1008-136-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-137-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-139-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-142-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-141-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1008-144-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1008-145-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-147-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-149-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-151-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-153-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-155-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-157-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-159-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-161-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-163-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-165-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-167-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-169-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-171-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-173-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-175-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-177-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-179-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-181-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-183-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-185-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-187-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-189-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-191-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-193-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-195-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-197-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-199-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-201-0x00000000028F0000-0x0000000002942000-memory.dmpFilesize
328KB
-
memory/1008-928-0x0000000005600000-0x0000000005C18000-memory.dmpFilesize
6.1MB
-
memory/1008-929-0x0000000004F50000-0x0000000004F62000-memory.dmpFilesize
72KB
-
memory/1008-930-0x0000000005C20000-0x0000000005D2A000-memory.dmpFilesize
1.0MB
-
memory/1008-931-0x0000000004F70000-0x0000000004FAC000-memory.dmpFilesize
240KB
-
memory/1008-932-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1008-933-0x0000000005F70000-0x0000000005FD6000-memory.dmpFilesize
408KB
-
memory/1008-934-0x0000000006780000-0x0000000006812000-memory.dmpFilesize
584KB
-
memory/1008-935-0x0000000006830000-0x00000000068A6000-memory.dmpFilesize
472KB
-
memory/1008-936-0x0000000006910000-0x0000000006AD2000-memory.dmpFilesize
1.8MB
-
memory/1008-937-0x0000000006AF0000-0x000000000701C000-memory.dmpFilesize
5.2MB
-
memory/1008-938-0x0000000007130000-0x000000000714E000-memory.dmpFilesize
120KB
-
memory/1008-941-0x00000000024B0000-0x0000000002512000-memory.dmpFilesize
392KB
-
memory/1008-942-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB
-
memory/1008-943-0x0000000005040000-0x0000000005050000-memory.dmpFilesize
64KB