Analysis
-
max time kernel
146s -
max time network
126s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
23-03-2023 17:22
Static task
static1
General
-
Target
f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe
-
Size
311KB
-
MD5
5938a091b9b7503c9a4b3c237565da02
-
SHA1
bd70ccc581acb0c9fbecfc27b1ccd7f926f60fea
-
SHA256
f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb
-
SHA512
70e81b32465076270895aae580d13c5ce5e2d67e547540c9f2598abaa5828c6ffbd1b24f235c9d5acbfe8c95448482318cae5cdbba9d2ee5fbbd69446e5b66e1
-
SSDEEP
6144:PU8YL7eh6phN+srdtWSQDJlJsBRTNb2mXtazncyELT4gZ9qluUn0:88Yneh6lrHWSCl2HTNbHXQcyeQ
Malware Config
Extracted
redline
dozk
91.215.85.15:25916
-
auth_value
9f1dc4ff242fb8b53742acae0ef96143
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
Processes:
resource yara_rule behavioral1/memory/2116-136-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-137-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-139-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-141-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-143-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-145-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-147-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-149-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-153-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-156-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-158-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-160-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-162-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-164-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-166-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-168-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-170-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-172-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-174-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-176-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-178-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-180-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-182-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-184-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-186-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-188-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-190-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-192-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-194-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-196-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-198-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-200-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline behavioral1/memory/2116-202-0x0000000004E70000-0x0000000004EC2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1364 2116 WerFault.exe f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exepid process 2116 f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe 2116 f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exedescription pid process Token: SeDebugPrivilege 2116 f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe"C:\Users\Admin\AppData\Local\Temp\f874dfa86bf86a9bc53e3e05af6280cf02c10f342805b0c298e73d0a18ba73cb.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2116 -s 12202⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 472 -p 2116 -ip 21161⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2116-134-0x0000000002440000-0x00000000024A2000-memory.dmpFilesize
392KB
-
memory/2116-135-0x0000000004F80000-0x0000000005524000-memory.dmpFilesize
5.6MB
-
memory/2116-136-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-137-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-139-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-141-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-143-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-145-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-147-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-149-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-150-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2116-153-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-154-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2116-152-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2116-156-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-158-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-160-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-162-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-164-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-166-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-168-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-170-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-172-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-174-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-176-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-178-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-180-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-182-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-184-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-186-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-188-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-190-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-192-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-194-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-196-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-198-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-200-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-202-0x0000000004E70000-0x0000000004EC2000-memory.dmpFilesize
328KB
-
memory/2116-929-0x0000000005530000-0x0000000005B48000-memory.dmpFilesize
6.1MB
-
memory/2116-930-0x0000000004F50000-0x0000000004F62000-memory.dmpFilesize
72KB
-
memory/2116-931-0x0000000005B50000-0x0000000005C5A000-memory.dmpFilesize
1.0MB
-
memory/2116-932-0x0000000005C60000-0x0000000005C9C000-memory.dmpFilesize
240KB
-
memory/2116-933-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2116-934-0x0000000005F70000-0x0000000005FD6000-memory.dmpFilesize
408KB
-
memory/2116-935-0x0000000006640000-0x00000000066D2000-memory.dmpFilesize
584KB
-
memory/2116-936-0x00000000066F0000-0x0000000006766000-memory.dmpFilesize
472KB
-
memory/2116-937-0x00000000067B0000-0x00000000067CE000-memory.dmpFilesize
120KB
-
memory/2116-938-0x0000000006AA0000-0x0000000006C62000-memory.dmpFilesize
1.8MB
-
memory/2116-939-0x0000000006C90000-0x00000000071BC000-memory.dmpFilesize
5.2MB
-
memory/2116-941-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2116-942-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB
-
memory/2116-943-0x0000000004F70000-0x0000000004F80000-memory.dmpFilesize
64KB