Analysis
-
max time kernel
135s -
max time network
144s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
25-03-2023 17:08
Static task
static1
General
-
Target
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe
-
Size
895KB
-
MD5
7f9cc3889e95b39a93593207cc823dd2
-
SHA1
553b922ae2d755e012792ab495c879f63ab3b923
-
SHA256
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5
-
SHA512
5a53fbeb23d5b407150427ac10d8a760bd493309ea88f2d82d357e439062b5cda633ce154ca9c56a1b07085bfaf51da6eb93c1e702502aad7122115ccca00951
-
SSDEEP
12288:/m6ynDHLvz37fjnf1DS03fhK6Uw7W0iRiRtuf+ro3H8o+XAKx+OtOgRv:zmtti3H8oVw+0
Malware Config
Extracted
redline
ngan003
199.115.193.116:11300
-
auth_value
b500a5cf0cb429e32a81c6ddcd8d4545
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exedescription pid process target process PID 1988 set thread context of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exepid process 4060 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe 4060 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exedescription pid process Token: SeDebugPrivilege 4060 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exedescription pid process target process PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe PID 1988 wrote to memory of 4060 1988 d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe"C:\Users\Admin\AppData\Local\Temp\d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exeC:\Users\Admin\AppData\Local\Temp\d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\d66720ec90fd4c8e65e9a28272ec291db0e7a7ce60426e219ef4623e277313f5.exe.logFilesize
1KB
MD5a3c82409506a33dec1856104ca55cbfd
SHA12e2ba4e4227590f8821002831c5410f7f45fe812
SHA256780a0d4410f5f9798cb573bcd774561d1439987a39b1368d3c890226928cd203
SHA5129621cfd3dab86d964a2bea6b3788fc19a895307962dcc41428741b8a86291f114df722e9017f755f63d53d09b5111e68f05aa505d9c9deae6c4378a87cdfa69f
-
memory/1988-133-0x0000000000A40000-0x0000000000B26000-memory.dmpFilesize
920KB
-
memory/1988-134-0x00000000059F0000-0x0000000005F94000-memory.dmpFilesize
5.6MB
-
memory/1988-135-0x0000000005520000-0x00000000055B2000-memory.dmpFilesize
584KB
-
memory/1988-136-0x00000000064D0000-0x00000000069FC000-memory.dmpFilesize
5.2MB
-
memory/1988-137-0x0000000005430000-0x0000000005440000-memory.dmpFilesize
64KB
-
memory/4060-142-0x0000000005490000-0x00000000054A2000-memory.dmpFilesize
72KB
-
memory/4060-141-0x0000000005560000-0x000000000566A000-memory.dmpFilesize
1.0MB
-
memory/4060-140-0x0000000005A30000-0x0000000006048000-memory.dmpFilesize
6.1MB
-
memory/4060-143-0x00000000054F0000-0x000000000552C000-memory.dmpFilesize
240KB
-
memory/4060-144-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/4060-145-0x00000000057E0000-0x00000000057F0000-memory.dmpFilesize
64KB
-
memory/4060-146-0x0000000005860000-0x00000000058C6000-memory.dmpFilesize
408KB
-
memory/4060-147-0x0000000006630000-0x00000000066A6000-memory.dmpFilesize
472KB
-
memory/4060-148-0x00000000065B0000-0x0000000006600000-memory.dmpFilesize
320KB
-
memory/4060-149-0x0000000007210000-0x00000000073D2000-memory.dmpFilesize
1.8MB
-
memory/4060-138-0x0000000000400000-0x0000000000432000-memory.dmpFilesize
200KB