Analysis
-
max time kernel
77s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
27-03-2023 18:55
Static task
static1
General
-
Target
60b551b59f5d0c545343a2e0505c7af90b213aa048773bc08cdefa1b05ed3063.exe
-
Size
361KB
-
MD5
446ba2accfb4e4a00ee05aba6ccaa121
-
SHA1
85e277c01e372cb70f27cd4ce21b8ab1f2c5bd6f
-
SHA256
60b551b59f5d0c545343a2e0505c7af90b213aa048773bc08cdefa1b05ed3063
-
SHA512
7c4401beddc117751828e5c62ecc14e18f374885ac51f7a97141c3f6eb474ef6145342ede9357a641b4689203866974deab6a9e71a23a692763f081bb64e2174
-
SSDEEP
6144:6lay6ONLUoC0YL2ERDNKu5u3Vy1mLdPfdjRnScrO:U1NwoC7LnDZJqdPJBm
Malware Config
Extracted
redline
@Germany
185.11.61.125:22344
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 33 IoCs
resource yara_rule behavioral1/memory/3228-136-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-137-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-139-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-141-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-143-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-146-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-150-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-152-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-154-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-156-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-158-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-160-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-162-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-164-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-166-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-168-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-170-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-172-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-174-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-176-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-178-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-180-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-182-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-184-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-186-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-188-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-190-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-192-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-194-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-196-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-198-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-200-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline behavioral1/memory/3228-202-0x0000000004D60000-0x0000000004DB2000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 3228 60b551b59f5d0c545343a2e0505c7af90b213aa048773bc08cdefa1b05ed3063.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3228 60b551b59f5d0c545343a2e0505c7af90b213aa048773bc08cdefa1b05ed3063.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60b551b59f5d0c545343a2e0505c7af90b213aa048773bc08cdefa1b05ed3063.exe"C:\Users\Admin\AppData\Local\Temp\60b551b59f5d0c545343a2e0505c7af90b213aa048773bc08cdefa1b05ed3063.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3228