Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
28-03-2023 00:15
General
-
Target
ku920385.exe
-
Size
366KB
-
MD5
1db7ddeeb37c9274f031263ad2022274
-
SHA1
44377ce985b07caca113b40013179d5ff1ef0daf
-
SHA256
7217e9e99079181fe3cf9464c7b36eb247b4ea22d07c0564a93aa4573c787a61
-
SHA512
72f723dd4a3e54cfc7e48d2370d4d53501fc32aec70b79d8875ed5f75a990647bc38620c52fbad2976b997214a833ad734309a47c636a4b19a8c622012dcc47d
-
SSDEEP
6144:47YgurjtL2SM3AE67+c5mTCNuhG6aCQs6xv8Icv:YCrjti13B0AnhbNQs6SIc
Score
10/10
Malware Config
Extracted
Family
redline
Botnet
rosn
C2
176.113.115.145:4125
Attributes
-
auth_value
050a19e1db4d0024b0f23b37dcf961f4
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 36 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ku920385.exe"C:\Users\Admin\AppData\Local\Temp\ku920385.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2024-55-0x0000000002470000-0x00000000024B6000-memory.dmpFilesize
280KB
-
memory/2024-56-0x00000000025C0000-0x0000000002604000-memory.dmpFilesize
272KB
-
memory/2024-57-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-58-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-60-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-62-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-64-0x0000000000220000-0x000000000026B000-memory.dmpFilesize
300KB
-
memory/2024-65-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-66-0x0000000004CB0000-0x0000000004CF0000-memory.dmpFilesize
256KB
-
memory/2024-68-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-70-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-72-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-74-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-76-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-78-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-80-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-84-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-82-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-86-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-90-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-88-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-92-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-96-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-94-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-100-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-98-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-104-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-102-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-106-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-108-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-110-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-114-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-112-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-116-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-120-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-118-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-122-0x00000000025C0000-0x00000000025FF000-memory.dmpFilesize
252KB
-
memory/2024-965-0x0000000004CB0000-0x0000000004CF0000-memory.dmpFilesize
256KB