Analysis
-
max time kernel
93s -
max time network
128s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 00:25
Behavioral task
behavioral1
Sample
0x000a000000022fab-1121.exe
Resource
win7-20230220-en
General
-
Target
0x000a000000022fab-1121.exe
-
Size
175KB
-
MD5
0d5e4c45ee0d8f38b9bef529923c62d8
-
SHA1
ae52fb0a557f6b2a0bcebca35712ed7e8f88cd38
-
SHA256
4d728d888d172a52f4525249287178b1754affe474f607f019b4957186ca6b8a
-
SHA512
4be62a90eedd0cd3dbb8ad29446909f2af188310059fe5191e0c48e3eedaec21e8b0ab0d2827ab37cc1df200f7607d566c1f02693acc3070fa6f6a3ec2388d2e
-
SSDEEP
3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih
Malware Config
Extracted
redline
from
176.113.115.145:4125
-
auth_value
8633e283485822a4a48f0a41d5397566
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0x000a000000022fab-1121.exepid process 5080 0x000a000000022fab-1121.exe 5080 0x000a000000022fab-1121.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0x000a000000022fab-1121.exedescription pid process Token: SeDebugPrivilege 5080 0x000a000000022fab-1121.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/5080-133-0x00000000000A0000-0x00000000000D2000-memory.dmpFilesize
200KB
-
memory/5080-134-0x0000000004FA0000-0x00000000055B8000-memory.dmpFilesize
6.1MB
-
memory/5080-135-0x0000000004B20000-0x0000000004C2A000-memory.dmpFilesize
1.0MB
-
memory/5080-136-0x0000000004A50000-0x0000000004A62000-memory.dmpFilesize
72KB
-
memory/5080-137-0x0000000004AE0000-0x0000000004B1C000-memory.dmpFilesize
240KB
-
memory/5080-138-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB
-
memory/5080-139-0x0000000005B70000-0x0000000006114000-memory.dmpFilesize
5.6MB
-
memory/5080-140-0x00000000055C0000-0x0000000005652000-memory.dmpFilesize
584KB
-
memory/5080-141-0x0000000004F00000-0x0000000004F66000-memory.dmpFilesize
408KB
-
memory/5080-142-0x0000000005AC0000-0x0000000005B36000-memory.dmpFilesize
472KB
-
memory/5080-143-0x0000000006120000-0x0000000006170000-memory.dmpFilesize
320KB
-
memory/5080-144-0x0000000006440000-0x0000000006602000-memory.dmpFilesize
1.8MB
-
memory/5080-145-0x0000000006B40000-0x000000000706C000-memory.dmpFilesize
5.2MB
-
memory/5080-146-0x0000000004AD0000-0x0000000004AE0000-memory.dmpFilesize
64KB