Analysis

  • max time kernel
    99s
  • max time network
    103s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 02:33

General

  • Target

    0x0008000000013362-1036.exe

  • Size

    175KB

  • MD5

    cc6cbdda0c8e2d6161e2116e00214160

  • SHA1

    25c93b0aca1125339dc9922bcda480a04cef326c

  • SHA256

    d070c857be09bad34225cd33542f6c943351e52f1d53ca9c81bfb9cb4b697d86

  • SHA512

    acc211ec34fb60007a253ba8c0acacc8869224567e308b5700ebe72b0ae634d3b0a37e24929cf5b9b920bb463bcb272a357c29cb9a1cf686e155eb469f9357de

  • SSDEEP

    3072:4xqZWZRanU2n0/Z62eJ5evJ9ih+PxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOm:mqZg/Z6XJIih

Malware Config

Extracted

Family

redline

Botnet

from

C2

176.113.115.145:4125

Attributes
  • auth_value

    8633e283485822a4a48f0a41d5397566

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0x0008000000013362-1036.exe
    "C:\Users\Admin\AppData\Local\Temp\0x0008000000013362-1036.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4896

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4896-133-0x00000000004F0000-0x0000000000522000-memory.dmp

    Filesize

    200KB

  • memory/4896-134-0x0000000005430000-0x0000000005A48000-memory.dmp

    Filesize

    6.1MB

  • memory/4896-135-0x0000000004F70000-0x000000000507A000-memory.dmp

    Filesize

    1.0MB

  • memory/4896-136-0x0000000004EA0000-0x0000000004EB2000-memory.dmp

    Filesize

    72KB

  • memory/4896-137-0x0000000004F00000-0x0000000004F3C000-memory.dmp

    Filesize

    240KB

  • memory/4896-138-0x0000000005250000-0x0000000005260000-memory.dmp

    Filesize

    64KB

  • memory/4896-139-0x0000000005260000-0x00000000052C6000-memory.dmp

    Filesize

    408KB

  • memory/4896-140-0x0000000005DF0000-0x0000000005E82000-memory.dmp

    Filesize

    584KB

  • memory/4896-141-0x0000000006440000-0x00000000069E4000-memory.dmp

    Filesize

    5.6MB

  • memory/4896-142-0x00000000061C0000-0x0000000006236000-memory.dmp

    Filesize

    472KB

  • memory/4896-143-0x0000000006240000-0x0000000006290000-memory.dmp

    Filesize

    320KB

  • memory/4896-144-0x0000000005250000-0x0000000005260000-memory.dmp

    Filesize

    64KB

  • memory/4896-145-0x0000000007BC0000-0x0000000007D82000-memory.dmp

    Filesize

    1.8MB

  • memory/4896-146-0x00000000082C0000-0x00000000087EC000-memory.dmp

    Filesize

    5.2MB