Overview

overview

10

Static

static

1

4a4ce0c49c...79.exe

windows7-x64

10

4a4ce0c49c...79.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    85s
  • max time network
    146s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230221-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 07:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    4a4ce0c49cde961bfb85b16d06942079.exe

  • Size

    362KB

  • MD5

    4a4ce0c49cde961bfb85b16d06942079

  • SHA1

    f40cfc70230dd2e053d9a74d60e4755bad1c9376

  • SHA256

    2e2cb229a73556caa2963dd5f240d914313aad441a1f586ad1de4d533644228f

  • SHA512

    b0a6859fbe78877f2e11c1b38e62d9bf41f1cf46c31f3081f9e89bee505d82e657e51241414975c9bf4d0d9dca6c65fa4a5ad6f731dd2c65de794949d5ab0d22

  • SSDEEP

    6144:DfGEqhgT/L0c9aQSv0vDsMGNX1XZ8q5HYDEvpTMMBGc:zw+T/YzQBDFGKqKo1c

Score
10/10
redlineroberdiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

ROBER

C2

138.201.195.134:15564

Attributes
  • auth_value

    de311ede2b43457816afc0d9989c5255

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 33 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\4a4ce0c49cde961bfb85b16d06942079.exe
    "C:\Users\Admin\AppData\Local\Temp\4a4ce0c49cde961bfb85b16d06942079.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4124
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 4124 -s 1812
      2⤵
      • Program crash
      PID:4208
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 452 -p 4124 -ip 4124
    1⤵
      PID:1720

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Privilege Escalation

    Defense Evasion

    Credential Access

    Credentials in Files

    1
    T1081

    Discovery

    Query Registry

    1
    T1012

    Lateral Movement

    Collection

    Data from Local System

    1
    T1005

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/4124-134-0x0000000004E80000-0x0000000005424000-memory.dmp
      Filesize

      5.6MB

      Download
    • memory/4124-135-0x0000000000860000-0x00000000008C2000-memory.dmp
      Filesize

      392KB

      Download
    • memory/4124-136-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4124-137-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4124-138-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4124-140-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-139-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-142-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-144-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-146-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-148-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-150-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-152-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-154-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-156-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-158-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-160-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-162-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-164-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-166-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-168-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-170-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-172-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-174-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-176-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-178-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-180-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-182-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-184-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-186-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-188-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-190-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-192-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-194-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-196-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-198-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-200-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-202-0x0000000005430000-0x0000000005482000-memory.dmp
      Filesize

      328KB

      Download
    • memory/4124-929-0x0000000005490000-0x0000000005AA8000-memory.dmp
      Filesize

      6.1MB

      Download
    • memory/4124-930-0x0000000005B40000-0x0000000005B52000-memory.dmp
      Filesize

      72KB

      Download
    • memory/4124-931-0x0000000005B60000-0x0000000005C6A000-memory.dmp
      Filesize

      1.0MB

      Download
    • memory/4124-932-0x0000000005C70000-0x0000000005CAC000-memory.dmp
      Filesize

      240KB

      Download
    • memory/4124-933-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4124-934-0x0000000005F80000-0x0000000005FE6000-memory.dmp
      Filesize

      408KB

      Download
    • memory/4124-935-0x0000000006650000-0x00000000066E2000-memory.dmp
      Filesize

      584KB

      Download
    • memory/4124-936-0x0000000007480000-0x00000000074F6000-memory.dmp
      Filesize

      472KB

      Download
    • memory/4124-937-0x0000000007560000-0x0000000007722000-memory.dmp
      Filesize

      1.8MB

      Download
    • memory/4124-938-0x0000000007730000-0x0000000007C5C000-memory.dmp
      Filesize

      5.2MB

      Download
    • memory/4124-939-0x0000000007D40000-0x0000000007D5E000-memory.dmp
      Filesize

      120KB

      Download
    • memory/4124-941-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4124-942-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download
    • memory/4124-943-0x0000000004E70000-0x0000000004E80000-memory.dmp
      Filesize

      64KB

      Download