Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
28-03-2023 08:17
Behavioral task
behavioral1
Sample
0x0007000000013a0c-1062.exe
Resource
win7-20230220-en
General
-
Target
0x0007000000013a0c-1062.exe
-
Size
175KB
-
MD5
ff660499a5256c0b5d4f070e4a179150
-
SHA1
d3df324fb84aa04dbf66eab67d274f63f7516621
-
SHA256
f06753e7a5e5f16486cd8418a349b1750faa184e5a2d4b55472a238f135c5370
-
SHA512
8127fb9dd37ef972d03cbeab458a9712908b2fadd7f293cfe65a4db6f90f40dd1170c0e4a9dd9e7f58a76c671b68af52f25eaa39fb60b6daebbae26ab737938f
-
SSDEEP
3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh
Malware Config
Extracted
redline
renta
176.113.115.145:4125
-
auth_value
359596fd5b36e9925ade4d9a1846bafb
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
0x0007000000013a0c-1062.exepid process 2200 0x0007000000013a0c-1062.exe 2200 0x0007000000013a0c-1062.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
0x0007000000013a0c-1062.exedescription pid process Token: SeDebugPrivilege 2200 0x0007000000013a0c-1062.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2200-133-0x0000000000340000-0x0000000000372000-memory.dmpFilesize
200KB
-
memory/2200-134-0x00000000052A0000-0x00000000058B8000-memory.dmpFilesize
6.1MB
-
memory/2200-135-0x0000000004DC0000-0x0000000004ECA000-memory.dmpFilesize
1.0MB
-
memory/2200-136-0x0000000004D00000-0x0000000004D12000-memory.dmpFilesize
72KB
-
memory/2200-137-0x0000000004D60000-0x0000000004D9C000-memory.dmpFilesize
240KB
-
memory/2200-138-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2200-139-0x0000000005090000-0x0000000005122000-memory.dmpFilesize
584KB
-
memory/2200-140-0x0000000005E70000-0x0000000006414000-memory.dmpFilesize
5.6MB
-
memory/2200-141-0x0000000005130000-0x0000000005196000-memory.dmpFilesize
408KB
-
memory/2200-142-0x0000000005D40000-0x0000000005DB6000-memory.dmpFilesize
472KB
-
memory/2200-143-0x0000000005DC0000-0x0000000005E10000-memory.dmpFilesize
320KB
-
memory/2200-144-0x0000000004CD0000-0x0000000004CE0000-memory.dmpFilesize
64KB
-
memory/2200-145-0x00000000066F0000-0x00000000068B2000-memory.dmpFilesize
1.8MB
-
memory/2200-146-0x0000000006DF0000-0x000000000731C000-memory.dmpFilesize
5.2MB