Analysis

  • max time kernel
    91s
  • max time network
    142s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20230220-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28-03-2023 11:22

General

  • Target

    9e626d06441e87a2ffab2cea65f9045b9c79b46283191c9a952b2003d24830f8.exe

  • Size

    175KB

  • MD5

    39a69fbac75d44b18ce687df5317d8ab

  • SHA1

    2a9db16e727e75bf606a0f67e5fa265e2fa7b305

  • SHA256

    9e626d06441e87a2ffab2cea65f9045b9c79b46283191c9a952b2003d24830f8

  • SHA512

    d7e59a39f3570699cbe26701bbec468012b8c3f1594da8168391df8659155294353784dd7c45b2f4f43394fce9283a3faed8616797d1cd5438f4b8513af8d7a9

  • SSDEEP

    3072:jxqZWRZaPkOQ3TjmTseesFqh+XxNn2pU9f2MKTV/wi4lr55R9TxlnsPsUw0jOuwh:1qZoTjalqh

Malware Config

Extracted

Family

redline

Botnet

renta

C2

176.113.115.145:4125

Attributes
  • auth_value

    359596fd5b36e9925ade4d9a1846bafb

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\9e626d06441e87a2ffab2cea65f9045b9c79b46283191c9a952b2003d24830f8.exe
    "C:\Users\Admin\AppData\Local\Temp\9e626d06441e87a2ffab2cea65f9045b9c79b46283191c9a952b2003d24830f8.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:544

Network

MITRE ATT&CK Matrix ATT&CK v6

Credential Access

Credentials in Files

2
T1081

Discovery

Query Registry

1
T1012

Collection

Data from Local System

2
T1005

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/544-133-0x00000000005E0000-0x0000000000612000-memory.dmp
    Filesize

    200KB

  • memory/544-134-0x0000000005500000-0x0000000005B18000-memory.dmp
    Filesize

    6.1MB

  • memory/544-135-0x0000000005080000-0x000000000518A000-memory.dmp
    Filesize

    1.0MB

  • memory/544-136-0x0000000004FB0000-0x0000000004FC2000-memory.dmp
    Filesize

    72KB

  • memory/544-137-0x0000000005010000-0x000000000504C000-memory.dmp
    Filesize

    240KB

  • memory/544-138-0x0000000005300000-0x0000000005310000-memory.dmp
    Filesize

    64KB

  • memory/544-139-0x0000000005380000-0x00000000053E6000-memory.dmp
    Filesize

    408KB

  • memory/544-140-0x00000000063E0000-0x0000000006984000-memory.dmp
    Filesize

    5.6MB

  • memory/544-141-0x0000000005F10000-0x0000000005FA2000-memory.dmp
    Filesize

    584KB

  • memory/544-142-0x0000000005300000-0x0000000005310000-memory.dmp
    Filesize

    64KB

  • memory/544-143-0x0000000006990000-0x0000000006B52000-memory.dmp
    Filesize

    1.8MB

  • memory/544-144-0x0000000007090000-0x00000000075BC000-memory.dmp
    Filesize

    5.2MB

  • memory/544-145-0x0000000006300000-0x0000000006376000-memory.dmp
    Filesize

    472KB

  • memory/544-146-0x0000000006380000-0x00000000063D0000-memory.dmp
    Filesize

    320KB