Analysis
-
max time kernel
30s -
max time network
34s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
10/05/2023, 20:36
General
-
Target
0x000400000001fca6-183.exe
-
Size
168KB
-
MD5
b5bb62a0bccc899dd14bbd8592654e65
-
SHA1
92f402078fe2f1407572171ddd6e20b0c3c43b58
-
SHA256
59682f651afc24ece0f44d456db1ebc0d1457c89256e00c0cac9939241d1e66b
-
SHA512
29356966ee5c26580ad27daf90fbfac9a1a61c93149bc31295c1395e4a1cf0951a6dbc7a2359a996fa51d32ccd95fff8de8609c2930c9da7577c915645e5654b
-
SSDEEP
1536:/X+zuWWqhVZCGWuiaPcu8W6dDUcf3C8AOTGqVYhWbuVn3N0+Q784wYkI8e8hv:PGznR8WCDJ3t4qVYA43S+Q7t8e8hv
Malware Config
Extracted
redline
lider
217.196.96.102:4132
-
auth_value
86fd821be73f28dc4769ad612e92a599
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\0x000400000001fca6-183.exe"C:\Users\Admin\AppData\Local\Temp\0x000400000001fca6-183.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
184KB
-
Filesize
24KB
-
Filesize
256KB