Analysis

  • max time kernel
    23s
  • max time network
    31s
  • platform
    windows7_x64
  • resource
    win7-20230220-en
  • resource tags

    arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system
  • submitted
    11/05/2023, 18:38

General

  • Target

    a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe

  • Size

    411KB

  • MD5

    2bfe72f3bd5b7848d3ca61bad997a3de

  • SHA1

    d8fcab3490d957cc9fc9057575dfe0ea6f1574d6

  • SHA256

    a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444

  • SHA512

    19e3a5e9acdc6edb4167e00f54035e6d36ce32fff0d9cee535667df9fdf8449779f214ca0cee438d7046ec6fd500ecaed51fae813d15bff87a16ddc3f4ce1803

  • SSDEEP

    6144:K5DLzs7DpO4NIS5bCwEU74DMCJQiMZrMHkr4Qhw:KV/s7DcIIS5uy7qMhiMZMHA4

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 3 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe
    "C:\Users\Admin\AppData\Local\Temp\a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:2012

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2012-55-0x00000000001B0000-0x00000000001EE000-memory.dmp

    Filesize

    248KB

  • memory/2012-56-0x0000000002550000-0x000000000257E000-memory.dmp

    Filesize

    184KB

  • memory/2012-58-0x0000000006700000-0x0000000006740000-memory.dmp

    Filesize

    256KB

  • memory/2012-57-0x0000000006700000-0x0000000006740000-memory.dmp

    Filesize

    256KB

  • memory/2012-59-0x0000000003EE0000-0x0000000003F0C000-memory.dmp

    Filesize

    176KB

  • memory/2012-60-0x0000000000400000-0x0000000002384000-memory.dmp

    Filesize

    31.5MB