Analysis
-
max time kernel
23s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
-
submitted
11/05/2023, 18:38
General
-
Target
a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe
-
Size
411KB
-
MD5
2bfe72f3bd5b7848d3ca61bad997a3de
-
SHA1
d8fcab3490d957cc9fc9057575dfe0ea6f1574d6
-
SHA256
a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444
-
SHA512
19e3a5e9acdc6edb4167e00f54035e6d36ce32fff0d9cee535667df9fdf8449779f214ca0cee438d7046ec6fd500ecaed51fae813d15bff87a16ddc3f4ce1803
-
SSDEEP
6144:K5DLzs7DpO4NIS5bCwEU74DMCJQiMZrMHkr4Qhw:KV/s7DcIIS5uy7qMhiMZMHA4
Score
10/10
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe"C:\Users\Admin\AppData\Local\Temp\a03c6858f0949259b33b700dd65f175bf05857b74a3fec668a183125cd2a8444.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
248KB
-
Filesize
184KB
-
Filesize
256KB
-
Filesize
256KB
-
Filesize
176KB
-
Filesize
31.5MB