Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-06-2023 11:36
Behavioral task
behavioral1
Sample
04808799.exe
Resource
win7-20230220-en
General
-
Target
04808799.exe
-
Size
172KB
-
MD5
571671cf890e153e1f0b0b568530bce3
-
SHA1
d4c936841eb3bfb8fb81a2f59f0d0650605aa643
-
SHA256
16ac8981175feef5c310175f874bd7bc25b6b71b1ae9d6f4e0e141118e2cd998
-
SHA512
84b064199f11d431159218c71bcbfcfc7d9a31718f3034d1cd06ff62c5be7046743ce0dcbcc961a1cde0b59c096afd18e8b7b026897fb06adbd9fcb6d0ed400d
-
SSDEEP
3072:QBF8QOIKbe97H9rWRxNB2NjrOSHy+8e8hg:q8MVdaHMOSHy+
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
04808799.exepid process 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe 1996 04808799.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
04808799.exedescription pid process Token: SeDebugPrivilege 1996 04808799.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1996-54-0x00000000008C0000-0x00000000008F0000-memory.dmpFilesize
192KB
-
memory/1996-55-0x0000000000300000-0x0000000000306000-memory.dmpFilesize
24KB
-
memory/1996-56-0x00000000043A0000-0x00000000043E0000-memory.dmpFilesize
256KB
-
memory/1996-57-0x00000000043A0000-0x00000000043E0000-memory.dmpFilesize
256KB