Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20230220-en -
resource tags
arch:x64arch:x86image:win7-20230220-enlocale:en-usos:windows7-x64system -
submitted
06-06-2023 11:37
Behavioral task
behavioral1
Sample
06009399.exe
Resource
win7-20230220-en
General
-
Target
06009399.exe
-
Size
172KB
-
MD5
23f206b50f60690a383ce7a0f51556ea
-
SHA1
27935a3a0f8eab965d69303c4301afaf7883cf05
-
SHA256
e8ccfd769c0767b0b990515cd118bb79c6b604ff5b17363aeb0aa4461b5fcc0f
-
SHA512
4cf99256bb08873be8329d5dcd3ca3950d708f64b3f69ae58562c70e6b217e561afc0ff4e1f74db99cfed4cc06caed90354f94c1b8edf2a7935d931b7dfeb046
-
SSDEEP
3072:QBF8QOIKbe97H9rWRxNB2NjrOSHy+8e8hg:q8MVdaHMOSHy+
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 26 IoCs
Processes:
06009399.exepid process 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe 2000 06009399.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
06009399.exedescription pid process Token: SeDebugPrivilege 2000 06009399.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2000-54-0x0000000000D70000-0x0000000000DA0000-memory.dmpFilesize
192KB
-
memory/2000-55-0x0000000000470000-0x0000000000476000-memory.dmpFilesize
24KB
-
memory/2000-56-0x0000000000B70000-0x0000000000BB0000-memory.dmpFilesize
256KB
-
memory/2000-57-0x0000000000B70000-0x0000000000BB0000-memory.dmpFilesize
256KB