Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
06-06-2023 11:37
Behavioral task
behavioral1
Sample
06009399.exe
Resource
win7-20230220-en
General
-
Target
06009399.exe
-
Size
172KB
-
MD5
23f206b50f60690a383ce7a0f51556ea
-
SHA1
27935a3a0f8eab965d69303c4301afaf7883cf05
-
SHA256
e8ccfd769c0767b0b990515cd118bb79c6b604ff5b17363aeb0aa4461b5fcc0f
-
SHA512
4cf99256bb08873be8329d5dcd3ca3950d708f64b3f69ae58562c70e6b217e561afc0ff4e1f74db99cfed4cc06caed90354f94c1b8edf2a7935d931b7dfeb046
-
SSDEEP
3072:QBF8QOIKbe97H9rWRxNB2NjrOSHy+8e8hg:q8MVdaHMOSHy+
Malware Config
Extracted
redline
maxi
83.97.73.126:19048
-
auth_value
6a3f22e5f4209b056a3fd330dc71956a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 23 IoCs
Processes:
06009399.exepid process 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe 3672 06009399.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
06009399.exedescription pid process Token: SeDebugPrivilege 3672 06009399.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3672-133-0x0000000000430000-0x0000000000460000-memory.dmpFilesize
192KB
-
memory/3672-134-0x000000000A8B0000-0x000000000AEC8000-memory.dmpFilesize
6.1MB
-
memory/3672-135-0x000000000A3A0000-0x000000000A4AA000-memory.dmpFilesize
1.0MB
-
memory/3672-136-0x000000000A2E0000-0x000000000A2F2000-memory.dmpFilesize
72KB
-
memory/3672-137-0x000000000A340000-0x000000000A37C000-memory.dmpFilesize
240KB
-
memory/3672-138-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3672-139-0x000000000A650000-0x000000000A6C6000-memory.dmpFilesize
472KB
-
memory/3672-140-0x000000000A770000-0x000000000A802000-memory.dmpFilesize
584KB
-
memory/3672-141-0x000000000B480000-0x000000000BA24000-memory.dmpFilesize
5.6MB
-
memory/3672-142-0x000000000A810000-0x000000000A876000-memory.dmpFilesize
408KB
-
memory/3672-143-0x000000000BC20000-0x000000000BDE2000-memory.dmpFilesize
1.8MB
-
memory/3672-144-0x000000000C320000-0x000000000C84C000-memory.dmpFilesize
5.2MB
-
memory/3672-145-0x0000000004E00000-0x0000000004E10000-memory.dmpFilesize
64KB
-
memory/3672-146-0x000000000B430000-0x000000000B480000-memory.dmpFilesize
320KB