Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
-
submitted
09/06/2023, 07:03
General
-
Target
4c7c7f9e5fb5f706972574aca7a21260.exe
-
Size
172KB
-
MD5
4c7c7f9e5fb5f706972574aca7a21260
-
SHA1
b2ae468be5e527db0a858bbe6b7f968479010975
-
SHA256
ca71816212ad21bb4e27bacdf9fd226acc1c9dbab6614e459b24212338f884dc
-
SHA512
c4b4efc56168570b4b51eaab1db722f7a782c1db845a907d78b16c14575177dc3c8a6247112ffe3d18b366f03a19fb477c01a5cadde65250c846515bcb9ca38f
-
SSDEEP
1536:nF4TOrrH036sv0W7TNmNDrHS/VCN6eepZJk2ze9l/yx4xNx/YQ/7buLJoTIH0GkO:F4TOrLGYo/AK4xNymISIHH8e8hg
Malware Config
Extracted
redline
Obfusc ADS
70.36.101.185:17081
-
auth_value
f849ae7b1849beadfbe67dc2626be5d0
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4c7c7f9e5fb5f706972574aca7a21260.exe"C:\Users\Admin\AppData\Local\Temp\4c7c7f9e5fb5f706972574aca7a21260.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
192KB
-
Filesize
6.1MB
-
Filesize
1.0MB
-
Filesize
72KB
-
Filesize
240KB
-
Filesize
64KB
-
Filesize
472KB
-
Filesize
584KB
-
Filesize
408KB
-
Filesize
5.6MB
-
Filesize
64KB
-
Filesize
1.8MB
-
Filesize
5.2MB
-
Filesize
320KB