Analysis
-
max time kernel
135s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
12-06-2023 22:32
Static task
static1
Behavioral task
behavioral1
Sample
n4524297.exe
Resource
win7-20230220-en
General
-
Target
n4524297.exe
-
Size
255KB
-
MD5
5ba02be58f756c893ea27416ca4eb90d
-
SHA1
ee848cd893e07d967c849e5f8600e246f81c3fc9
-
SHA256
9e60f719f6c1ae293ad593dc093e5872bc1a7df340a54527e7a1c9186ad66712
-
SHA512
3c4670a3287531cc762ee270734a1ff967471b0dec146bcb87ddb4c0a80ee696b73ee87795c21f127d93f124972c114ec401677ec9165621c1388202503e97af
-
SSDEEP
3072:vMiBIHozcM2o5/rmRviNhLI1fbCeOYTpL6GXraZKegBc4054fxvwXZB:vMCI22OmqTMraEeFnqCZB
Malware Config
Extracted
redline
boris
83.97.73.129:19068
-
auth_value
205e4fccc0f8c7da1d56fb1da4ac5e6a
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
n4524297.exepid process 3456 n4524297.exe 3456 n4524297.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
n4524297.exedescription pid process Token: SeDebugPrivilege 3456 n4524297.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3456-133-0x00000000021D0000-0x0000000002200000-memory.dmpFilesize
192KB
-
memory/3456-137-0x0000000009FA0000-0x000000000A5B8000-memory.dmpFilesize
6.1MB
-
memory/3456-138-0x000000000A620000-0x000000000A72A000-memory.dmpFilesize
1.0MB
-
memory/3456-139-0x000000000A760000-0x000000000A772000-memory.dmpFilesize
72KB
-
memory/3456-140-0x000000000A780000-0x000000000A7BC000-memory.dmpFilesize
240KB
-
memory/3456-141-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/3456-142-0x000000000A960000-0x000000000A9D6000-memory.dmpFilesize
472KB
-
memory/3456-143-0x000000000A9E0000-0x000000000AA72000-memory.dmpFilesize
584KB
-
memory/3456-144-0x000000000AA80000-0x000000000AAE6000-memory.dmpFilesize
408KB
-
memory/3456-145-0x000000000AFD0000-0x000000000B574000-memory.dmpFilesize
5.6MB
-
memory/3456-146-0x0000000002520000-0x0000000002530000-memory.dmpFilesize
64KB
-
memory/3456-147-0x000000000B770000-0x000000000B932000-memory.dmpFilesize
1.8MB
-
memory/3456-148-0x000000000B960000-0x000000000BE8C000-memory.dmpFilesize
5.2MB
-
memory/3456-149-0x0000000002470000-0x00000000024C0000-memory.dmpFilesize
320KB