Analysis
-
max time kernel
127s -
max time network
130s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 14:08
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20230621-en
General
-
Target
file.exe
-
Size
388KB
-
MD5
b435f4fa4b02f5e0686c0a82b0033354
-
SHA1
472ea52b01e0ba97f46cf97521f32a563395a744
-
SHA256
ea52680e80eb9e200c61abd755587ec2fd5ed477e8093dbcd8d75200be09ac0d
-
SHA512
ba2e2014f472a86266c9809a0252af4c8101f30c5f320445351502039958f8f37aa4166a1d38046f8bc7c161ca18220b8fe52810c45faa36ad3ab9694e33eb27
-
SSDEEP
12288:wztKe0jWeeIO5Ghgmc0D57ABb0wTH1b/rbOxzrnb2OA8efJUZmM:wkeeex3A6M
Malware Config
Extracted
redline
furga
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
file.exepid process 3936 file.exe 3936 file.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
file.exedescription pid process Token: SeDebugPrivilege 3936 file.exe
Processes
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3936-133-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/3936-137-0x000000000A660000-0x000000000AC78000-memory.dmpFilesize
6.1MB
-
memory/3936-138-0x000000000A040000-0x000000000A14A000-memory.dmpFilesize
1.0MB
-
memory/3936-139-0x000000000A150000-0x000000000A162000-memory.dmpFilesize
72KB
-
memory/3936-140-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3936-141-0x000000000A170000-0x000000000A1AC000-memory.dmpFilesize
240KB
-
memory/3936-142-0x000000000A450000-0x000000000A4C6000-memory.dmpFilesize
472KB
-
memory/3936-143-0x000000000A4D0000-0x000000000A562000-memory.dmpFilesize
584KB
-
memory/3936-144-0x000000000AC80000-0x000000000B224000-memory.dmpFilesize
5.6MB
-
memory/3936-145-0x000000000A5D0000-0x000000000A636000-memory.dmpFilesize
408KB
-
memory/3936-146-0x000000000B640000-0x000000000B690000-memory.dmpFilesize
320KB
-
memory/3936-147-0x0000000004BB0000-0x0000000004BC0000-memory.dmpFilesize
64KB
-
memory/3936-148-0x000000000B800000-0x000000000B9C2000-memory.dmpFilesize
1.8MB
-
memory/3936-149-0x000000000B9D0000-0x000000000BEFC000-memory.dmpFilesize
5.2MB