Analysis
-
max time kernel
85s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20230621-en -
resource tags
arch:x64arch:x86image:win10v2004-20230621-enlocale:en-usos:windows10-2004-x64system -
submitted
22-06-2023 16:36
Static task
static1
General
-
Target
3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exe
-
Size
269KB
-
MD5
ac83471b6bbdcfdd68c5feecd4a8a8ec
-
SHA1
7880874b62c1ffa5cd048a526de175dc0a9808b6
-
SHA256
3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f
-
SHA512
b852def5993db3eea75ccd1072f580d6c9f574c589bb85c108b980b502c82d9a1151f6a85d505ce1ec9e02881704d1c4c8867d1a1c7210e3e0ec4c1cd0b77d64
-
SSDEEP
3072:SWKNGeeQpyFEMqytKjmPH7323neb3WDEFdgYRjd1sQ2UsJHmOpE/MWR9sx4WRm6x:ReeFTXtKjgH74nhDOgYR/+tOEQJQm
Malware Config
Extracted
redline
furga
83.97.73.128:19071
-
auth_value
1b7af6db7a79a3475798fcf494818be7
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exepid process 4780 3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exe 4780 3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exedescription pid process Token: SeDebugPrivilege 4780 3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exe"C:\Users\Admin\AppData\Local\Temp\3861a62c8c2f52ee0b0d0eefdbb5b4a6c771c6942a5a9d08d7941d7582e27d4f.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4780
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4780-133-0x00000000001C0000-0x00000000001F0000-memory.dmpFilesize
192KB
-
memory/4780-137-0x000000000A630000-0x000000000AC48000-memory.dmpFilesize
6.1MB
-
memory/4780-138-0x000000000A010000-0x000000000A11A000-memory.dmpFilesize
1.0MB
-
memory/4780-139-0x000000000A140000-0x000000000A152000-memory.dmpFilesize
72KB
-
memory/4780-140-0x000000000A160000-0x000000000A19C000-memory.dmpFilesize
240KB
-
memory/4780-141-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4780-142-0x000000000A340000-0x000000000A3B6000-memory.dmpFilesize
472KB
-
memory/4780-143-0x000000000A3C0000-0x000000000A452000-memory.dmpFilesize
584KB
-
memory/4780-144-0x000000000A460000-0x000000000A4C6000-memory.dmpFilesize
408KB
-
memory/4780-145-0x000000000AFD0000-0x000000000B574000-memory.dmpFilesize
5.6MB
-
memory/4780-146-0x0000000004B80000-0x0000000004B90000-memory.dmpFilesize
64KB
-
memory/4780-147-0x000000000B7A0000-0x000000000B962000-memory.dmpFilesize
1.8MB
-
memory/4780-148-0x000000000B970000-0x000000000BE9C000-memory.dmpFilesize
5.2MB
-
memory/4780-149-0x0000000004630000-0x0000000004680000-memory.dmpFilesize
320KB