Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
26-07-2023 17:42
Static task
static1
Behavioral task
behavioral1
Sample
tmp.exe
Resource
win7-20230712-en
General
-
Target
tmp.exe
-
Size
443KB
-
MD5
79910d840d3c62dc8df6fecf3f59b6a2
-
SHA1
244fd7431a26dcf6758adadd6973357ac35fd9c2
-
SHA256
136214e8c6ed831286ca46aeeb90e2309a71882e57d7ad85add5ebb2d050d60a
-
SHA512
97ba9199096705bda7d9d54595dcee459223ff0f9c186e2d3038782643c089e30290fcccc08122d4fcc032827ffc8e168f80e42d88bf74bedea042d82825f670
-
SSDEEP
6144:t3FeLg5jxYN/OBuqCWEYs9BBoPqPXZuzbPrKBJ+nz0ymJv1jjv+HT:NFek5jaN/MHuBGyPpuzXKXY0y2Jjmz
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 3 IoCs
Processes:
resource yara_rule behavioral1/memory/2180-60-0x0000000003D30000-0x0000000003D5C000-memory.dmp family_redline behavioral1/memory/2180-61-0x00000000069D0000-0x0000000006A10000-memory.dmp family_redline behavioral1/memory/2180-62-0x0000000004140000-0x0000000004168000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
tmp.exepid process 2180 tmp.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
tmp.exedescription pid process Token: SeDebugPrivilege 2180 tmp.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2180-55-0x00000000024D0000-0x00000000025D0000-memory.dmpFilesize
1024KB
-
memory/2180-56-0x00000000002C0000-0x00000000002FD000-memory.dmpFilesize
244KB
-
memory/2180-57-0x0000000000400000-0x0000000002440000-memory.dmpFilesize
32.2MB
-
memory/2180-58-0x0000000073DF0000-0x00000000744DE000-memory.dmpFilesize
6.9MB
-
memory/2180-59-0x00000000069D0000-0x0000000006A10000-memory.dmpFilesize
256KB
-
memory/2180-60-0x0000000003D30000-0x0000000003D5C000-memory.dmpFilesize
176KB
-
memory/2180-61-0x00000000069D0000-0x0000000006A10000-memory.dmpFilesize
256KB
-
memory/2180-62-0x0000000004140000-0x0000000004168000-memory.dmpFilesize
160KB
-
memory/2180-63-0x00000000024D0000-0x00000000025D0000-memory.dmpFilesize
1024KB
-
memory/2180-64-0x00000000069D0000-0x0000000006A10000-memory.dmpFilesize
256KB
-
memory/2180-65-0x0000000000400000-0x0000000002440000-memory.dmpFilesize
32.2MB
-
memory/2180-66-0x00000000002C0000-0x00000000002FD000-memory.dmpFilesize
244KB
-
memory/2180-67-0x0000000073DF0000-0x00000000744DE000-memory.dmpFilesize
6.9MB
-
memory/2180-68-0x00000000069D0000-0x0000000006A10000-memory.dmpFilesize
256KB
-
memory/2180-71-0x0000000000400000-0x0000000002440000-memory.dmpFilesize
32.2MB
-
memory/2180-72-0x0000000073DF0000-0x00000000744DE000-memory.dmpFilesize
6.9MB
-
memory/2180-73-0x00000000024D0000-0x00000000025D0000-memory.dmpFilesize
1024KB