Analysis
-
max time kernel
126s -
max time network
134s -
platform
windows10-1703_x64 -
resource
win10-20230703-en -
resource tags
arch:x64arch:x86image:win10-20230703-enlocale:en-usos:windows10-1703-x64system -
submitted
27-07-2023 07:47
Static task
static1
General
-
Target
35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exe
-
Size
411KB
-
MD5
748fa7efd71dbedc5b9b45cbd072e1ee
-
SHA1
38bebf44e29256746c87cc2e53f8231d96033628
-
SHA256
35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4
-
SHA512
958692430da667db529d374adc73b8e1f8ba7f0a74f5a71758e1e6458dcf4ddf1128828bf17db567e081300f53780e603003e210b8177c218c277bc4c1740073
-
SSDEEP
6144:zxI8Qg53ookA3WhN+tKge+OYXFFSflFM/UI9HG:lI8nVojgQMK6xVFSNycIm
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3996-125-0x0000000004360000-0x000000000438C000-memory.dmp family_redline behavioral1/memory/3996-132-0x0000000004520000-0x0000000004548000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exepid process 3996 35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exedescription pid process Token: SeDebugPrivilege 3996 35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exe"C:\Users\Admin\AppData\Local\Temp\35325c083afcddec02ece87056546394b8ede0c657c32a6ec7770fd02a42c4f4.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3996-123-0x0000000002370000-0x0000000002470000-memory.dmpFilesize
1024KB
-
memory/3996-124-0x0000000003F20000-0x0000000003F5D000-memory.dmpFilesize
244KB
-
memory/3996-125-0x0000000004360000-0x000000000438C000-memory.dmpFilesize
176KB
-
memory/3996-126-0x0000000000400000-0x000000000230E000-memory.dmpFilesize
31.1MB
-
memory/3996-127-0x0000000006A70000-0x0000000006A80000-memory.dmpFilesize
64KB
-
memory/3996-128-0x0000000006A70000-0x0000000006A80000-memory.dmpFilesize
64KB
-
memory/3996-129-0x0000000006A70000-0x0000000006A80000-memory.dmpFilesize
64KB
-
memory/3996-131-0x0000000073960000-0x000000007404E000-memory.dmpFilesize
6.9MB
-
memory/3996-130-0x0000000006A80000-0x0000000006F7E000-memory.dmpFilesize
5.0MB
-
memory/3996-132-0x0000000004520000-0x0000000004548000-memory.dmpFilesize
160KB
-
memory/3996-133-0x0000000006F80000-0x0000000007586000-memory.dmpFilesize
6.0MB
-
memory/3996-134-0x0000000006920000-0x0000000006932000-memory.dmpFilesize
72KB
-
memory/3996-135-0x0000000006950000-0x0000000006A5A000-memory.dmpFilesize
1.0MB
-
memory/3996-136-0x0000000006A70000-0x0000000006A80000-memory.dmpFilesize
64KB
-
memory/3996-137-0x0000000007590000-0x00000000075CE000-memory.dmpFilesize
248KB
-
memory/3996-138-0x0000000007600000-0x000000000764B000-memory.dmpFilesize
300KB
-
memory/3996-139-0x00000000077A0000-0x0000000007806000-memory.dmpFilesize
408KB
-
memory/3996-140-0x0000000007F40000-0x0000000007FD2000-memory.dmpFilesize
584KB
-
memory/3996-141-0x0000000002370000-0x0000000002470000-memory.dmpFilesize
1024KB
-
memory/3996-142-0x0000000008270000-0x00000000082E6000-memory.dmpFilesize
472KB
-
memory/3996-143-0x0000000008310000-0x00000000084D2000-memory.dmpFilesize
1.8MB
-
memory/3996-144-0x00000000084F0000-0x0000000008A1C000-memory.dmpFilesize
5.2MB
-
memory/3996-145-0x0000000003F20000-0x0000000003F5D000-memory.dmpFilesize
244KB
-
memory/3996-146-0x0000000008B40000-0x0000000008B5E000-memory.dmpFilesize
120KB
-
memory/3996-148-0x0000000000400000-0x000000000230E000-memory.dmpFilesize
31.1MB
-
memory/3996-150-0x0000000073960000-0x000000007404E000-memory.dmpFilesize
6.9MB