Analysis
-
max time kernel
121s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
28-07-2023 17:38
Static task
static1
Behavioral task
behavioral1
Sample
b824349984caaa7351d0c62a0_JC.exe
Resource
win7-20230712-en
General
-
Target
b824349984caaa7351d0c62a0_JC.exe
-
Size
441KB
-
MD5
b268ac227f61080c783c56005fa2ff83
-
SHA1
8b4e46ce1b66655fd893e87fb12fc4bb89f46578
-
SHA256
b824349984caaa7351d0c62a0b04e0ff3412834c24e7f9f29e9c1459c525ccb1
-
SHA512
4dcf500bcf1423e40d9dbe2c5ed55518f7b76521941bb05bff4f47158bb9d8c35ed2d423a0c96e74a798d342eca0a7c170eed42e032b6e867aac0484902ef9f2
-
SSDEEP
6144:2QYU8LE9mXbBb/Adg1RZceDBfYHbbk21Erzpjv+HT:AU8IYoASbWpjmz
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2192-57-0x0000000003F80000-0x0000000003FAC000-memory.dmp family_redline behavioral1/memory/2192-59-0x0000000004340000-0x0000000004380000-memory.dmp family_redline behavioral1/memory/2192-63-0x0000000003FE0000-0x0000000004008000-memory.dmp family_redline behavioral1/memory/2192-65-0x0000000004340000-0x0000000004380000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
b824349984caaa7351d0c62a0_JC.exepid process 2192 b824349984caaa7351d0c62a0_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
b824349984caaa7351d0c62a0_JC.exedescription pid process Token: SeDebugPrivilege 2192 b824349984caaa7351d0c62a0_JC.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2192-55-0x0000000002520000-0x0000000002620000-memory.dmpFilesize
1024KB
-
memory/2192-56-0x0000000000220000-0x000000000025D000-memory.dmpFilesize
244KB
-
memory/2192-57-0x0000000003F80000-0x0000000003FAC000-memory.dmpFilesize
176KB
-
memory/2192-58-0x0000000000400000-0x0000000002440000-memory.dmpFilesize
32.2MB
-
memory/2192-59-0x0000000004340000-0x0000000004380000-memory.dmpFilesize
256KB
-
memory/2192-60-0x0000000004340000-0x0000000004380000-memory.dmpFilesize
256KB
-
memory/2192-61-0x0000000004340000-0x0000000004380000-memory.dmpFilesize
256KB
-
memory/2192-62-0x0000000073DD0000-0x00000000744BE000-memory.dmpFilesize
6.9MB
-
memory/2192-63-0x0000000003FE0000-0x0000000004008000-memory.dmpFilesize
160KB
-
memory/2192-65-0x0000000004340000-0x0000000004380000-memory.dmpFilesize
256KB
-
memory/2192-66-0x0000000002520000-0x0000000002620000-memory.dmpFilesize
1024KB
-
memory/2192-67-0x0000000000400000-0x0000000002440000-memory.dmpFilesize
32.2MB
-
memory/2192-68-0x0000000000220000-0x000000000025D000-memory.dmpFilesize
244KB
-
memory/2192-69-0x0000000073DD0000-0x00000000744BE000-memory.dmpFilesize
6.9MB
-
memory/2192-70-0x0000000002520000-0x0000000002620000-memory.dmpFilesize
1024KB