Analysis
-
max time kernel
119s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
29-07-2023 15:31
Static task
static1
Behavioral task
behavioral1
Sample
ee5754e39b22b6758e5d2b940_JC.exe
Resource
win7-20230712-en
General
-
Target
ee5754e39b22b6758e5d2b940_JC.exe
-
Size
411KB
-
MD5
1209c6857cc79e40556ce90da185c356
-
SHA1
4f58e0d124edf610c0554483443cf38b4cc682a3
-
SHA256
ee5754e39b22b6758e5d2b940a0cfc11835a80779073148028a6222a7e37e086
-
SHA512
b0831e6344d6ff1eafa1e4937eae5206c9e99425ff4ec222800011dbc1c74eebbc81818b1fd6c71f8530de1cf24a15e83454dc36d37b025f57fadfbd14bb0376
-
SSDEEP
6144:LpFd4439vvCgXcn77/2Fzdm9u6tCp58B3I99RArUNOMSYZW/t:LpD39vCoc//wxmo6te5oyLyCOq4
Malware Config
Extracted
redline
@Germany
194.26.135.162:2920
-
auth_value
9d15d78194367a949e54a07d6ce02c62
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/2556-56-0x0000000003F90000-0x0000000003FBC000-memory.dmp family_redline behavioral1/memory/2556-61-0x0000000003FC0000-0x0000000003FE8000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ee5754e39b22b6758e5d2b940_JC.exepid process 2556 ee5754e39b22b6758e5d2b940_JC.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ee5754e39b22b6758e5d2b940_JC.exedescription pid process Token: SeDebugPrivilege 2556 ee5754e39b22b6758e5d2b940_JC.exe
Processes
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2556-55-0x00000000024C0000-0x00000000025C0000-memory.dmpFilesize
1024KB
-
memory/2556-57-0x0000000000400000-0x000000000230E000-memory.dmpFilesize
31.1MB
-
memory/2556-56-0x0000000003F90000-0x0000000003FBC000-memory.dmpFilesize
176KB
-
memory/2556-59-0x00000000067F0000-0x0000000006830000-memory.dmpFilesize
256KB
-
memory/2556-58-0x00000000067F0000-0x0000000006830000-memory.dmpFilesize
256KB
-
memory/2556-60-0x0000000000220000-0x000000000025D000-memory.dmpFilesize
244KB
-
memory/2556-61-0x0000000003FC0000-0x0000000003FE8000-memory.dmpFilesize
160KB
-
memory/2556-62-0x0000000074C50000-0x000000007533E000-memory.dmpFilesize
6.9MB
-
memory/2556-63-0x00000000067F0000-0x0000000006830000-memory.dmpFilesize
256KB
-
memory/2556-64-0x0000000000400000-0x000000000230E000-memory.dmpFilesize
31.1MB
-
memory/2556-65-0x0000000074C50000-0x000000007533E000-memory.dmpFilesize
6.9MB
-
memory/2556-66-0x00000000024C0000-0x00000000025C0000-memory.dmpFilesize
1024KB