Analysis
- max time kernel
102s - max time network
106s - platform
windows10-1703_x64 - resource
win10-20230703-en - resource tags
- submitted
02/08/2023, 15:33
General
- Target ecd4843c21bdb0db85396583b97670d8fceb111c718161b807196107c7e1e49e.exe
- Size 410KB
- Sample230802-sy682age3x
- SHA256 ecd4843c21bdb0db85396583b97670d8fceb111c718161b807196107c7e1e49e
Malware Config
Extracted
-
redline
-
LogsDiller Cloud (TG: @logsdillabot)
-
51.89.201.49:6932
-
auth_value
3a050df92d0cf082b2cdaf87863616be
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\ecd4843c21bdb0db85396583b97670d8fceb111c718161b807196107c7e1e49e.exe"C:\Users\Admin\AppData\Local\Temp\ecd4843c21bdb0db85396583b97670d8fceb111c718161b807196107c7e1e49e.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/4472-118-0x0000000002680000-0x0000000002780000-memory.dmp
memory/4472-119-0x0000000002440000-0x000000000247F000-memory.dmp
memory/4472-120-0x0000000004240000-0x0000000004278000-memory.dmp
memory/4472-121-0x0000000000400000-0x000000000230D000-memory.dmp
memory/4472-122-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-123-0x0000000073B00000-0x00000000741EE000-memory.dmp
memory/4472-124-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-125-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-126-0x0000000006A80000-0x0000000006F7E000-memory.dmp
memory/4472-127-0x0000000004300000-0x0000000004334000-memory.dmp
memory/4472-128-0x0000000004370000-0x0000000004376000-memory.dmp
memory/4472-129-0x0000000007080000-0x0000000007686000-memory.dmp
memory/4472-130-0x0000000007690000-0x000000000779A000-memory.dmp
memory/4472-132-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-131-0x0000000004440000-0x0000000004452000-memory.dmp
memory/4472-133-0x0000000004580000-0x00000000045BE000-memory.dmp
memory/4472-134-0x00000000077A0000-0x00000000077EB000-memory.dmp
memory/4472-135-0x0000000002680000-0x0000000002780000-memory.dmp
memory/4472-136-0x0000000000400000-0x000000000230D000-memory.dmp
memory/4472-137-0x0000000002440000-0x000000000247F000-memory.dmp
memory/4472-138-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-139-0x0000000073B00000-0x00000000741EE000-memory.dmp
memory/4472-140-0x00000000079D0000-0x0000000007A46000-memory.dmp
memory/4472-141-0x0000000007A50000-0x0000000007AE2000-memory.dmp
memory/4472-143-0x0000000007AF0000-0x0000000007B56000-memory.dmp
memory/4472-144-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-145-0x0000000008320000-0x0000000008370000-memory.dmp
memory/4472-146-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-147-0x0000000008FE0000-0x00000000091A2000-memory.dmp
memory/4472-148-0x000000000A790000-0x000000000ACBC000-memory.dmp
memory/4472-149-0x0000000004380000-0x0000000004390000-memory.dmp
memory/4472-151-0x0000000000400000-0x000000000230D000-memory.dmp
memory/4472-152-0x0000000073B00000-0x00000000741EE000-memory.dmp