Overview
overview
10Static
static
10189ca1951e...df.exe
windows7-x64
10189ca1951e...df.exe
windows10-2004-x64
1037ca1cfa1f...60.exe
windows7-x64
1037ca1cfa1f...60.exe
windows10-2004-x64
1037e3ba3283...c3.elf
debian-9-armhf
13898dfa5cb...ba.exe
windows7-x64
103898dfa5cb...ba.exe
windows10-2004-x64
103e488cd6f6...e9.exe
windows7-x64
103e488cd6f6...e9.exe
windows10-2004-x64
10505fe3cf69...cb.exe
windows7-x64
10505fe3cf69...cb.exe
windows10-2004-x64
106543c547b8...84.exe
windows7-x64
16543c547b8...84.exe
windows10-2004-x64
10911bb31927...e4.exe
windows7-x64
10911bb31927...e4.exe
windows10-2004-x64
10913aec7dc7...60.exe
windows7-x64
10913aec7dc7...60.exe
windows10-2004-x64
10NEAS.arm7elf_JC.elf
debian-9-armhf
1a23543464a...48.exe
windows7-x64
10a23543464a...48.exe
windows10-2004-x64
10ad21aff38e...59.exe
windows7-x64
1ad21aff38e...59.exe
windows10-2004-x64
10ba5ce65d72...ff.exe
windows7-x64
10ba5ce65d72...ff.exe
windows10-2004-x64
10ca1af61fd2...7f.elf
debian-9-mipsel
9cad291a2df...eb.exe
windows7-x64
10cad291a2df...eb.exe
windows10-2004-x64
10da8e7392c3...fb.exe
windows7-x64
10da8e7392c3...fb.exe
windows10-2004-x64
10e3a0367cf2...02.exe
windows7-x64
10e3a0367cf2...02.exe
windows10-2004-x64
10f8ac9d00a1...1b.exe
windows7-x64
10Analysis
-
max time kernel
85s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2023 08:33
Behavioral task
behavioral1
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
189ca1951e90f92454d9e6f451847f17d5d3e85639e474147d9d63ec529189df.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral3
Sample
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
Resource
win7-20230831-en
Behavioral task
behavioral4
Sample
37ca1cfa1f30b57408d3e855f98f9e5fd6900b23643bbc0c6163a875edf00b60.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral5
Sample
37e3ba3283cd2b6f56990318a0861f92f76aac467a79df61b72878a493c476c3.elf
Resource
debian9-armhf-20230831-en
Behavioral task
behavioral6
Sample
3898dfa5cb6bbc6d6c48c202d31333d3b214d0f2ac7c4396eb54d6ed09bf24ba.exe
Resource
win7-20230831-en
Behavioral task
behavioral7
Sample
3898dfa5cb6bbc6d6c48c202d31333d3b214d0f2ac7c4396eb54d6ed09bf24ba.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral8
Sample
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9.exe
Resource
win7-20230831-en
Behavioral task
behavioral9
Sample
3e488cd6f6cc7b35713c321dc58b63fa95ba9c69248008109b7bf9a543add7e9.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral10
Sample
505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe
Resource
win7-20230831-en
Behavioral task
behavioral11
Sample
505fe3cf697c698f75b5135389463f40af5c90b576cd1d637db3400fe2701bcb.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral12
Sample
6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984.exe
Resource
win7-20230831-en
Behavioral task
behavioral13
Sample
6543c547b83be07c11742aebcba0264026667005c7d4b90ca9ee8da62ad06984.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral14
Sample
911bb31927c7250b4741063159cccf6549e4a28ce6b0a5043d3392c7fce401e4.exe
Resource
win7-20230831-en
Behavioral task
behavioral15
Sample
911bb31927c7250b4741063159cccf6549e4a28ce6b0a5043d3392c7fce401e4.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral16
Sample
913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe
Resource
win7-20230831-en
Behavioral task
behavioral17
Sample
913aec7dc792e606551464e3203a1545bed4f032de9dfced990183fa65c53360.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral18
Sample
NEAS.arm7elf_JC.elf
Resource
debian9-armhf-en-20211208
Behavioral task
behavioral19
Sample
a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe
Resource
win7-20230831-en
Behavioral task
behavioral20
Sample
a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral21
Sample
ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859.exe
Resource
win7-20230831-en
Behavioral task
behavioral22
Sample
ad21aff38e3b20ca7c9c7236977dfb0821d515962cb5c705d8a5b9a8cbc43859.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral23
Sample
ba5ce65d728b5529fede411b5fb3b99e88a69c797e5bf8b89e18e42a9d6761ff.exe
Resource
win7-20230831-en
Behavioral task
behavioral24
Sample
ba5ce65d728b5529fede411b5fb3b99e88a69c797e5bf8b89e18e42a9d6761ff.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral25
Sample
ca1af61fd2c6ecd3827b63604900beaaf6382c8bf6ef6b7a6e469e250f9b2e7f.elf
Resource
debian9-mipsel-20230831-en
Behavioral task
behavioral26
Sample
cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe
Resource
win7-20230831-en
Behavioral task
behavioral27
Sample
cad291a2df541313c6d296dcb798f5565ce591ca94f4649c21bc0e8b7e7a86eb.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral28
Sample
da8e7392c3c3d1c521d28c78d60425a2a5b7f52d17eb495d0e5cc581737344fb.exe
Resource
win7-20230831-en
Behavioral task
behavioral29
Sample
da8e7392c3c3d1c521d28c78d60425a2a5b7f52d17eb495d0e5cc581737344fb.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral30
Sample
e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe
Resource
win7-20230831-en
Behavioral task
behavioral31
Sample
e3a0367cf2ebe9a41c5972ce3e53c1eb89d81fa01d1fe3e29ecca89af8f5a802.exe
Resource
win10v2004-20230915-en
Behavioral task
behavioral32
Sample
f8ac9d00a184e45b3c8600507eb21194712ea65d0e8e72657963c870f039d21b.exe
Resource
win7-20230831-en
General
-
Target
a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe
-
Size
387KB
-
MD5
f646c097913ec9dc3897ec3b5e452919
-
SHA1
0948b7d2f5b0ebcbc5c3b7c8ef29a271abbfa93f
-
SHA256
a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448
-
SHA512
5e2d2e7356f5c69b6ef676ccb266c58786030a0d751aa8c6e52e9a8ef5365d7d7f41c0434e25260998bbf53d99122f363b0f620a4a8dd4d68e5952545416cf07
-
SSDEEP
12288:kDoSU8AcJIoxecqF2kTJFLb1ChbNdP+kfXuBuKUv0HJg0YBmgMylojOPcoDYyFtz:kcFpQmyojOwUPXzqSd
Malware Config
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 1 IoCs
Processes:
resource yara_rule behavioral20/memory/4856-1-0x00000000021D0000-0x000000000222A000-memory.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exepid process 4856 a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe 4856 a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe 4856 a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe 4856 a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exedescription pid process Token: SeDebugPrivilege 4856 a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe"C:\Users\Admin\AppData\Local\Temp\a23543464a64fea0ed91623e16dc9631a2274c4a4f929a04eacf149590c6c448.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4856-0-0x0000000000400000-0x0000000000465000-memory.dmpFilesize
404KB
-
memory/4856-1-0x00000000021D0000-0x000000000222A000-memory.dmpFilesize
360KB
-
memory/4856-5-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/4856-6-0x00000000070D0000-0x0000000007674000-memory.dmpFilesize
5.6MB
-
memory/4856-7-0x0000000004BA0000-0x0000000004C32000-memory.dmpFilesize
584KB
-
memory/4856-8-0x00000000077B0000-0x00000000077C0000-memory.dmpFilesize
64KB
-
memory/4856-9-0x0000000007720000-0x000000000772A000-memory.dmpFilesize
40KB
-
memory/4856-10-0x0000000007C60000-0x0000000008278000-memory.dmpFilesize
6.1MB
-
memory/4856-11-0x00000000078E0000-0x00000000078F2000-memory.dmpFilesize
72KB
-
memory/4856-12-0x0000000007900000-0x0000000007A0A000-memory.dmpFilesize
1.0MB
-
memory/4856-13-0x0000000007A10000-0x0000000007A4C000-memory.dmpFilesize
240KB
-
memory/4856-14-0x0000000007A90000-0x0000000007ADC000-memory.dmpFilesize
304KB
-
memory/4856-15-0x0000000008280000-0x00000000082E6000-memory.dmpFilesize
408KB
-
memory/4856-16-0x0000000008A30000-0x0000000008A80000-memory.dmpFilesize
320KB
-
memory/4856-17-0x0000000008A80000-0x0000000008AF6000-memory.dmpFilesize
472KB
-
memory/4856-18-0x0000000008B10000-0x0000000008B2E000-memory.dmpFilesize
120KB
-
memory/4856-19-0x0000000008BE0000-0x0000000008DA2000-memory.dmpFilesize
1.8MB
-
memory/4856-20-0x0000000008DB0000-0x00000000092DC000-memory.dmpFilesize
5.2MB
-
memory/4856-21-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB
-
memory/4856-22-0x00000000077B0000-0x00000000077C0000-memory.dmpFilesize
64KB
-
memory/4856-25-0x0000000074590000-0x0000000074D40000-memory.dmpFilesize
7.7MB