Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
-
submitted
12-10-2023 14:46
General
-
Target
81DE0B0491C0A7AF0539CBFDDD5248BC.exe
-
Size
5.6MB
-
MD5
81de0b0491c0a7af0539cbfddd5248bc
-
SHA1
724f5e4ab06069d0e0b8117c1b802bd028a9d97e
-
SHA256
81c8e32e41112edd57ece8eed85bba6fec5b3750a6b264504930798e623d1917
-
SHA512
381ffee29e05b5c78cf85ff5892373d2170e39aa70c2dc100980531c2cb98e0d5ce03918e69a33aeab4933f01f1fb6be0ff8d283720e3cae68a2e990d8442716
-
SSDEEP
98304:f1repUJlaEhSme+bpMt4PUMFfyQJsAHnsByU/On+KfoYY6gwzYpeafFSirJl76:VJlPdHWttMFqQzHsBh/On//gwZaNlrDO
Malware Config
Extracted
redline
3
135.181.49.47:27356
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine payload 8 IoCs
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 6 IoCs
-
Suspicious behavior: EnumeratesProcesses 4 IoCs
-
Suspicious use of AdjustPrivilegeToken 1 IoCs
-
Suspicious use of SetWindowsHookEx 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\81DE0B0491C0A7AF0539CBFDDD5248BC.exe"C:\Users\Admin\AppData\Local\Temp\81DE0B0491C0A7AF0539CBFDDD5248BC.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/496-0-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-1-0x000000007ED00000-0x000000007F0D1000-memory.dmpFilesize
3.8MB
-
memory/496-2-0x0000000074090000-0x0000000074840000-memory.dmpFilesize
7.7MB
-
memory/496-3-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-4-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-5-0x000000000AA60000-0x000000000B004000-memory.dmpFilesize
5.6MB
-
memory/496-6-0x000000000A590000-0x000000000A622000-memory.dmpFilesize
584KB
-
memory/496-7-0x000000000A740000-0x000000000A750000-memory.dmpFilesize
64KB
-
memory/496-9-0x000000000A530000-0x000000000A53A000-memory.dmpFilesize
40KB
-
memory/496-8-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-10-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-11-0x000000007ED00000-0x000000007F0D1000-memory.dmpFilesize
3.8MB
-
memory/496-12-0x000000000B630000-0x000000000BC48000-memory.dmpFilesize
6.1MB
-
memory/496-13-0x0000000074090000-0x0000000074840000-memory.dmpFilesize
7.7MB
-
memory/496-14-0x000000000A860000-0x000000000A96A000-memory.dmpFilesize
1.0MB
-
memory/496-15-0x000000000A6A0000-0x000000000A6B2000-memory.dmpFilesize
72KB
-
memory/496-16-0x000000000A700000-0x000000000A73C000-memory.dmpFilesize
240KB
-
memory/496-17-0x000000000A750000-0x000000000A79C000-memory.dmpFilesize
304KB
-
memory/496-18-0x000000000A740000-0x000000000A750000-memory.dmpFilesize
64KB
-
memory/496-19-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-20-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-21-0x000000000B480000-0x000000000B4E6000-memory.dmpFilesize
408KB
-
memory/496-22-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-23-0x000000000C520000-0x000000000C6E2000-memory.dmpFilesize
1.8MB
-
memory/496-24-0x000000000CC20000-0x000000000D14C000-memory.dmpFilesize
5.2MB
-
memory/496-26-0x00000000007E0000-0x000000000208E000-memory.dmpFilesize
24.7MB
-
memory/496-28-0x0000000074090000-0x0000000074840000-memory.dmpFilesize
7.7MB