Overview

overview

10

Static

static

10

cryptolaemus

windows10-2004-x64

10

cryptolaemus

windows11-21h2-x64

10

Analysis

  • max time kernel
    141s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240226-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24/04/2024, 13:51 UTC

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6674e7645dd686fa5d36735696226d9f1104e3bf58ffb428197fb995d2c6f2a8.exe

  • Size

    306KB

  • MD5

    e534dbf6402a0d80ae6adab77d9a0260

  • SHA1

    c9748d617f69104a5dea728a42ccf4abe2f0942e

  • SHA256

    6674e7645dd686fa5d36735696226d9f1104e3bf58ffb428197fb995d2c6f2a8

  • SHA512

    6477c5407538f24e46c025eb20ed3da1d0d2f9dc0909f25de6075fe799e2a8907106f7b3125b50f22c406b5b3bb26e8e35c2eded6d83f1020a60d3352637f29d

  • SSDEEP

    6144:/qY6irwP7YfmrYiJv7TAPAzdcZqf7DI/L:/nwPkiJvGAzdcUzs/

Score
10/10
redlinespoodiscoveryinfostealerspywarestealer

Malware Config

Extracted

Family

redline

Botnet

spoo

C2

103.113.70.99:2630

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

    infostealerredline
  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
    spyware
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan
  • Suspicious behavior: EnumeratesProcesses 22 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6674e7645dd686fa5d36735696226d9f1104e3bf58ffb428197fb995d2c6f2a8.exe
    "C:\Users\Admin\AppData\Local\Temp\6674e7645dd686fa5d36735696226d9f1104e3bf58ffb428197fb995d2c6f2a8.exe"
    1⤵
    • Modifies system certificate store
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:4820
  • C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
    "C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=1408 --field-trial-handle=2328,i,5873823382323802923,13134441441264702821,262144 --variations-seed-version /prefetch:8
    1⤵
      PID:2800

    Network

    • flag-us
      DNS
      13.86.106.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      13.86.106.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      249.197.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      249.197.17.2.in-addr.arpa
      IN PTR
      Response
      249.197.17.2.in-addr.arpa
      IN PTR
      a2-17-197-249deploystaticakamaitechnologiescom
    • flag-us
      DNS
      249.197.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      249.197.17.2.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      249.197.17.2.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      249.197.17.2.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      68.159.190.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      68.159.190.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      95.221.229.192.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      95.221.229.192.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      99.70.113.103.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      99.70.113.103.in-addr.arpa
      IN PTR
      Response
      99.70.113.103.in-addr.arpa
      IN PTR
      vm2375815stark-industries solutions
    • flag-us
      DNS
      196.249.167.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      196.249.167.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      157.123.68.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      157.123.68.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      15.164.165.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      15.164.165.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      154.239.44.20.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      154.239.44.20.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      24.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      24.139.73.23.in-addr.arpa
      IN PTR
      Response
      24.139.73.23.in-addr.arpa
      IN PTR
      a23-73-139-24deploystaticakamaitechnologiescom
    • flag-us
      DNS
      24.139.73.23.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      24.139.73.23.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN A
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN Unknown
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN A
      Response
      chromewebstore.googleapis.com
      IN A
      172.217.169.10
      chromewebstore.googleapis.com
      IN A
      216.58.212.234
      chromewebstore.googleapis.com
      IN A
      142.250.179.234
      chromewebstore.googleapis.com
      IN A
      142.250.180.10
      chromewebstore.googleapis.com
      IN A
      142.250.187.202
      chromewebstore.googleapis.com
      IN A
      142.250.187.234
      chromewebstore.googleapis.com
      IN A
      142.250.200.42
      chromewebstore.googleapis.com
      IN A
      172.217.16.234
      chromewebstore.googleapis.com
      IN A
      142.250.200.10
      chromewebstore.googleapis.com
      IN A
      142.250.178.10
      chromewebstore.googleapis.com
      IN A
      216.58.201.106
      chromewebstore.googleapis.com
      IN A
      216.58.204.74
    • flag-us
      DNS
      chromewebstore.googleapis.com
      Remote address:
      8.8.8.8:53
      Request
      chromewebstore.googleapis.com
      IN Unknown
      Response
    • flag-us
      DNS
      pki.goog
      Remote address:
      8.8.8.8:53
      Request
      pki.goog
      IN A
      Response
      pki.goog
      IN A
      216.239.32.29
    • flag-us
      DNS
      pki.goog
      Remote address:
      8.8.8.8:53
      Request
      pki.goog
      IN Unknown
      Response
    • flag-us
      GET
      http://pki.goog/gsr1/gsr1.crt
      Remote address:
      216.239.32.29:80
      Request
      GET /gsr1/gsr1.crt HTTP/1.1
      Host: pki.goog
      Connection: keep-alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Encoding: gzip
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 797
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Wed, 24 Apr 2024 13:30:30 GMT
      Expires: Wed, 24 Apr 2024 14:20:30 GMT
      Cache-Control: public, max-age=3000
      Age: 1286
      Last-Modified: Wed, 20 May 2020 16:45:00 GMT
      Content-Type: application/pkix-cert
      Vary: Accept-Encoding
    • flag-us
      GET
      http://pki.goog/repo/certs/gtsr1.der
      Remote address:
      216.239.32.29:80
      Request
      GET /repo/certs/gtsr1.der HTTP/1.1
      Host: pki.goog
      Connection: keep-alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 1371
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Wed, 24 Apr 2024 13:30:31 GMT
      Expires: Wed, 24 Apr 2024 14:20:31 GMT
      Cache-Control: public, max-age=3000
      Age: 1285
      Last-Modified: Sun, 25 Jun 2023 02:58:00 GMT
      Content-Type: application/pkix-cert
      Vary: Accept-Encoding
    • flag-us
      GET
      http://pki.goog/repo/certs/gts1c3.der
      Remote address:
      216.239.32.29:80
      Request
      GET /repo/certs/gts1c3.der HTTP/1.1
      Host: pki.goog
      Connection: keep-alive
      User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/122.0.0.0 Safari/537.36 Edg/122.0.0.0
      Accept-Encoding: gzip, deflate
      Accept-Language: en-US,en;q=0.9
      Response
      HTTP/1.1 200 OK
      Accept-Ranges: bytes
      Content-Encoding: gzip
      Content-Security-Policy-Report-Only: require-trusted-types-for 'script'; report-uri https://csp.withgoogle.com/csp/cacerts
      Cross-Origin-Resource-Policy: cross-origin
      Cross-Origin-Opener-Policy: same-origin; report-to="cacerts"
      Report-To: {"group":"cacerts","max_age":2592000,"endpoints":[{"url":"https://csp.withgoogle.com/csp/report-to/cacerts"}]}
      Content-Length: 1304
      X-Content-Type-Options: nosniff
      Server: sffe
      X-XSS-Protection: 0
      Date: Wed, 24 Apr 2024 13:31:11 GMT
      Expires: Wed, 24 Apr 2024 14:21:11 GMT
      Cache-Control: public, max-age=3000
      Age: 1247
      Last-Modified: Mon, 17 Aug 2020 09:45:00 GMT
      Content-Type: application/pkix-cert
      Vary: Accept-Encoding
    • flag-us
      DNS
      10.169.217.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.169.217.172.in-addr.arpa
      IN PTR
      Response
      10.169.217.172.in-addr.arpa
      IN PTR
      lhr25s26-in-f101e100net
    • flag-us
      DNS
      10.169.217.172.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      10.169.217.172.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      29.32.239.216.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      29.32.239.216.in-addr.arpa
      IN PTR
      Response
      29.32.239.216.in-addr.arpa
      IN PTR
      any-in-201d1e100net
    • flag-us
      DNS
      228.249.119.40.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      228.249.119.40.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      149.220.183.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      149.220.183.52.in-addr.arpa
      IN PTR
    • flag-us
      DNS
      240.221.184.93.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      240.221.184.93.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      43.229.111.52.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      43.229.111.52.in-addr.arpa
      IN PTR
      Response
    • flag-us
      DNS
      137.71.105.51.in-addr.arpa
      Remote address:
      8.8.8.8:53
      Request
      137.71.105.51.in-addr.arpa
      IN PTR
      Response
    • 103.113.70.99:2630
      6674e7645dd686fa5d36735696226d9f1104e3bf58ffb428197fb995d2c6f2a8.exe
      1.2MB
       30.2kB
       939
      434
    • 13.107.253.64:443
      46 B
       40 B
       1
      1
    • 172.217.169.10:443
      chromewebstore.googleapis.com
      tls
      1.0kB
       5.2kB
       8
      8
    • 216.239.32.29:80
      http://pki.goog/repo/certs/gts1c3.der
      http
      2.3kB
       6.0kB
       13
      9

      HTTP Request

      GET http://pki.goog/gsr1/gsr1.crt

      HTTP Response

      200

      HTTP Request

      GET http://pki.goog/repo/certs/gtsr1.der

      HTTP Response

      200

      HTTP Request

      GET http://pki.goog/repo/certs/gts1c3.der

      HTTP Response

      200
    • 8.8.8.8:53
      13.86.106.20.in-addr.arpa
      dns
      71 B
       157 B
       1
      1

      DNS Request

      13.86.106.20.in-addr.arpa

    • 8.8.8.8:53
      249.197.17.2.in-addr.arpa
      dns
      213 B
       135 B
       3
      1

      DNS Request

      249.197.17.2.in-addr.arpa

      DNS Request

      249.197.17.2.in-addr.arpa

      DNS Request

      249.197.17.2.in-addr.arpa

    • 8.8.8.8:53
      68.159.190.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      68.159.190.20.in-addr.arpa

    • 8.8.8.8:53
      95.221.229.192.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      95.221.229.192.in-addr.arpa

    • 8.8.8.8:53
      99.70.113.103.in-addr.arpa
      dns
      72 B
       122 B
       1
      1

      DNS Request

      99.70.113.103.in-addr.arpa

    • 8.8.8.8:53
      196.249.167.52.in-addr.arpa
      dns
      73 B
       147 B
       1
      1

      DNS Request

      196.249.167.52.in-addr.arpa

    • 8.8.8.8:53
      157.123.68.40.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      157.123.68.40.in-addr.arpa

    • 8.8.8.8:53
      15.164.165.52.in-addr.arpa
      dns
      72 B
       146 B
       1
      1

      DNS Request

      15.164.165.52.in-addr.arpa

    • 8.8.8.8:53
      154.239.44.20.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      154.239.44.20.in-addr.arpa

    • 8.8.8.8:53
      24.139.73.23.in-addr.arpa
      dns
      142 B
       135 B
       2
      1

      DNS Request

      24.139.73.23.in-addr.arpa

      DNS Request

      24.139.73.23.in-addr.arpa

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
       1

      DNS Request

      chromewebstore.googleapis.com

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
       1

      DNS Request

      chromewebstore.googleapis.com

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
       267 B
       1
      1

      DNS Request

      chromewebstore.googleapis.com

      DNS Response

      172.217.169.10
      216.58.212.234
      142.250.179.234
      142.250.180.10
      142.250.187.202
      142.250.187.234
      142.250.200.42
      172.217.16.234
      142.250.200.10
      142.250.178.10
      216.58.201.106
      216.58.204.74

    • 8.8.8.8:53
      chromewebstore.googleapis.com
      dns
      75 B
       132 B
       1
      1

      DNS Request

      chromewebstore.googleapis.com

    • 8.8.8.8:53
      pki.goog
      dns
      54 B
       70 B
       1
      1

      DNS Request

      pki.goog

      DNS Response

      216.239.32.29

    • 8.8.8.8:53
      pki.goog
      dns
      54 B
       128 B
       1
      1

      DNS Request

      pki.goog

    • 8.8.8.8:53
      10.169.217.172.in-addr.arpa
      dns
      146 B
       112 B
       2
      1

      DNS Request

      10.169.217.172.in-addr.arpa

      DNS Request

      10.169.217.172.in-addr.arpa

    • 8.8.8.8:53
      29.32.239.216.in-addr.arpa
      dns
      72 B
       107 B
       1
      1

      DNS Request

      29.32.239.216.in-addr.arpa

    • 8.8.8.8:53
      228.249.119.40.in-addr.arpa
      dns
      73 B
       159 B
       1
      1

      DNS Request

      228.249.119.40.in-addr.arpa

    • 8.8.8.8:53
      149.220.183.52.in-addr.arpa
      dns
      146 B
       147 B
       2
      1

      DNS Request

      149.220.183.52.in-addr.arpa

      DNS Request

      149.220.183.52.in-addr.arpa

    • 8.8.8.8:53
      240.221.184.93.in-addr.arpa
      dns
      73 B
       144 B
       1
      1

      DNS Request

      240.221.184.93.in-addr.arpa

    • 8.8.8.8:53
      43.229.111.52.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      43.229.111.52.in-addr.arpa

    • 8.8.8.8:53
      137.71.105.51.in-addr.arpa
      dns
      72 B
       158 B
       1
      1

      DNS Request

      137.71.105.51.in-addr.arpa

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\Tmp490A.tmp
      Filesize

      2KB

      MD5

      1420d30f964eac2c85b2ccfe968eebce

      SHA1

      bdf9a6876578a3e38079c4f8cf5d6c79687ad750

      SHA256

      f3327793e3fd1f3f9a93f58d033ed89ce832443e2695beca9f2b04adba049ed9

      SHA512

      6fcb6ce148e1e246d6805502d4914595957061946751656567a5013d96033dd1769a22a87c45821e7542cde533450e41182cee898cd2ccf911c91bc4822371a8

      Download Submit

    • memory/4820-27-0x0000000006F20000-0x000000000702A000-memory.dmp

      Filesize

      1.0MB

      Download

    • memory/4820-2-0x0000000005C90000-0x0000000006234000-memory.dmp

      Filesize

      5.6MB

      Download

    • memory/4820-3-0x0000000005780000-0x0000000005812000-memory.dmp

      Filesize

      584KB

      Download

    • memory/4820-4-0x0000000005970000-0x0000000005980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4820-5-0x0000000005720000-0x000000000572A000-memory.dmp

      Filesize

      40KB

      Download

    • memory/4820-1-0x0000000000CB0000-0x0000000000D02000-memory.dmp

      Filesize

      328KB

      Download

    • memory/4820-22-0x0000000006340000-0x00000000063B6000-memory.dmp

      Filesize

      472KB

      Download

    • memory/4820-23-0x0000000006C90000-0x0000000006CAE000-memory.dmp

      Filesize

      120KB

      Download

    • memory/4820-0-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4820-26-0x00000000073D0000-0x00000000079E8000-memory.dmp

      Filesize

      6.1MB

      Download

    • memory/4820-30-0x0000000007030000-0x000000000707C000-memory.dmp

      Filesize

      304KB

      Download

    • memory/4820-29-0x0000000006EC0000-0x0000000006EFC000-memory.dmp

      Filesize

      240KB

      Download

    • memory/4820-28-0x0000000006E60000-0x0000000006E72000-memory.dmp

      Filesize

      72KB

      Download

    • memory/4820-31-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

      Download

    • memory/4820-32-0x0000000007170000-0x00000000071D6000-memory.dmp

      Filesize

      408KB

      Download

    • memory/4820-33-0x0000000007BF0000-0x0000000007C40000-memory.dmp

      Filesize

      320KB

      Download

    • memory/4820-34-0x0000000005970000-0x0000000005980000-memory.dmp

      Filesize

      64KB

      Download

    • memory/4820-37-0x0000000008CC0000-0x0000000008E82000-memory.dmp

      Filesize

      1.8MB

      Download

    • memory/4820-38-0x00000000093C0000-0x00000000098EC000-memory.dmp

      Filesize

      5.2MB

      Download

    • memory/4820-40-0x0000000074E00000-0x00000000755B0000-memory.dmp

      Filesize

      7.7MB

      Download

    We care about your privacy.

    This website stores cookies on your computer. These cookies are used to improve your website experience and provide more personalized services to you, both on this website and through other media. To find out more about the cookies we use, see our Privacy Policy.