Analysis

  • max time kernel
    148s
  • max time network
    150s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    22/07/2024, 18:35

General

  • Target

    123.exe

  • Size

    667KB

  • MD5

    343d4defc4481746b24e7c2921c4f548

  • SHA1

    47616a15b6fecfdb7ba8a5a3d01277c1b148d530

  • SHA256

    e07aa8e347888a9fa3c9a21614e799a72c12f84507a1f567331edfed03e79d23

  • SHA512

    72aa1600efe604f85072b467acbb0cb7684874d3c7483147a72eb01968ef044030c7033d3fcc522c36bab4f7994703c57e0bb1811526c60a18c24a0d8012754b

  • SSDEEP

    6144:IHejFCzqQIfr3Q8kM30Wl2sFqtcwD0NRhf7i8jFfcasWh:IHejFIqQ6D6M30WllotcwSf7i8j5c7W

Malware Config

Signatures

  • RedLine

    RedLine Stealer is a malware family written in C#, first appearing in early 2020.

  • RedLine payload 1 IoCs
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

  • Program crash 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 37 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\123.exe
    "C:\Users\Admin\AppData\Local\Temp\123.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:3100
    • C:\Windows\SysWOW64\WerFault.exe
      C:\Windows\SysWOW64\WerFault.exe -u -p 3100 -s 2600
      2⤵
      • Program crash
      PID:3320
  • C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 3100 -ip 3100
    1⤵
      PID:2036

    Network

    MITRE ATT&CK Enterprise v15

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3100-0-0x00000000747AE000-0x00000000747AF000-memory.dmp

      Filesize

      4KB

    • memory/3100-1-0x0000000000F90000-0x000000000103C000-memory.dmp

      Filesize

      688KB

    • memory/3100-2-0x00000000747A0000-0x0000000074F50000-memory.dmp

      Filesize

      7.7MB

    • memory/3100-3-0x0000000005930000-0x000000000594E000-memory.dmp

      Filesize

      120KB

    • memory/3100-4-0x00000000062F0000-0x0000000006894000-memory.dmp

      Filesize

      5.6MB

    • memory/3100-5-0x0000000005E30000-0x0000000005EC2000-memory.dmp

      Filesize

      584KB

    • memory/3100-6-0x0000000005FC0000-0x0000000005FCA000-memory.dmp

      Filesize

      40KB

    • memory/3100-7-0x00000000091A0000-0x00000000097B8000-memory.dmp

      Filesize

      6.1MB

    • memory/3100-8-0x0000000008CD0000-0x0000000008DDA000-memory.dmp

      Filesize

      1.0MB

    • memory/3100-9-0x0000000008C00000-0x0000000008C12000-memory.dmp

      Filesize

      72KB

    • memory/3100-10-0x0000000008C60000-0x0000000008C9C000-memory.dmp

      Filesize

      240KB

    • memory/3100-11-0x0000000008DE0000-0x0000000008E2C000-memory.dmp

      Filesize

      304KB

    • memory/3100-14-0x0000000009F30000-0x0000000009F96000-memory.dmp

      Filesize

      408KB

    • memory/3100-15-0x000000000A240000-0x000000000A2B6000-memory.dmp

      Filesize

      472KB

    • memory/3100-16-0x000000000A1E0000-0x000000000A1FE000-memory.dmp

      Filesize

      120KB

    • memory/3100-17-0x000000000A9D0000-0x000000000AB92000-memory.dmp

      Filesize

      1.8MB

    • memory/3100-18-0x000000000B750000-0x000000000BC7C000-memory.dmp

      Filesize

      5.2MB

    • memory/3100-19-0x00000000747A0000-0x0000000074F50000-memory.dmp

      Filesize

      7.7MB