Analysis
- max time kernel
58s - max time network
111s - platform
windows10_x64 - resource
win10v20210408 - submitted
18/04/2021, 13:02
General
- Target 4096b746fb975c1edbcb9b4d529b7b22.exe
- Size 1.6MB
- Sample210418-ny5b6nyppx
- SHA256 f9a7e1e888fadb9d98e593d75f1b76b0809721ad7efbd9882a9a88d45588ceb6
Malware Config
Signatures
- RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
- Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\4096b746fb975c1edbcb9b4d529b7b22.exe"C:\Users\Admin\AppData\Local\Temp\4096b746fb975c1edbcb9b4d529b7b22.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"{path}"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/740-132-0x00000000053D0000-0x00000000053D1000-memory.dmp
memory/740-133-0x00000000052A0000-0x00000000058A6000-memory.dmp
memory/740-140-0x0000000008540000-0x0000000008541000-memory.dmp
memory/740-139-0x0000000006600000-0x0000000006601000-memory.dmp
memory/740-138-0x0000000007360000-0x0000000007361000-memory.dmp
memory/740-137-0x0000000006C60000-0x0000000006C61000-memory.dmp
memory/740-134-0x0000000005640000-0x0000000005641000-memory.dmp
memory/740-125-0x0000000000400000-0x000000000042C000-memory.dmp
memory/740-131-0x0000000005390000-0x0000000005391000-memory.dmp
memory/740-129-0x00000000058B0000-0x00000000058B1000-memory.dmp
memory/740-130-0x0000000005330000-0x0000000005331000-memory.dmp
memory/784-124-0x000000000C120000-0x000000000C172000-memory.dmp
memory/784-116-0x00000000054C0000-0x00000000054C1000-memory.dmp
memory/784-123-0x00000000099A0000-0x0000000009A34000-memory.dmp
memory/784-114-0x0000000000460000-0x0000000000461000-memory.dmp
memory/784-122-0x0000000009760000-0x0000000009761000-memory.dmp
memory/784-121-0x0000000005430000-0x0000000005435000-memory.dmp
memory/784-120-0x0000000004FE0000-0x0000000004FE1000-memory.dmp
memory/784-118-0x0000000004F60000-0x0000000004F61000-memory.dmp
memory/784-119-0x0000000002860000-0x0000000002861000-memory.dmp
memory/784-117-0x0000000005060000-0x0000000005061000-memory.dmp