Analysis
-
max time kernel
142s -
max time network
146s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
20-04-2021 11:52
Static task
static1
Behavioral task
behavioral1
Sample
954b39f45379c530b7f659d697c29ac7.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
954b39f45379c530b7f659d697c29ac7.exe
Resource
win10v20210408
General
-
Target
954b39f45379c530b7f659d697c29ac7.exe
-
Size
487KB
-
MD5
954b39f45379c530b7f659d697c29ac7
-
SHA1
9fa7dcb754041cc878f6ca3a71581a04e3b23427
-
SHA256
301a510700f2ebccd25fc5cc6c579ead2196b957ed81aa3eda29c7bc40887c26
-
SHA512
aecda633e082d00a5d9989aad8e20e300372efdcdbe4f48991b7fb7f70079d7465f420c278167edf25656966c44ac03ab72c3f1aaa18962771bee63364e7a6d8
Malware Config
Extracted
redline
v113
45.150.67.141:8054
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/192-122-0x00000000004163C6-mapping.dmp family_redline behavioral2/memory/192-121-0x0000000000400000-0x000000000041C000-memory.dmp family_redline -
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral2/memory/624-120-0x00000000056F0000-0x00000000056FB000-memory.dmp agile_net -
Suspicious use of SetThreadContext 1 IoCs
Processes:
954b39f45379c530b7f659d697c29ac7.exedescription pid process target process PID 624 set thread context of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
954b39f45379c530b7f659d697c29ac7.exeAddInProcess32.exedescription pid process Token: SeDebugPrivilege 624 954b39f45379c530b7f659d697c29ac7.exe Token: SeDebugPrivilege 192 AddInProcess32.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
954b39f45379c530b7f659d697c29ac7.exedescription pid process target process PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe PID 624 wrote to memory of 192 624 954b39f45379c530b7f659d697c29ac7.exe AddInProcess32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\954b39f45379c530b7f659d697c29ac7.exe"C:\Users\Admin\AppData\Local\Temp\954b39f45379c530b7f659d697c29ac7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exeC:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe2⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/192-126-0x0000000002DD0000-0x0000000002DD1000-memory.dmpFilesize
4KB
-
memory/192-125-0x0000000005950000-0x0000000005951000-memory.dmpFilesize
4KB
-
memory/192-129-0x0000000005340000-0x0000000005946000-memory.dmpFilesize
6.0MB
-
memory/192-130-0x0000000005640000-0x0000000005641000-memory.dmpFilesize
4KB
-
memory/192-128-0x00000000053C0000-0x00000000053C1000-memory.dmpFilesize
4KB
-
memory/192-121-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/192-127-0x0000000005380000-0x0000000005381000-memory.dmpFilesize
4KB
-
memory/192-122-0x00000000004163C6-mapping.dmp
-
memory/624-116-0x00000000051F0000-0x00000000051F1000-memory.dmpFilesize
4KB
-
memory/624-114-0x0000000000920000-0x0000000000921000-memory.dmpFilesize
4KB
-
memory/624-120-0x00000000056F0000-0x00000000056FB000-memory.dmpFilesize
44KB
-
memory/624-119-0x00000000056E0000-0x00000000056E1000-memory.dmpFilesize
4KB
-
memory/624-118-0x0000000005150000-0x00000000051E2000-memory.dmpFilesize
584KB
-
memory/624-117-0x0000000005790000-0x0000000005791000-memory.dmpFilesize
4KB