Analysis
-
max time kernel
110s -
max time network
122s -
platform
windows10_x64 -
resource
win10-en-20211014 -
submitted
22-11-2021 23:53
Static task
static1
General
-
Target
62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe
-
Size
781KB
-
MD5
4755ebeea9d87c4435318808c218c8e9
-
SHA1
667a9a1d958e62e371e99b3881325f5a56163781
-
SHA256
62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5
-
SHA512
6042c20f20546de6659af5bb32f1d33c41c7049c2bfed295679d8e738a36c3955753e8f69ea49909d3aba04f3194c7ac700c6fc49d660730b512a62170ddbca8
Malware Config
Extracted
redline
raketa2
45.67.228.227:58696
Signatures
-
RedLine
RedLine Stealer is a malware family written in C#, first appearing in early 2020.
-
RedLine Payload 2 IoCs
Processes:
resource yara_rule behavioral1/memory/3412-122-0x0000000000400000-0x0000000000420000-memory.dmp family_redline behavioral1/memory/3412-123-0x0000000000418F0A-mapping.dmp family_redline -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Accesses cryptocurrency files/wallets, possible credential harvesting 2 TTPs
-
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exedescription pid process target process PID 4064 set thread context of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exepid process 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 3412 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exedescription pid process Token: SeDebugPrivilege 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe Token: SeDebugPrivilege 3412 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exedescription pid process target process PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe PID 4064 wrote to memory of 3412 4064 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe 62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe"C:\Users\Admin\AppData\Local\Temp\62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exeC:\Users\Admin\AppData\Local\Temp\62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\62aeb64c1246124c98369a008bd36e3d8c477480aa8247aba8586e96a8d4b2c5.exe.logMD5
daa436d058b25bdde9e2d6fe53c6ccf6
SHA13fc5d1eab28db05865915d8f6d9ecf85d9cc1d9e
SHA256afb0ed8659b214fe4251a87a1c0a362c123363497fbd50737c1ae36a9376c4cd
SHA51284f13582070ae4a3a9bb5e4b29620e659c258ab282e43e9bfa50528c08aae875d8c33cf3647fbb1253102af39b89f3b97f316e62f544355cc9c379e04fba960a
-
memory/3412-133-0x00000000052A0000-0x00000000052A1000-memory.dmpFilesize
4KB
-
memory/3412-138-0x0000000007330000-0x0000000007331000-memory.dmpFilesize
4KB
-
memory/3412-127-0x0000000005400000-0x0000000005401000-memory.dmpFilesize
4KB
-
memory/3412-139-0x00000000068F0000-0x00000000068F1000-memory.dmpFilesize
4KB
-
memory/3412-128-0x0000000004E70000-0x0000000004E71000-memory.dmpFilesize
4KB
-
memory/3412-122-0x0000000000400000-0x0000000000420000-memory.dmpFilesize
128KB
-
memory/3412-123-0x0000000000418F0A-mapping.dmp
-
memory/3412-129-0x0000000004FA0000-0x0000000004FA1000-memory.dmpFilesize
4KB
-
memory/3412-140-0x00000000079F0000-0x00000000079F1000-memory.dmpFilesize
4KB
-
memory/3412-136-0x0000000005A10000-0x0000000005A11000-memory.dmpFilesize
4KB
-
memory/3412-134-0x0000000005320000-0x0000000005321000-memory.dmpFilesize
4KB
-
memory/3412-130-0x0000000004ED0000-0x0000000004ED1000-memory.dmpFilesize
4KB
-
memory/3412-131-0x0000000004DF0000-0x00000000053F6000-memory.dmpFilesize
6.0MB
-
memory/3412-132-0x0000000004F10000-0x0000000004F11000-memory.dmpFilesize
4KB
-
memory/4064-115-0x00000000006D0000-0x00000000006D1000-memory.dmpFilesize
4KB
-
memory/4064-117-0x0000000005170000-0x0000000005171000-memory.dmpFilesize
4KB
-
memory/4064-118-0x0000000005800000-0x0000000005854000-memory.dmpFilesize
336KB
-
memory/4064-121-0x00000000058D0000-0x00000000058E8000-memory.dmpFilesize
96KB
-
memory/4064-120-0x0000000005EB0000-0x0000000005EB1000-memory.dmpFilesize
4KB
-
memory/4064-119-0x0000000005940000-0x0000000005941000-memory.dmpFilesize
4KB